File: manual.htm

package info (click to toggle)
splint 1%3A3.1.2%2Bdfsg-1
links: PTS, VCS
area: main
in suites: buster
size: 21,012 kB
ctags: 23,302
sloc: ansic: 150,869; yacc: 3,465; sh: 3,034; makefile: 2,160; lex: 412
file content (19268 lines) | stat: -rw-r--r-- 929,428 bytes
parent folder | download | duplicates (2)
<html>
<head>
<meta content=
"HTML Tidy for Solaris (vers 1st March 2003), see www.w3.org"
      name="generator">
<link rel="stylesheet" type="text/css" href=
"manual.css" title="style1">
<title>Splint Manual</title>
<style type="text/css">
<!--
 /* Font Definitions */
 @font-face
        {font-family:Helvetica;
        panose-1:2 11 5 4 2 2 2 2 2 4;}
@font-face
        {font-family:Courier;
        panose-1:2 7 4 9 2 2 5 2 4 4;}
@font-face
        {font-family:"Tms Rmn";
        panose-1:2 2 6 3 4 5 5 2 3 4;}
@font-face
        {font-family:Helv;
        panose-1:2 11 6 4 2 2 2 3 2 4;}
@font-face
        {font-family:"New York";
        panose-1:2 4 5 3 6 5 6 2 3 4;}
@font-face
        {font-family:System;
        panose-1:0 0 0 0 0 0 0 0 0 0;}
@font-face
        {font-family:Wingdings;
        panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
        {font-family:"MS Mincho";
        panose-1:2 2 6 9 4 2 5 8 3 4;}
@font-face
        {font-family:Batang;
        panose-1:2 3 6 0 0 1 1 1 1 1;}
@font-face
        {font-family:SimSun;
        panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
        {font-family:PMingLiU;
        panose-1:2 1 6 1 0 1 1 1 1 1;}
@font-face
        {font-family:"MS Gothic";
        panose-1:2 11 6 9 7 2 5 8 2 4;}
@font-face
        {font-family:Dotum;
        panose-1:2 11 6 0 0 1 1 1 1 1;}
@font-face
        {font-family:SimHei;
        panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
        {font-family:MingLiU;
        panose-1:2 1 6 9 0 1 1 1 1 1;}
@font-face
        {font-family:Mincho;
        panose-1:2 2 6 9 4 3 5 8 3 5;}
@font-face
        {font-family:Gulim;
        panose-1:2 11 6 0 0 1 1 1 1 1;}
@font-face
        {font-family:Century;
        panose-1:2 4 6 3 5 7 5 2 3 3;}
@font-face
        {font-family:"Angsana New";
        panose-1:2 2 6 3 5 4 5 2 3 4;}
@font-face
        {font-family:"Cordia New";
        panose-1:2 11 3 4 2 2 2 2 2 4;}
@font-face
        {font-family:Mangal;
        panose-1:0 0 4 0 0 0 0 0 0 0;}
@font-face
        {font-family:Latha;
        panose-1:0 0 4 0 0 0 0 0 0 0;}
@font-face
        {font-family:Sylfaen;
        panose-1:1 10 5 2 5 3 6 3 3 3;}
@font-face
        {font-family:Vrinda;
        panose-1:0 0 4 0 0 0 0 0 0 0;}
@font-face
        {font-family:Raavi;
        panose-1:0 0 4 0 0 0 0 0 0 0;}
@font-face
        {font-family:Shruti;
        panose-1:0 0 4 0 0 0 0 0 0 0;}
@font-face
        {font-family:Sendnya;
        panose-1:0 0 4 0 0 0 0 0 0 0;}
@font-face
        {font-family:Gautami;
        panose-1:0 0 4 0 0 0 0 0 0 0;}
@font-face
        {font-family:Tunga;
        panose-1:0 0 4 0 0 0 0 0 0 0;}
@font-face
        {font-family:"Estrangella Edessa";
        panose-1:0 0 0 0 0 0 0 0 0 0;}
@font-face
        {font-family:"Arial Unicode MS";
        panose-1:0 0 0 0 0 0 0 0 0 0;}
@font-face
        {font-family:Tahoma;
        panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
        {font-family:"Book Antiqua";
        panose-1:2 4 6 2 5 3 5 3 3 4;}
@font-face
        {font-family:"Arial Narrow";
        panose-1:2 11 5 6 2 2 2 3 2 4;}
@font-face
        {font-family:Times;
        panose-1:0 0 0 0 0 0 0 0 0 0;}
@font-face
        {font-family:Marlett;
        panose-1:0 0 0 0 0 0 0 0 0 0;}
@font-face
        {font-family:"News Gothic MT";
        panose-1:2 11 5 4 2 2 3 2 2 4;}
@font-face
        {font-family:"Lucida Sans Unicode";
        panose-1:2 11 6 2 3 5 4 2 2 4;}
@font-face
        {font-family:"Century Gothic";
        panose-1:2 11 5 2 2 2 2 2 2 4;}
@font-face
        {font-family:"Abadi MT Condensed Light";
        panose-1:2 11 3 6 3 1 1 1 1 3;}
@font-face
        {font-family:"Matisse ITC";
        panose-1:4 4 4 3 3 13 2 2 7 4;}
@font-face
        {font-family:Westminster;
        panose-1:4 4 5 6 3 15 2 2 7 2;}
@font-face
        {font-family:"Lucida Console";
        panose-1:2 11 6 9 4 5 4 2 2 4;}
@font-face
        {font-family:"Arial Black";
        panose-1:2 11 10 4 2 1 2 2 2 4;}
@font-face
        {font-family:"Comic Sans MS";
        panose-1:3 15 7 2 3 3 2 2 2 4;}
@font-face
        {font-family:Verdana;
        panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
        {font-family:Webdings;
        panose-1:5 3 1 2 1 5 9 6 7 3;}
@font-face
        {font-family:"Verdana Ref";
        panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
        {font-family:"Georgia Ref";
        panose-1:2 4 5 2 5 4 5 2 3 3;}
@font-face
        {font-family:RefSpecialty;
        panose-1:2 0 5 0 0 0 0 0 0 0;}
@font-face
        {font-family:"MS Reference 1";
        panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
        {font-family:"MS Reference 2";
        panose-1:0 0 0 0 0 0 0 0 0 0;}
@font-face
        {font-family:Money;
        panose-1:0 0 4 0 0 0 0 0 0 0;}
@font-face
        {font-family:"Mediascape OSD Icon";
        panose-1:2 11 6 3 5 3 2 2 2 4;}
@font-face
        {font-family:Pronto;
        panose-1:2 11 7 3 3 0 0 0 0 7;}
@font-face
        {font-family:"Agency FB";
        panose-1:0 1 6 6 4 0 0 4 0 3;}
@font-face
        {font-family:Algerian;
        panose-1:4 2 7 5 4 10 2 6 7 2;}
@font-face
        {font-family:"Arial Rounded MT Bold";
        panose-1:2 15 7 4 3 5 4 3 2 4;}
@font-face
        {font-family:"Baskerville Old Face";
        panose-1:2 2 6 2 8 5 5 2 3 3;}
@font-face
        {font-family:"Bauhaus 93";
        panose-1:4 3 9 5 2 11 2 2 12 2;}
@font-face
        {font-family:"Bell MT";
        panose-1:2 2 5 3 6 3 5 2 3 3;}
@font-face
        {font-family:"Berlin Sans FB";
        panose-1:2 14 6 2 2 5 2 2 3 6;}
@font-face
        {font-family:"Bernard MT Condensed";
        panose-1:2 5 8 6 6 9 5 2 4 4;}
@font-face
        {font-family:"Blackadder ITC";
        panose-1:4 2 5 5 5 16 7 2 13 2;}
@font-face
        {font-family:"Bookman Old Style";
        panose-1:2 5 6 4 5 5 5 2 2 4;}
@font-face
        {font-family:"Bradley Hand ITC";
        panose-1:3 7 4 2 5 3 2 3 2 3;}
@font-face
        {font-family:"Britannic Bold";
        panose-1:2 11 9 3 6 7 3 2 2 4;}
@font-face
        {font-family:Broadway;
        panose-1:4 4 9 5 8 11 2 2 5 2;}
@font-face
        {font-family:"Brush Script MT";
        panose-1:3 6 8 2 4 4 6 7 3 4;}
@font-face
        {font-family:"Californian FB";
        panose-1:2 7 4 3 6 8 11 3 2 4;}
@font-face
        {font-family:"Calisto MT";
        panose-1:2 4 6 3 5 5 5 3 3 4;}
@font-face
        {font-family:Castellar;
        panose-1:2 10 4 2 6 4 6 1 3 1;}
@font-face
        {font-family:Centaur;
        panose-1:2 3 5 4 5 2 5 2 3 4;}
@font-face
        {font-family:"Century Schoolbook";
        panose-1:2 4 6 4 5 5 5 2 3 4;}
@font-face
        {font-family:Chiller;
        panose-1:4 2 4 4 3 16 7 2 6 2;}
@font-face
        {font-family:"Colonna MT";
        panose-1:4 2 8 5 6 2 2 3 2 3;}
@font-face
        {font-family:"Cooper Black";
        panose-1:2 8 9 4 4 3 11 2 4 4;}
@font-face
        {font-family:"Copperplate Gothic Bold";
        panose-1:2 14 7 5 2 2 6 2 4 4;}
@font-face
        {font-family:"Copperplate Gothic Light";
        panose-1:2 14 5 7 2 2 6 2 4 4;}
@font-face
        {font-family:"Curlz MT";
        panose-1:4 4 4 4 5 7 2 2 2 2;}
@font-face
        {font-family:"Edwardian Script ITC";
        panose-1:3 3 3 2 4 7 7 13 8 4;}
@font-face
        {font-family:Elephant;
        panose-1:2 2 9 4 9 5 5 2 3 3;}
@font-face
        {font-family:"Engravers MT";
        panose-1:2 9 7 7 8 5 5 2 3 4;}
@font-face
        {font-family:"Eras Bold ITC";
        panose-1:2 11 9 7 3 5 4 2 2 4;}
@font-face
        {font-family:"Eras Demi ITC";
        panose-1:2 11 8 5 3 5 4 2 8 4;}
@font-face
        {font-family:"Eras Light ITC";
        panose-1:2 11 4 2 3 5 4 2 8 4;}
@font-face
        {font-family:"Eras Medium ITC";
        panose-1:2 11 6 2 3 5 4 2 8 4;}
@font-face
        {font-family:"Felix Titling";
        panose-1:4 6 5 5 6 2 2 2 10 4;}
@font-face
        {font-family:"Footlight MT Light";
        panose-1:2 4 6 2 6 3 10 2 3 4;}
@font-face
        {font-family:Forte;
        panose-1:3 6 9 2 4 5 2 7 2 3;}
@font-face
        {font-family:"Franklin Gothic Book";
        panose-1:2 11 5 3 2 1 2 2 2 4;}
@font-face
        {font-family:"Franklin Gothic Demi";
        panose-1:2 11 7 3 2 1 2 2 2 4;}
@font-face
        {font-family:"Franklin Gothic Demi Cond";
        panose-1:2 11 7 6 3 4 2 2 2 4;}
@font-face
        {font-family:"Franklin Gothic Heavy";
        panose-1:2 11 9 3 2 1 2 2 2 4;}
@font-face
        {font-family:"Franklin Gothic Medium";
        panose-1:2 11 6 3 2 1 2 2 2 4;}
@font-face
        {font-family:"Franklin Gothic Medium Cond";
        panose-1:2 11 6 6 3 4 2 2 2 4;}
@font-face
        {font-family:"Freestyle Script";
        panose-1:3 8 4 2 3 2 5 11 4 4;}
@font-face
        {font-family:"French Script MT";
        panose-1:3 2 4 2 4 6 7 4 6 5;}
@font-face
        {font-family:Garamond;
        panose-1:2 2 4 4 3 3 1 1 8 3;}
@font-face
        {font-family:Gigi;
        panose-1:4 4 5 4 6 16 7 2 13 2;}
@font-face
        {font-family:"Gill Sans MT";
        panose-1:2 11 5 2 2 1 4 2 2 3;}
@font-face
        {font-family:"Gill Sans MT Condensed";
        panose-1:2 11 5 6 2 1 4 2 2 3;}
@font-face
        {font-family:"Gill Sans Ultra Bold";
        panose-1:2 11 10 2 2 1 4 2 2 3;}
@font-face
        {font-family:"Gill Sans Ultra Bold Condensed";
        panose-1:2 11 10 6 2 1 4 2 2 3;}
@font-face
        {font-family:"Gill Sans MT Ext Condensed Bold";
        panose-1:2 11 9 2 2 1 4 2 2 3;}
@font-face
        {font-family:"Gloucester MT Extra Condensed";
        panose-1:2 3 8 8 2 6 1 1 1 1;}
@font-face
        {font-family:"Goudy Old Style";
        panose-1:2 2 5 2 5 3 5 2 3 3;}
@font-face
        {font-family:"Goudy Stout";
        panose-1:2 2 9 4 7 3 11 2 4 1;}
@font-face
        {font-family:Haettenschweiler;
        panose-1:2 11 7 6 4 9 2 6 2 4;}
@font-face
        {font-family:"Harlow Solid Italic";
        panose-1:4 3 6 4 2 15 2 2 13 2;}
@font-face
        {font-family:Harrington;
        panose-1:4 4 5 5 5 10 2 2 7 2;}
@font-face
        {font-family:"High Tower Text";
        panose-1:2 4 5 2 5 5 6 3 3 3;}
@font-face
        {font-family:"Imprint MT Shadow";
        panose-1:4 2 6 5 6 3 3 3 2 2;}
@font-face
        {font-family:Jokerman;
        panose-1:4 9 6 5 6 13 6 2 7 2;}
@font-face
        {font-family:"Juice ITC";
        panose-1:4 4 4 3 4 10 2 2 2 2;}
@font-face
        {font-family:"Kristen ITC";
        panose-1:3 5 5 2 4 2 2 3 2 2;}
@font-face
        {font-family:"Kunstler Script";
        panose-1:3 3 4 2 2 6 7 13 13 6;}
@font-face
        {font-family:"Lucida Bright";
        panose-1:2 4 6 2 5 5 5 2 3 4;}
@font-face
        {font-family:"Lucida Calligraphy";
        panose-1:3 1 1 1 1 1 1 1 1 1;}
@font-face
        {font-family:"Lucida Fax";
        panose-1:2 6 6 2 5 5 5 2 2 4;}
@font-face
        {font-family:"Lucida Handwriting";
        panose-1:3 1 1 1 1 1 1 1 1 1;}
@font-face
        {font-family:"Lucida Sans";
        panose-1:2 11 6 2 3 5 4 2 2 4;}
@font-face
        {font-family:"Lucida Sans Typewriter";
        panose-1:2 11 5 9 3 5 4 3 2 4;}
@font-face
        {font-family:Magneto;
        panose-1:4 3 8 5 5 8 2 2 13 2;}
@font-face
        {font-family:"Maiandra GD";
        panose-1:2 14 5 2 3 3 8 2 2 4;}
@font-face
        {font-family:"Matura MT Script Capitals";
        panose-1:3 2 8 2 6 6 2 7 2 2;}
@font-face
        {font-family:Mistral;
        panose-1:3 9 7 2 3 4 7 2 4 3;}
@font-face
        {font-family:"Modern No\. 20";
        panose-1:2 7 7 4 7 5 5 2 3 3;}
@font-face
        {font-family:"Niagara Engraved";
        panose-1:4 2 5 2 7 7 3 3 2 2;}
@font-face
        {font-family:"Niagara Solid";
        panose-1:4 2 5 2 7 7 2 2 2 2;}
@font-face
        {font-family:"OCR A Extended";
        panose-1:2 1 5 9 2 1 2 1 3 3;}
@font-face
        {font-family:"Old English Text MT";
        panose-1:3 4 9 2 4 5 8 3 8 6;}
@font-face
        {font-family:Onyx;
        panose-1:4 5 6 2 8 7 2 2 2 3;}
@font-face
        {font-family:"Palace Script MT";
        panose-1:3 3 3 2 2 6 7 12 11 5;}
@font-face
        {font-family:Papyrus;
        panose-1:3 7 5 2 6 5 2 3 2 5;}
@font-face
        {font-family:Parchment;
        panose-1:3 4 6 2 4 7 8 4 8 4;}
@font-face
        {font-family:Perpetua;
        panose-1:2 2 5 2 6 4 1 2 3 3;}
@font-face
        {font-family:"Perpetua Titling MT";
        panose-1:2 2 5 2 6 5 5 2 8 4;}
@font-face
        {font-family:Playbill;
        panose-1:4 5 6 3 10 6 2 2 2 2;}
@font-face
        {font-family:"Poor Richard";
        panose-1:2 8 5 2 5 5 5 2 7 2;}
@font-face
        {font-family:Pristina;
        panose-1:3 6 4 2 4 4 6 8 2 4;}
@font-face
        {font-family:"Rage Italic";
        panose-1:3 7 5 2 4 5 7 7 3 4;}
@font-face
        {font-family:Ravie;
        panose-1:4 4 8 5 5 8 9 2 6 2;}
@font-face
        {font-family:Rockwell;
        panose-1:2 6 6 3 2 2 5 2 4 3;}
@font-face
        {font-family:"Rockwell Condensed";
        panose-1:2 6 6 3 5 4 5 2 1 4;}
@font-face
        {font-family:"Rockwell Extra Bold";
        panose-1:2 6 9 3 4 5 5 2 4 3;}
@font-face
        {font-family:"Informal Roman";
        panose-1:3 6 4 2 3 4 6 11 2 4;}
@font-face
        {font-family:"Script MT Bold";
        panose-1:3 4 6 2 4 6 7 8 9 4;}
@font-face
        {font-family:"Showcard Gothic";
        panose-1:4 2 9 4 2 1 2 2 6 4;}
@font-face
        {font-family:"Snap ITC";
        panose-1:4 4 10 7 6 10 2 2 2 2;}
@font-face
        {font-family:Stencil;
        panose-1:4 4 9 5 13 8 2 2 4 4;}
@font-face
        {font-family:"Tempus Sans ITC";
        panose-1:4 2 4 4 3 13 7 2 2 2;}
@font-face
        {font-family:"Trebuchet MS";
        panose-1:2 11 6 3 2 2 2 2 2 4;}
@font-face
        {font-family:"Tw Cen MT";
        panose-1:2 11 6 2 2 1 4 2 6 3;}
@font-face
        {font-family:"Tw Cen MT Condensed";
        panose-1:2 11 6 6 2 1 4 2 2 3;}
@font-face
        {font-family:"Viner Hand ITC";
        panose-1:3 7 5 2 3 5 2 2 2 3;}
@font-face
        {font-family:Vivaldi;
        panose-1:3 2 6 2 5 5 6 9 8 4;}
@font-face
        {font-family:"Vladimir Script";
        panose-1:3 5 4 2 4 4 7 7 3 5;}
@font-face
        {font-family:"Wide Latin";
        panose-1:2 10 10 7 5 5 5 2 4 4;}
@font-face
        {font-family:"Wingdings 2";
        panose-1:5 2 1 2 1 5 7 7 7 7;}
@font-face
        {font-family:"Wingdings 3";
        panose-1:5 4 1 2 1 8 7 7 7 7;}
@font-face
        {font-family:"Berlin Sans FB Demi";
        panose-1:2 14 8 2 2 5 2 2 3 6;}
@font-face
        {font-family:"Tw Cen MT Condensed Extra Bold";
        panose-1:2 11 8 3 2 0 0 0 0 4;}
@font-face
        {font-family:"Almanac MT";
        panose-1:5 1 1 1 1 1 1 1 1 1;}
@font-face
        {font-family:"Beesknees ITC";
        panose-1:4 4 10 5 5 13 2 2 5 2;}
@font-face
        {font-family:"Holidays MT";
        panose-1:5 1 1 1 1 1 1 1 1 1;}
@font-face
        {font-family:"Monotype Sorts";
        panose-1:1 1 6 1 1 1 1 1 1 1;}
@font-face
        {font-family:"Monotype Sorts 2";
        panose-1:5 2 1 2 1 2 8 2 8 8;}
@font-face
        {font-family:"Pepita MT";
        panose-1:3 6 4 2 4 5 2 7 8 4;}
@font-face
        {font-family:"Vacation MT";
        panose-1:5 1 1 1 1 1 1 1 1 1;}
@font-face
        {font-family:"Map Symbols";
        panose-1:0 5 1 2 1 7 6 2 5 7;}
@font-face
        {font-family:"Bookshelf Symbol 3";
        panose-1:5 5 1 2 1 7 6 2 5 7;}
@font-face
        {font-family:Georgia;
        panose-1:2 4 5 2 5 4 5 2 3 3;}
@font-face
        {font-family:"MS Outlook";
        panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
        {font-family:"Berling Antiqua";
        panose-1:2 2 6 2 6 4 5 3 4 2;}
@font-face
        {font-family:Bookdings;
        panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
        {font-family:"Frutiger Linotype";
        panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
        {font-family:"Andale Mono";
        panose-1:2 11 5 9 0 0 0 0 0 4;}
@font-face
        {font-family:Impact;
        panose-1:2 11 8 6 3 9 2 5 2 4;}
@font-face
        {font-family:"Monotype Corsiva";
        panose-1:3 1 1 1 1 2 1 1 1 1;}
@font-face
        {font-family:"MT Extra";
        panose-1:5 5 1 2 1 2 5 2 2 2;}
@font-face
        {font-family:ProgramTwo;
        panose-1:0 0 0 0 0 0 0 0 0 0;}
 /* Style Definitions */
 p.MsoNormal, li.MsoNormal, div.MsoNormal
        {margin:0in;
        margin-bottom:.0001pt;
        text-align:justify;
        font-size:11.0pt;
        font-family:"Times New Roman";}
h1
        {margin-top:12.0pt;
        margin-right:0in;
        margin-bottom:3.0pt;
        margin-left:0in;
        text-align:justify;
        text-indent:0in;
        page-break-before:always;
        page-break-after:avoid;
        font-size:16.0pt;
        font-family:"Times New Roman";}
h2
        {margin-top:12.0pt;
        margin-right:0in;
        margin-bottom:3.0pt;
        margin-left:0in;
        text-align:justify;
        text-indent:0in;
        page-break-after:avoid;
        font-size:14.0pt;
        font-family:"Times New Roman";}
h3
        {margin-top:12.0pt;
        margin-right:0in;
        margin-bottom:3.0pt;
        margin-left:0in;
        text-align:justify;
        text-indent:0in;
        page-break-after:avoid;
        font-size:12.0pt;
        font-family:"Times New Roman";}
h4
        {margin-top:12.0pt;
        margin-right:0in;
        margin-bottom:3.0pt;
        margin-left:0in;
        text-align:justify;
        text-indent:0in;
        page-break-after:avoid;
        font-size:12.0pt;
        font-family:"Times New Roman";}
h5
        {margin-top:12.0pt;
        margin-right:0in;
        margin-bottom:3.0pt;
        margin-left:0in;
        text-align:justify;
        text-indent:0in;
        font-size:11.0pt;
        font-family:"Times New Roman";
        font-weight:normal;}
h6
        {margin-top:12.0pt;
        margin-right:0in;
        margin-bottom:3.0pt;
        margin-left:0in;
        text-align:justify;
        text-indent:0in;
        font-size:11.0pt;
        font-family:"Times New Roman";
        font-weight:normal;
        font-style:italic;}
p.MsoHeading7, li.MsoHeading7, div.MsoHeading7
        {margin-top:12.0pt;
        margin-right:0in;
        margin-bottom:3.0pt;
        margin-left:0in;
        text-align:justify;
        text-indent:0in;
        page-break-before:always;
        page-break-after:avoid;
        font-size:16.0pt;
        font-family:"Times New Roman";
        font-weight:bold;}
p.MsoHeading8, li.MsoHeading8, div.MsoHeading8
        {margin-top:12.0pt;
        margin-right:0in;
        margin-bottom:3.0pt;
        margin-left:0in;
        text-align:justify;
        text-indent:0in;
        page-break-after:avoid;
        font-size:14.0pt;
        font-family:"Times New Roman";
        font-weight:bold;}
p.MsoHeading9, li.MsoHeading9, div.MsoHeading9
        {margin-top:12.0pt;
        margin-right:0in;
        margin-bottom:3.0pt;
        margin-left:0in;
        text-align:justify;
        text-indent:0in;
        page-break-after:avoid;
        font-size:12.0pt;
        font-family:"Times New Roman";
        font-weight:bold;}
p.MsoIndex1, li.MsoIndex1, div.MsoIndex1
        {margin-top:0in;
        margin-right:0in;
        margin-bottom:0in;
        margin-left:10.0pt;
        margin-bottom:.0001pt;
        text-align:justify;
        text-indent:-10.0pt;
        font-size:11.0pt;
        font-family:"Times New Roman";}
p.MsoIndex2, li.MsoIndex2, div.MsoIndex2
        {margin-top:0in;
        margin-right:0in;
        margin-bottom:0in;
        margin-left:20.0pt;
        margin-bottom:.0001pt;
        text-align:justify;
        text-indent:-10.0pt;
        font-size:11.0pt;
        font-family:"Times New Roman";}
p.MsoIndex3, li.MsoIndex3, div.MsoIndex3
        {margin-top:0in;
        margin-right:0in;
        margin-bottom:0in;
        margin-left:30.0pt;
        margin-bottom:.0001pt;
        text-align:justify;
        text-indent:-10.0pt;
        font-size:11.0pt;
        font-family:"Times New Roman";}
p.MsoIndex4, li.MsoIndex4, div.MsoIndex4
        {margin-top:0in;
        margin-right:0in;
        margin-bottom:0in;
        margin-left:40.0pt;
        margin-bottom:.0001pt;
        text-align:justify;
        text-indent:-10.0pt;
        font-size:11.0pt;
        font-family:"Times New Roman";}
p.MsoIndex5, li.MsoIndex5, div.MsoIndex5
        {margin-top:0in;
        margin-right:0in;
        margin-bottom:0in;
        margin-left:50.0pt;
        margin-bottom:.0001pt;
        text-align:justify;
        text-indent:-10.0pt;
        font-size:11.0pt;
        font-family:"Times New Roman";}
p.MsoIndex6, li.MsoIndex6, div.MsoIndex6
        {margin-top:0in;
        margin-right:0in;
        margin-bottom:0in;
        margin-left:60.0pt;
        margin-bottom:.0001pt;
        text-align:justify;
        text-indent:-10.0pt;
        font-size:11.0pt;
        font-family:"Times New Roman";}
p.MsoIndex7, li.MsoIndex7, div.MsoIndex7
        {margin-top:0in;
        margin-right:0in;
        margin-bottom:0in;
        margin-left:70.0pt;
        margin-bottom:.0001pt;
        text-align:justify;
        text-indent:-10.0pt;
        font-size:11.0pt;
        font-family:"Times New Roman";}
p.MsoIndex8, li.MsoIndex8, div.MsoIndex8
        {margin-top:0in;
        margin-right:0in;
        margin-bottom:0in;
        margin-left:80.0pt;
        margin-bottom:.0001pt;
        text-align:justify;
        text-indent:-10.0pt;
        font-size:11.0pt;
        font-family:"Times New Roman";}
p.MsoIndex9, li.MsoIndex9, div.MsoIndex9
        {margin-top:0in;
        margin-right:0in;
        margin-bottom:0in;
        margin-left:1.25in;
        margin-bottom:.0001pt;
        text-align:justify;
        text-indent:-10.0pt;
        font-size:11.0pt;
        font-family:"Times New Roman";}
p.MsoToc1, li.MsoToc1, div.MsoToc1
        {margin-top:9.0pt;
        margin-right:0in;
        margin-bottom:4.0pt;
        margin-left:0in;
        text-align:justify;
        font-size:11.0pt;
        font-family:"Times New Roman";
        font-weight:bold;}
p.MsoToc2, li.MsoToc2, div.MsoToc2
        {margin-top:4.0pt;
        margin-right:0in;
        margin-bottom:0in;
        margin-left:.15in;
        margin-bottom:.0001pt;
        text-align:justify;
        font-size:11.0pt;
        font-family:"Times New Roman";}
p.MsoToc3, li.MsoToc3, div.MsoToc3
        {margin-top:0in;
        margin-right:0in;
        margin-bottom:0in;
        margin-left:22.3pt;
        margin-bottom:.0001pt;
        text-align:justify;
        font-size:11.0pt;
        font-family:"Times New Roman";}
p.MsoToc4, li.MsoToc4, div.MsoToc4
        {margin-top:0in;
        margin-right:0in;
        margin-bottom:0in;
        margin-left:30.0pt;
        margin-bottom:.0001pt;
        text-align:justify;
        font-size:11.0pt;
        font-family:"Times New Roman";}
p.MsoToc5, li.MsoToc5, div.MsoToc5
        {margin-top:0in;
        margin-right:0in;
        margin-bottom:0in;
        margin-left:40.0pt;
        margin-bottom:.0001pt;
        text-align:justify;
        font-size:11.0pt;
        font-family:"Times New Roman";}
p.MsoToc6, li.MsoToc6, div.MsoToc6
        {margin-top:0in;
        margin-right:0in;
        margin-bottom:0in;
        margin-left:50.0pt;
        margin-bottom:.0001pt;
        text-align:justify;
        font-size:11.0pt;
        font-family:"Times New Roman";}
p.MsoToc7, li.MsoToc7, div.MsoToc7
        {margin-top:0in;
        margin-right:0in;
        margin-bottom:0in;
        margin-left:60.0pt;
        margin-bottom:.0001pt;
        text-align:justify;
        font-size:11.0pt;
        font-family:"Times New Roman";}
p.MsoToc8, li.MsoToc8, div.MsoToc8
        {margin-top:0in;
        margin-right:0in;
        margin-bottom:0in;
        margin-left:70.0pt;
        margin-bottom:.0001pt;
        text-align:justify;
        font-size:11.0pt;
        font-family:"Times New Roman";}
p.MsoToc9, li.MsoToc9, div.MsoToc9
        {margin-top:0in;
        margin-right:0in;
        margin-bottom:0in;
        margin-left:80.0pt;
        margin-bottom:.0001pt;
        text-align:justify;
        font-size:11.0pt;
        font-family:"Times New Roman";}
p.MsoFootnoteText, li.MsoFootnoteText, div.MsoFootnoteText
        {margin:0in;
        margin-bottom:.0001pt;
        text-align:justify;
        font-size:10.0pt;
        font-family:"Times New Roman";}
p.MsoCommentText, li.MsoCommentText, div.MsoCommentText
        {margin:0in;
        margin-bottom:.0001pt;
        text-align:justify;
        font-size:20.0pt;
        font-family:"Times New Roman";}
p.MsoHeader, li.MsoHeader, div.MsoHeader
        {margin:0in;
        margin-bottom:.0001pt;
        text-align:justify;
        font-size:11.0pt;
        font-family:"Times New Roman";
        font-weight:bold;
        font-style:italic;}
p.MsoFooter, li.MsoFooter, div.MsoFooter
        {margin:0in;
        margin-bottom:.0001pt;
        text-align:justify;
        font-size:20.0pt;
        font-family:"Times New Roman";}
p.MsoIndexHeading, li.MsoIndexHeading, div.MsoIndexHeading
        {margin:0in;
        margin-bottom:.0001pt;
        text-align:justify;
        font-size:11.0pt;
        font-family:"Times New Roman";}
p.MsoCaption, li.MsoCaption, div.MsoCaption
        {margin-top:6.0pt;
        margin-right:0in;
        margin-bottom:6.0pt;
        margin-left:0in;
        text-align:center;
        font-size:10.0pt;
        font-family:"Times New Roman";
        font-weight:bold;}
p.MsoTof, li.MsoTof, div.MsoTof
        {margin-top:0in;
        margin-right:0in;
        margin-bottom:0in;
        margin-left:22.0pt;
        margin-bottom:.0001pt;
        text-align:justify;
        text-indent:-22.0pt;
        font-size:11.0pt;
        font-family:"Times New Roman";}
span.MsoFootnoteReference
        {vertical-align:super;}
span.MsoPageNumber
        {vertical-align:baseline;}
p.MsoListBullet, li.MsoListBullet, div.MsoListBullet
        {margin-top:0in;
        margin-right:0in;
        margin-bottom:0in;
        margin-left:12.95pt;
        margin-bottom:.0001pt;
        text-align:justify;
        text-indent:-12.95pt;
        font-size:11.0pt;
        font-family:"Times New Roman";}
p.MsoTitle, li.MsoTitle, div.MsoTitle
        {margin-top:12.0pt;
        margin-right:0in;
        margin-bottom:3.0pt;
        margin-left:0in;
        text-align:center;
        font-size:16.0pt;
        font-family:Arial;
        font-weight:bold;}
p.MsoSubtitle, li.MsoSubtitle, div.MsoSubtitle
        {margin-top:0in;
        margin-right:0in;
        margin-bottom:3.0pt;
        margin-left:0in;
        text-align:center;
        font-size:12.0pt;
        font-family:Arial;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
        {margin:0in;
        margin-bottom:.0001pt;
        line-height:200%;
        font-size:11.0pt;
        font-family:"Times New Roman";}
pre
        {margin:0in;
        margin-bottom:.0001pt;
        font-size:10.0pt;
        font-family:"Courier New";}
p.TextFontCX, li.TextFontCX, div.TextFontCX
        {margin:0in;
        margin-bottom:.0001pt;
        text-align:justify;
        font-size:11.0pt;
        font-family:"Times New Roman";}
p.Appendix, li.Appendix, div.Appendix
        {margin-top:12.0pt;
        margin-right:0in;
        margin-bottom:3.0pt;
        margin-left:0in;
        text-align:justify;
        page-break-after:avoid;
        font-size:14.0pt;
        font-family:"Times New Roman";
        font-weight:bold;}
p.Heading10, li.Heading10, div.Heading10
        {margin-top:12.0pt;
        margin-right:0in;
        margin-bottom:3.0pt;
        margin-left:0in;
        text-align:justify;
        page-break-after:avoid;
        font-size:12.0pt;
        font-family:"Times New Roman";
        letter-spacing:-.4pt;
        font-weight:bold;}
p.Heading11, li.Heading11, div.Heading11
        {margin-top:12.0pt;
        margin-right:0in;
        margin-bottom:3.0pt;
        margin-left:0in;
        text-align:justify;
        page-break-after:avoid;
        font-size:11.0pt;
        font-family:"Times New Roman";
        letter-spacing:-.4pt;
        font-weight:bold;
        font-style:italic;}
span.Flag
        {font-family:Tahoma;
        }
span.Annot
        {font-family:Tahoma;
        }
span.PlainText
        {font-family:"Courier New";}
span.Keyword
        {font-family:"Courier New";
        }
span.Line
        {font-family:Arial;
        font-style:italic;}
span.implicit
        {font-family:"Courier New";
        color:gray;
        font-style:italic;}
span.HeadingNote
        {font-family:"Times New Roman";
        font-style:italic;}
p.Author, li.Author, div.Author
        {margin-top:0in;
        margin-right:0in;
        margin-bottom:3.0pt;
        margin-left:0in;
        text-align:center;
        font-size:14.0pt;
        font-family:Arial;
        font-style:italic;}
p.Verbatim, li.Verbatim, div.Verbatim
        {margin:0in;
        margin-bottom:.0001pt;
        font-size:10.0pt;
        font-family:"Courier New";
        text-align:left}
p.lclintrun, li.lclintrun, div.lclintrun
        {margin:0in;
        margin-bottom:.0001pt;
        font-size:11.0pt;
        font-family:"Arial Narrow";}
p.IndentText, li.IndentText, div.IndentText
        {margin-top:0in;
        margin-right:.2in;
        margin-bottom:0in;
        margin-left:.2in;
        margin-bottom:.0001pt;
        text-align:left;
        font-size:11.0pt;
        font-family:"Times New Roman";}
p.beforelist, li.beforelist, div.beforelist
        {margin-top:0in;
        margin-right:0in;
        margin-bottom:6.0pt;
        margin-left:0in;
        text-align:justify;
        font-size:11.0pt;
        font-family:"Times New Roman";}
p.example, li.example, div.example
        {margin-top:6.0pt;
        margin-right:.2in;
        margin-bottom:6.0pt;
        margin-left:.2in;
        font-size:9.5pt;
        font-family:"Courier New";
        text-align=left}
p.skiplist, li.skiplist, div.skiplist
        {margin-top:6.0pt;
        margin-right:0in;
        margin-bottom:0in;
        margin-left:0in;
        margin-bottom:.0001pt;
        text-align:justify;
        font-size:11.0pt;
        font-family:"Times New Roman";}
p.afterlist, li.afterlist, div.afterlist
        {margin-top:6.0pt;
        margin-right:0in;
        margin-bottom:0in;
        margin-left:0in;
        margin-bottom:.0001pt;
        text-align:justify;
        font-size:11.0pt;
        font-family:"Times New Roman";}
p.betweenlists, li.betweenlists, div.betweenlists
        {margin-top:6.0pt;
        margin-right:0in;
        margin-bottom:6.0pt;
        margin-left:0in;
        text-align:justify;
        font-size:11.0pt;
        font-family:"Times New Roman";}
p.indentbefore, li.indentbefore, div.indentbefore
        {margin-top:0in;
        margin-right:.2in;
        margin-bottom:6.0pt;
        margin-left:.2in;
        font-size:11.0pt;
        text-align:left;
        font-family:"Times New Roman";}
p.indentbefore0, li.indentbefore0, div.indentbefore0
        {margin-top:0in;
        margin-right:.2in;
        margin-bottom:6.0pt;
        margin-left:.2in;
        font-size:11.0pt;
        text-align:left;
        font-family:"Times New Roman";}
span.CodeText
        {font-family:Arial;
        }
p.Sidebar, li.Sidebar, div.Sidebar
        {margin:0in;
        margin-bottom:.0001pt;
        font-size:9.0pt;
        font-family:"Times New Roman";}
p.URL, li.URL, div.URL
        {margin:0in;
        margin-bottom:.0001pt;
        text-align:justify;
        font-size:10.0pt;
        font-family:Arial;}
span.StyleKeywordBold
        {font-family:"Courier New";
        color:white;
        font-weight:bold;}
p.ProgramName, li.ProgramName, div.ProgramName
        {margin:0in;
        margin-bottom:.0001pt;
        text-align:justify;
        font-size:10.0pt;
        font-family:Arial;}
span.Style1
        {font-family:"Courier New";}
span.ProgramNameChar
        {font-family:Arial;}
span.ProgramCode
        {font-family:ProgramTwo;
        }
p.fileName, li.fileName, div.fileName
        {margin-top:0in;
        margin-right:.2in;
        margin-bottom:0in;
        margin-left:.2in;
        margin-bottom:.0001pt;
        font-size:10.0pt;
        font-family:Arial;}
p.FileName0, li.FileName0, div.FileName0
        {margin-top:0in;
        margin-right:.2in;
        margin-bottom:0in;
        margin-left:.2in;
        margin-bottom:.0001pt;
        font-size:10.0pt;
        font-family:Arial;}
span.FileNameChar
        {font-family:Arial;}
ins
        {text-decoration:none;}
span.msoIns
        {text-decoration:underline;}
span.msoDel
        {text-decoration:line-through;
        color:red;}
 /* Page Definitions */
 @page Section1
        {size:8.5in 11.0in;
        margin:1.0in 1.25in .75in 1.25in;}
div.Section1
        {page:Section1;}
@page Section2
        {size:8.5in 11.0in;
        margin:1.0in 1.25in 1.0in 99.35pt;}
div.Section2
        {page:Section2;}
@page Section3
        {size:8.5in 11.0in;
        margin:1.0in 1.25in 1.0in 99.35pt;}
div.Section3
        {page:Section3;}
@page Section4
        {size:8.5in 11.0in;
        margin:1.0in 1.25in 1.0in 99.0pt;}
div.Section4
        {page:Section4;}
@page Section5
        {size:8.5in 11.0in;
        margin:1.0in 1.25in 1.0in 1.25in;}
div.Section5
        {page:Section5;}
@page Section6
        {size:8.5in 11.0in;
        margin:1.0in 1.25in 1.0in 1.25in;}
div.Section6
        {page:Section6;}
@page Section7
        {size:8.5in 11.0in;
        margin:1.0in 1.25in 1.0in 1.25in;}
div.Section7
        {page:Section7;}
@page Section8
        {size:8.5in 11.0in;
        margin:1.0in 1.25in 1.0in 1.25in;}
div.Section8
        {page:Section8;}
 /* List Definitions */
 ol
        {margin-bottom:0in;}
ul
        {margin-bottom:0in;}
-->
</style>
</head>
<body>
<!--#include virtual="header.html"-->
<div class="Section1">
<p class="MsoTitle"><img width="189" height="219" src=
"manual-301_files/image001.jpg" hspace="12"><a name=
"_Ref533872469"></a></p>
<p class="MsoTitle"><a name="_Ref483663680"></a><span class=
"MsoCommentReference"><span style=
'font-size:20.0pt'>&nbsp;</span></span></p>
<p class="MsoTitle"><span class=
      "MsoCommentReference"><span style='font-size:26.0pt; font-family:"Book Antiqua"'>
&nbsp;</span></span></p>
<p class="MsoTitle"><span class=
      "MsoCommentReference"><span style='font-size:26.0pt; font-family:"Book Antiqua"'>
&nbsp;</span></span></p>
<p class="MsoTitle"><span class=
      "MsoCommentReference"><span style='font-size:26.0pt; font-family:"Book Antiqua"'>
&nbsp;</span></span></p>
<p class="MsoTitle"><span class=
      "MsoCommentReference"><span style='font-size:26.0pt; font-family:"Book Antiqua"'>
Splint Manual</span></span></p>
<p class="MsoTitle"><span class=
      "MsoCommentReference"><span style='font-size:26.0pt; font-family:"Book Antiqua"'>
&nbsp;</span></span></p>
<p class="MsoSubtitle"><span class=
"MsoCommentReference"><span style=
'font-size: 18.0pt;font-family:"Book Antiqua"'>Version
3.1.1</span></span></p>
<p class="MsoSubtitle"><span class=
"MsoCommentReference"><span style=
'font-size: 18.0pt;font-family:"Book Antiqua"'>27 April 2003
</span></span></p>
<p class="MsoSubtitle"><span class=
"MsoCommentReference"><span style=
'font-size: 15.5pt'>&nbsp;</span></span></p>
<p class="MsoSubtitle"><span class=
"MsoCommentReference"><span style=
'font-size: 15.5pt'>&nbsp;</span></span></p>
<p class="MsoSubtitle"><span class=
"MsoCommentReference"><span style=
'font-size: 15.5pt'>&nbsp;</span></span></p>
<p class="MsoNormal"><span class=
      "MsoCommentReference"><span style='font-size:14.0pt; font-family:"Book Antiqua"'>
&nbsp;</span></span></p>
<p class="MsoNormal"><span class=
      "MsoCommentReference"><span style='font-size:14.0pt; font-family:"Book Antiqua"'>
&nbsp;</span></span></p>
<p class="MsoNormal"><span class=
      "MsoCommentReference"><span style='font-size:14.0pt; font-family:"Book Antiqua"'>
&nbsp;</span></span></p>
<p class="MsoNormal"><span class=
      "MsoCommentReference"><span style='font-size:14.0pt; font-family:"Book Antiqua"'>
&nbsp;</span></span></p>
<p class="TextFontCX"><span class=
      "MsoCommentReference"><span style='font-size:15.5pt'>&nbsp;</span></span></p>
<p class="TextFontCX" align="right" style=
'margin-right: -58.5pt;text-align:right'><img width="364"
     height="181" src="manual-301_files/image002.gif" align="left"
     hspace="12" alt="Text Box: &#13;
     Secure Programming Group&#13;
University of Virginia &#13;
Department of Computer Science&#13;
&#13;
     "></p>
<p class="TextFontCX" style=
'margin-left:28.35pt; text-indent:-14.15pt'><span class=
"MsoCommentReference"><span style=
'font-size: 15.5pt'>&nbsp;</span></span></p>
<p class="TextFontCX" align="right" style=
'margin-right: 9.0pt;text-align:right'><span class=
"MsoCommentReference"><i><span style=
'font-size:14.0pt'>&nbsp;</span></i></span></p></div>
<span class="MsoCommentReference"><b><i><span style=
'font-size:14.0pt;font-family: Arial'><br clear="all" style=
'page-break-before:auto'></span></i></b></span> 
<div class="Section2"><span class=
      "MsoCommentReference"><span style='font-size: 15.5pt;font-family:"Times New Roman"'>
<br clear="all" style='page-break-before: always'></span></span> 
<p class="TextFontCX"><span class=
"MsoCommentReference"><b><span style=
'font-size:14.0pt;font-family:Arial'>&nbsp;</span></b></span></p>
<h4 style='margin-left:0in;text-indent:0in'><span class=
"MsoCommentReference"><span style=
'font-size:14.0pt'>Authors</span></span></h4>
<p class="TextFontCX">This manual was written by David Evans,
except for Section 9 and Appendix B which were written by David
Larochelle and David Evans.</p>
<h4 style='margin-left:0in;text-indent:0in'><span class=
"MsoCommentReference"><span style=
'font-size:14.0pt'>Credits</span></span></h4>
<p class="TextFontCX">Splint is developed and maintained by the
Secure Programming Group at the University of Virginia Department
of Computer Science.&nbsp; David Evans is the project leader and
the primary developer of Splint.&nbsp; David Larochelle developed
the memory bounds checking.&nbsp; University of Virginia students
Chris Barker, David Friedman, Mike Lanouette and Hien Phan all
contributed significantly to the development of Splint.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Splint is the successor to LCLint, a tool
originally developed as a joint research project between the
Massachusetts Institute of Technology and Digital Equipment
Corporation&#8217;s System Research Center.&nbsp; David Evans was
the primary designed and developer of LCLint.&nbsp; John Guttag and
Jim Horning had the original idea for a static checking tool for
detecting inconsistencies between LCL specifications and their C
implementations.&nbsp; They provided valuable advice on its
functionality and design and were instrumental in its
development.&nbsp;</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Splint incorporates the original LCL checker
developed by Yang Meng Tan.&nbsp; This was built on the DECspec
Project (Joe Wild, Gary Feldman, Steve Garland, and Bill
McKeeman).&nbsp; The LSL checker used by LCLint was developed by
Steve Garland.&nbsp; The original C grammar for LCLint was provided
by Nate Osgood.&nbsp; This work has also benefited greatly from
discussions with Mike Burrows, David Friedman, Stephen Garland,
Colin Godfrey, Steve Harrison, Yanlin Huang, Daniel Jackson, John
Knight, David Larochelle, Angelika Leeb, Ulana Legedza, Gary
McGraw, Anya Pogosyants, Avneesh Saxena, Seejo Sebastine, Navneet
Singh, Raymie Stata, Yang Meng Tan, and Mark Vandevoorde.&nbsp; I
especially thank Angelika Leeb for many constructive comments on
improving an early version of this document, Raymie Stata and Mark
Vandevoorde for technical assistance, and Dorothy Curtis, Paco
Hope, Scott Ruffner, Christina Jackson, David Ladd, and Jessica
Greer for systems assistance.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Much of Splint&#8217;s development has been
driven by feedback from users in academia and industry.&nbsp; Many
more people than I can mention here have made contributions by
suggesting improvements, reporting bugs, porting early versions of
Splint to other platforms.&nbsp; Particularly heroic contributions
have been made by Nelson Beebe, Eric Bloodworth, Jutta Degener,
Rick Farnbach, Chris Flatters, Huver Hu, Alexander Mai, John Gerard
Malecki, Thomas G. McWilliams, Michael Meskes, Richard
O&#8217;Keefe, Jens Schweikhardt, Albert L. Ting and Jim Zelenka.
Martin &#8220;Herbert&#8221; Dietze and Mike Smith performed
valiantly in producing the original Win32 and OS2 ports.&nbsp; Tim
Van Holder produced the <span class="Keyword"><span style=
'font-size:10.0pt;font-family:Arial;color:windowtext'>automake</span></span>
and <span class="Keyword"><span style=
'font-size:10.0pt;font-family:Arial; color:windowtext'>autoconf</span></span>
distribution.&nbsp;</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">
Splint research at the University of Virginia is currently funded in part by an NSF CAREER Award and an NSF CCLI Award for using analysis to teach software engineering.&nbsp;  Splint has been previously supported by a grant from NASA and David Larochelle was funded by a USENIX student research grant.
<span style='font-size:20.0pt'>&nbsp;</span></p></div>
<span class="MsoCommentReference"><span style=
'font-size:15.5pt;font-family:"Times New Roman"'><br clear="all"
style='page-break-before:right'></span></span> 
<div class="Section3">
<p class="MsoToc1" align="center" style='text-align:center'>
<span class="MsoCommentReference"><span style=
'font-size:15.5pt'>Contents</span></span></p>
<p class="MsoToc1">1<span style=
'font-size:12.0pt;font-weight:normal'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
<a href=#operation>Operation</a>................................................................................................................
11</p>
<p class="MsoToc2">1.1<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span>
Warnings.............................................................................................................
11</p>
<p class="MsoToc2">1.2<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span>
Flags....................................................................................................................
12</p>
<p class="MsoToc2">1.3<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Stylized
Comments...............................................................................................
12</p>
<p class="MsoToc3">1.3.1<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span>
Annotations...................................................................................................
13</p>
<p class="MsoToc3">1.3.2<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Setting
Flags..................................................................................................
13</p>
<p class="MsoToc1">2<span style=
'font-size:12.0pt;font-weight:normal'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
<a href=#null>Null
Dereferences</a>...................................................................................................
14</p>
<p class="MsoToc3">2.1.1<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Predicate
Functions........................................................................................
14</p>
<p class="MsoToc3">2.1.2<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Notnull
Annotations........................................................................................
15</p>
<p class="MsoToc3">2.1.3<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Relaxing Null
Checking..................................................................................
15</p>
<p class="MsoToc1">3<span style=
'font-size:12.0pt;font-weight:normal'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
<a href=#undefined>
Undefined
Values</a>....................................................................................................
17</p>
<p class="MsoToc3">3.1.1<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Undefined
Parameters...................................................................................
17</p>
<p class="MsoToc3">3.1.2<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Relaxing
Checking.........................................................................................
18</p>
<p class="MsoToc3">3.1.3<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Partially
Defined
Structures............................................................................
18</p>
<p class="MsoToc1">4<span style=
'font-size:12.0pt;font-weight:normal'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
<a href=#types>
Types</a>.......................................................................................................................
19</p>
<p class="MsoToc2">4.1<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Built in C
Types....................................................................................................
19</p>
<p class="MsoToc3">4.1.1<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span>
Characters....................................................................................................
19</p>
<p class="MsoToc3">4.1.2<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span>
Enumerators..................................................................................................
19</p>
<p class="MsoToc3">4.1.3<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Numeric
Types..............................................................................................
19</p>
<p class="MsoToc3">4.1.4<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Arbitrary
Integral
Types.................................................................................
19</p>
<p class="MsoToc2">4.2<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Boolean
Types.....................................................................................................
20</p>
<p class="MsoToc2">4.3<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Abstract
Types.....................................................................................................
21</p>
<p class="MsoToc3">4.3.1<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Controlling
Access.........................................................................................
22</p>
<p class="MsoToc3">4.3.2<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span>
Mutability......................................................................................................
23</p>
<p class="MsoToc2">4.4<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span>
Polymorphism.......................................................................................................
24</p>
<p class="MsoToc1">5<span style=
'font-size:12.0pt;font-weight:normal'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
<a href=#memory>
Memory
Management</a>............................................................................................
25</p>
<p class="MsoToc2">5.1<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Storage
Model......................................................................................................
25</p>
<p class="MsoToc2">5.2<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Deallocation
Errors...............................................................................................
26</p>
<p class="MsoToc3">5.2.1<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Unshared
References....................................................................................
26</p>
<p class="MsoToc3">5.2.2<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Temporary
Parameters..................................................................................
27</p>
<p class="MsoToc3">5.2.3<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Owned and
Dependent
References.................................................................
27</p>
<p class="MsoToc3">5.2.4<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Keep
Parameters...........................................................................................
28</p>
<p class="MsoToc3">5.2.5<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Shared
References........................................................................................
28</p>
<p class="MsoToc3">5.2.6<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Stack
References..........................................................................................
28</p>
<p class="MsoToc3">5.2.7<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Inner
Storage.................................................................................................
28</p>
<p class="MsoToc2">5.3<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Implicit Memory
Annotations.................................................................................
29</p>
<p class="MsoToc2">5.4<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Reference
Counting..............................................................................................
30</p>
<p class="MsoToc1">6<span style=
'font-size:12.0pt;font-weight:normal'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
<a href=#sharing>
Sharing</a>....................................................................................................................
31</p>
<p class="MsoToc2">6.1<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span>
Aliasing................................................................................................................
31</p>
<p class="MsoToc3">6.1.1<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Unique
Parameters........................................................................................
31</p>
<p class="MsoToc3">6.1.2<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Returned
Parameters.....................................................................................
31</p>
<p class="MsoToc2">6.2<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span>
Exposure..............................................................................................................
32</p>
<p class="MsoToc3">6.2.1<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Read-Only
Storage........................................................................................
32</p>
<p class="MsoToc3">6.2.2<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Exposed
Storage............................................................................................
33</p>
<p class="MsoToc1">7<span style=
'font-size:12.0pt;font-weight:normal'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
<a href=#function>
Function
Interfaces</a>.................................................................................................
35</p>
<p class="MsoToc2">7.1<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span>
Modifications........................................................................................................
35</p>
<p class="MsoToc3">7.1.1<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> State
Modifications........................................................................................
36</p>
<p class="MsoToc3">7.1.2<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Missing Modifies
Clauses...............................................................................
36</p>
<p class="MsoToc2">7.2<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Global
Variables...................................................................................................
37</p>
<p class="MsoToc3">7.2.1<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Controlling
Globals
Checking..........................................................................
37</p>
<p class="MsoToc3">7.2.2<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Definition
State..............................................................................................
38</p>
<p class="MsoToc2">7.3<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Declaration
Consistency........................................................................................
38</p>
<p class="MsoToc2">7.4<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> State
Clauses.......................................................................................................
39</p>
<p class="MsoToc2">7.5<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Requires and
Ensures
Clauses...............................................................................
41</p>
<p class="MsoToc1">8<span style=
'font-size:12.0pt;font-weight:normal'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
<a href=#control>
Control
Flow</a>...........................................................................................................
43</p>
<p class="MsoToc2">8.1<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span>
Execution.............................................................................................................
43</p>
<p class="MsoToc2">8.2<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Undefined
Behavior..............................................................................................
44</p>
<p class="MsoToc2">8.3<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Problematic
Control
Structures..............................................................................
45</p>
<p class="MsoToc3">8.3.1<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Likely Infinite
Loops......................................................................................
45</p>
<p class="MsoToc3">8.3.2<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span>
Switches.......................................................................................................
46</p>
<p class="MsoToc3">8.3.3<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Deep
Breaks.................................................................................................
46</p>
<p class="MsoToc3">8.3.4<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Loop and If
Bodies........................................................................................
47</p>
<p class="MsoToc3">8.3.5<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Complete
Logic.............................................................................................
47</p>
<p class="MsoToc2">8.4<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Suspicious
Statements...........................................................................................
47</p>
<p class="MsoToc3">8.4.1<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Statements with
No
Effects............................................................................
47</p>
<p class="MsoToc3">8.4.2<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Ignored Return
Values...................................................................................
48</p>
<p class="MsoToc1">9<span style=
'font-size:12.0pt;font-weight:normal'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
<a href=#buffer>
Buffer
Sizes</a>.............................................................................................................
49</p>
<p class="MsoToc2">9.1<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Checking
Accesses..............................................................................................
49</p>
<p class="MsoToc2">9.2<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Annotating
Buffer
Sizes........................................................................................
49</p>
<p class="MsoToc2">9.3<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span>
Warnings.............................................................................................................
50</p>
<p class="MsoToc1">10<span style=
'font-size:12.0pt;font-weight:normal'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
<a href=#extensible>
Extensible
Checking</a>............................................................................................
52</p>
<p class="MsoToc2">10.1<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Defining
Attributes............................................................................................
52</p>
<p class="MsoToc2">10.2<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Annotations......................................................................................................
54</p>
<p class="MsoToc2">10.3<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Example...........................................................................................................
54</p>
<p class="MsoToc1">11<span style=
'font-size:12.0pt;font-weight:normal'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
<a href=#macros>
Macros</a>..................................................................................................................
55</p>
<p class="MsoToc2">11.1<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Constant
Macros...............................................................................................
55</p>
<p class="MsoToc2">11.2<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Function-like
Macros.........................................................................................
55</p>
<p class="MsoToc3">11.2.1<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span> Side
Effect Free
Parameters.......................................................................
56</p>
<p class="MsoToc2">11.3<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Controlling Macro
Checking...............................................................................
57</p>
<p class="MsoToc2">11.4<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Iterators...........................................................................................................
58</p>
<p class="MsoToc3">11.4.1<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Defining
Iterators.......................................................................................
58</p>
<p class="MsoToc3">11.4.2<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Using
Iterators...........................................................................................
58</p>
<p class="MsoToc1">12<span style=
'font-size:12.0pt;font-weight:normal'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
<a href=#naming>
Naming
Conventions</a>............................................................................................
60</p>
<p class="MsoToc2">12.1<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Type-Based Naming
Conventions......................................................................
60</p>
<p class="MsoToc3">12.1.1<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Czech
Names.............................................................................................
60</p>
<p class="MsoToc3">12.1.2<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Slovak
Names............................................................................................
61</p>
<p class="MsoToc3">12.1.3<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Czechoslovak
Names..................................................................................
61</p>
<p class="MsoToc2">12.2<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Namespace
Prefixes.........................................................................................
61</p>
<p class="MsoToc2">12.3<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Naming
Restrictions..........................................................................................
63</p>
<p class="MsoToc3">12.3.1<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Reserved
Names........................................................................................
63</p>
<p class="MsoToc3">12.3.2<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Distinct
Names...........................................................................................
63</p>
<p class="MsoToc1">13<span style=
'font-size:12.0pt;font-weight:normal'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
<a href=#completeness>
Completeness</a>.......................................................................................................
65</p>
<p class="MsoToc2">13.1<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Unused
Declarations.........................................................................................
65</p>
<p class="MsoToc2">13.2<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Complete
Programs...........................................................................................
65</p>
<p class="MsoToc3">13.2.1<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Unnecessarily External
Names....................................................................
65</p>
<p class="MsoToc3">13.2.2<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Declarations Missing from
Headers.............................................................
65</p>
<p class="MsoToc1">14<span style=
'font-size:12.0pt;font-weight:normal'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
<a href=#libraries>
Libraries and Header File
Inclusion</a>....................................................................
66</p>
<p class="MsoToc2">14.1<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Standard
Libraries.............................................................................................
66</p>
<p class="MsoToc3">14.1.1<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span> ISO
Standard
Library..................................................................................
66</p>
<p class="MsoToc3">14.1.2<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
POSIX
Library...........................................................................................
66</p>
<p class="MsoToc3">14.1.3<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span> UNIX
Library............................................................................................
66</p>
<p class="MsoToc3">14.1.4<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Strict
Libraries............................................................................................
66</p>
<p class="MsoToc2">14.2<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Generating
Libraries..........................................................................................
67</p>
<p class="MsoToc3">14.2.1<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Generating the Standard
Libraries................................................................
67</p>
<p class="MsoToc2">14.3<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Header File
Inclusion.........................................................................................
68</p>
<p class="MsoToc3">14.3.1<span style=
'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Preprocessing
Constants.............................................................................
68</p>
<p class="MsoToc1">Appendix A<span style=
'font-size:12.0pt;font-weight:normal'>&nbsp;&nbsp;&nbsp;</span>
<a href=#availability>
Availability</a>...............................................................................................
71</p>
<p class="MsoToc1">Appendix B<span style=
'font-size:12.0pt;font-weight:normal'>&nbsp;&nbsp;&nbsp;</span>
<a href=#flags>
Flags</a>........................................................................................................
72</p>
<p class="MsoToc2">Global
Flags...................................................................................................................
72</p>
<p class="MsoToc3">
Help..........................................................................................................................
72</p>
<p class="MsoToc3">
Initialization................................................................................................................
72</p>
<p class="MsoToc3">
Pre-processor............................................................................................................
73</p>
<p class="MsoToc3">
Libraries....................................................................................................................
73</p>
<p class="MsoToc3">
Output.......................................................................................................................
74</p>
<p class="MsoToc3">Expected
Errors.........................................................................................................
75</p>
<p class="MsoToc2">Message
Format............................................................................................................
75</p>
<p class="MsoToc2">Mode Selector
Flags.......................................................................................................
75</p>
<p class="MsoToc2">Checking
Flags...............................................................................................................
76</p>
<p class="MsoToc3">
Key...........................................................................................................................
76</p>
<p class="MsoToc3">
Types........................................................................................................................
76</p>
<p class="MsoToc3">Function
Interfaces.....................................................................................................
79</p>
<p class="MsoToc3">Memory
Management................................................................................................
81</p>
<p class="MsoToc3">
Sharing......................................................................................................................
84</p>
<p class="MsoToc3">Use Before Definition <i>(Section
3)</i>...............................................................................
85</p>
<p class="MsoToc3">Null Dereferences <i>(Section
2)</i>....................................................................................
85</p>
<p class="MsoToc3">Macros <i>(Section
7)</i>....................................................................................................
85</p>
<p class="MsoToc3">
Iterators.....................................................................................................................
86</p>
<p class="MsoToc3">Naming
Conventions...................................................................................................
86</p>
<p class="MsoToc3">Other
Checks.............................................................................................................
90</p>
<p class="MsoToc2">Flag Name
Abbreviations................................................................................................
95</p>
<p class="MsoToc1">Appendix C<span style=
'font-size:12.0pt;font-weight:normal'>&nbsp;&nbsp;&nbsp;</span>
<a href=#annotations>
Annotations</a>.............................................................................................
97</p>
<p class="MsoToc3">Suppressing
Warnings.................................................................................................
97</p>
<p class="MsoToc2">Syntactic
Annotations.....................................................................................................
97</p>
<p class="MsoToc3">
Functions...................................................................................................................
97</p>
<p class="MsoToc3">Iterators (Section
11.4)...............................................................................................
98</p>
<p class="MsoToc3">Constants (Section
11.1).............................................................................................
98</p>
<p class="MsoToc3">Alternate Types (Section
4.4)......................................................................................
98</p>
<p class="MsoToc3">Declarator
Annotations...............................................................................................
98</p>
<p class="MsoToc3">Type
Access..............................................................................................................
98</p>
<p class="MsoToc3">Macro
Expansion......................................................................................................
101</p>
<p class="MsoToc3">Arbitrary Integral
Types............................................................................................
102</p>
<p class="MsoToc3">Traditional Lint
Comments........................................................................................
102</p>
<p class="MsoToc2">Metastate
Definitions....................................................................................................
103</p>
<p class="MsoToc1">Appendix D<span style=
'font-size:12.0pt;font-weight:normal'>&nbsp;&nbsp;&nbsp;</span>
<a href=#specifications>
Specifications<a/>.........................................................................................
104</p>
<p class="MsoToc3">Specification
Flags....................................................................................................
104</p>
<p class="MsoToc1">
Appendix E<span style=
'font-size:12.0pt;font-weight:normal'>&nbsp;&nbsp;&nbsp;</span>
<a href=#annotated>
Annotated
Bibliography</a>........................................................................
107</p>

<p class="TextFontCX">&nbsp;</p></div>
<span class="MsoCommentReference"><b><i><span style=
'font-size:15.5pt;font-family: "Times New Roman";text-transform:uppercase'>
<br clear="all" style=
'page-break-before: right'></span></i></b></span> 
<div class="Section4">
<p class="TextFontCX"><span style=
'font-size:16.0pt'>&nbsp;</span></p>
<p class="MsoNormal" align="center" style='text-align:center'>
<b><span style='font-size:16.0pt'>Splint User&#8217;s
Manual</span></b></p>
<p class="MsoNormal" align="center" style='text-align:center'>
&nbsp;</p>
<p class="MsoNormal" align="center" style='text-align:center'>
Version 3.1.1</p>
<p class="MsoNormal" align="center" style='text-align:center'>7
27 April 2003</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Splint<a href="#_ftn1" name="_ftnref1"
   title=""><span class="MsoFootnoteReference"><span class=
   "MsoFootnoteReference"><span style=
   'font-size:11.0pt;font-family:"Times New Roman"'>[1]</span></span></span></a>
   is a tool for statically checking C programs for security
   vulnerabilities and programming mistakes.&nbsp; Splint does many
   of the traditional lint checks including unused declarations,
   type inconsistencies, use before definition, unreachable code,
   ignored return values, execution paths with no return, likely
   infinite loops, and fall through cases.&nbsp; More powerful
   checks are made possible by additional information given in
   source code annotations.&nbsp; Annotations&nbsp;are stylized
   comments that document assumptions about functions, variables,
   parameters and types.&nbsp; In addition to the checks
   specifically enabled by annotations, many of the traditional
   lint checks are improved by exploiting this additional
   information.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">As more effort is put into annotating
programs, better checking results. A representational
effort-benefit curve for using Splint is shown in Figure 1.&nbsp;
Splint is designed to be flexible and allow programmers to select
appropriate points on the effort-benefit curve for particular
projects.&nbsp; As different checks are turned on and more
information is given in code annotations the number of bugs that
can be detected increases dramatically.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="beforelist">Problems detected by Splint include:</p>
<p class="TextFontCX" style=
'margin-left:12.95pt; text-indent:-12.95pt'><span style=
'font-family:Symbol'>&#183;<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
Dereferencing a possibly null pointer (Section 2);</p>
<p class="TextFontCX" style=
'margin-left:12.95pt; text-indent:-12.95pt'><span style=
'font-family:Symbol'>&#183;<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
Using possibly undefined storage or returning storage that is not
properly defined (Section&nbsp;3);</p>
<p class="MsoListBullet"><span style=
'font-family:Symbol'>&#183;<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
Type mismatches, with greater precision and flexibility than
provided by C compilers (Section 4.1&#8211;4.2);</p>
<p class="MsoListBullet"><span style=
'font-family:Symbol'>&#183;<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
Violations of information hiding&nbsp;(Section 4.3);</p>
<p class="TextFontCX" style=
'margin-left:12.95pt; text-indent:-12.95pt'><span style=
'font-family:Symbol'>&#183;<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
Memory management errors including uses of dangling references and
memory leaks&nbsp; (Section 5);</p>
<p class="TextFontCX" style=
'margin-left:12.95pt; text-indent:-12.95pt'><span style=
'font-family:Symbol'>&#183;<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
Dangerous aliasing (Section 6);</p>
<p class="TextFontCX" style=
'margin-left:12.95pt; text-indent:-12.95pt'><span style=
'font-family:Symbol'>&#183;<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
Modifications and global variable uses that are inconsistent with
specified interfaces (Section 7);</p>
<p class="TextFontCX" style=
'margin-left:12.95pt; text-indent:-12.95pt'><span style=
'font-family:Symbol'>&#183;<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
Problematic control flow such as likely infinite loops (Section
8.3.1), fall through cases or incomplete switches (Section 8.3.2),
and suspicious statements (Section 8.4);</p>
<p class="TextFontCX" style=
'margin-left:12.95pt; text-indent:-12.95pt'><span style=
'font-family:Symbol'>&#183;<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
Buffer overflow vulnerabilities (Section 9);</p>
<p class="TextFontCX" style=
'margin-left:12.95pt; text-indent:-12.95pt'><span style=
'font-family:Symbol'>&#183;<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
Dangerous macro implementations or invocations (Section 11);
and</p>
<p class="TextFontCX" style=
'margin-left:12.95pt; text-indent:-12.95pt'><span style=
'font-family:Symbol'>&#183;<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
Violations of customized naming conventions.&nbsp; (Section
12).</p>
<p class="TextFontCX">&nbsp;</p>
<p class="MsoCaption">&nbsp;</p>
<center><img width="572" height="350" src=
"manual-301_files/image003.gif">
<center><br>
<br>
 
<p class="MsoCaption"><a name="_Toc534824605"></a><a name=
"_Ref534821281">Figure</a> 1.&nbsp; Typical Effort-Benefit
Curve</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Splint checking can be customized to select
what classes of errors are reported using command line flags and
stylized comments in the code.&nbsp; In addition, users can define
new annotations&nbsp;and associated checks to extend Splint&#8217;s
checking or to enforce application specific properties (Section
10).</p>
<p class="TextFontCX"><a name="_Ref343085763"></a><a name=
"_Ref343065516">&nbsp;</a></p>
<p class="TextFontCX"><b>About This Document</b></p>
<p class="TextFontCX">This document is a guide to using
Splint.&nbsp; Section 1 explains how to run Splint, interpret
messages and control checking.&nbsp; Sections 2&#8211;13 describe
particular checks done by Splint.&nbsp; There are some minor
dependencies between sections, but in general they can be read in
any order.&nbsp; Section 14 covers issues involving libraries and
header file inclusion important for running Splint on large
systems.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">This document does not describe technical
details of the checking.&nbsp; For technical background and
analysis of Splint&#8217;s effectiveness in practice, see the
papers available at <a href=
      "http://www.splint.org/"><span style='font-size:10.0pt;font-family:Arial'>
http://www.splint.org</span></a>.&nbsp;</p>
<center>
<table cellspacing="0" cellpadding="0" hspace="0" width="80%"
       style="border-collapse: collapse" bordercolor="#111111">
<tr>
<td valign="top" align="left" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="right" style='text-align:right'>
<a name="_Ref349497354"></a><a name=
      "_Ref348079997"><i><span style='font-size:9.0pt'>Since human
      beings themselves are not fully debugged yet, there will be
      bugs in your code no matter what you do.</span></i></a></p>
<p class="TextFontCX" align="right" style=
'margin-left:4.5pt;text-align:right'><span style=
'font-size:9.0pt'>Chris Mason,</span><i><span style=
'font-size:9.0pt'>Zero-defects&nbsp; memo</span></i>
      <span style='font-size:9.0pt'>(quoted in <i>Microsoft
      Secrets</i>, Cusumano and
      Selby)</span></p></td></tr></table></center>
<h1 style='margin-left:0in;text-indent:0in'><a name=
"Section1"></a><a name="_Toc534974932"></a><a name=
"_Ref348785755">1<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
<a id="operation" name="operation"> Operation</a></h1>
<p class="TextFontCX">Splint is invoked by listing files to be
checked.&nbsp; Initialization files, command line flags, and
stylized comments may be used to customize checking globally and
locally.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">The best way to learn to use Splint, of
course, is to actually use it (if you don&#8217;t already have
Splint installed on your system, see Appendix A). &nbsp;Before you
read much further in this document, I recommend finding a small C
program.&nbsp; Then, try running:</p>
<p class="example" align="left">splint *.c</p>
<center>
<center>
<p class="TextFontCX">For the most C programs, this will produce a
large number of warnings.&nbsp; To turn off reporting for some of
the warnings, try:<a name="_Ref347468509"></a><a name=
"_Ref345591726"></a><a name="_Ref345568136"></a><a name=
"_Ref345515100"></a><a name="_Ref345497041"></a><a name=
"_Ref345435155"></a><a name="_Ref345257971"></a><a name=
"_Ref344916723"></a><a name="_Ref344907348"></a><a name=
"_Ref344891202"></a><a name="_Toc344355397"></a></p>
<p class="example" align="left">splint -weak *.c</p>
<center>
<center>
<p class="TextFontCX">The <span class="Flag"><span style=
'font-size:10.0pt'>-weak</span></span> flag is a mode flag that
sets many checking parameters to select weaker checking than is
done in the default mode.&nbsp; Other Splint flags will be
introduced in the following sections; a complete list is given in
Appendix B.</p>
<h2 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974933"></a><a name="_Toc344355435">1.1<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Warnings</a></h2>
<p class="beforelist">A typical warning message is:</p>
<p class="IndentText" align="left" style="margin-bottom: 0.0003pt">
<span style='font-size:10.0pt;font-family:Arial'>sample.c: (in
function faucet)</span></p>
<p class="IndentText" align="left"><span style=
'font-size:10.0pt;font-family:Arial'>sample.c:11:12</span><span style='font-size:10.0pt; font-family:Arial'>
: Fresh storage x not released before return</span></p>
<p class="IndentText" align="left"><span style=
'font-size:10.0pt;font-family:Arial'>&nbsp; A memory leak has been
detected. Storage allocated locally is not released</span></p>
<p class="IndentText" align="left"><span style=
'font-size:10.0pt;font-family:Arial'>&nbsp; before the last
reference to it is lost. (Use -mustfreefresh to inhibit</span></p>
<p class="IndentText" align="left"><span style=
'font-size:10.0pt;font-family:Arial'>&nbsp; warning)</span></p>
<p class="IndentText" align="left"><span style=
'font-size:10.0pt;font-family:Arial'>&nbsp;&nbsp; sample.c:5:47:
Fresh storage x allocated</span></p>
<center>
<center>
<p class="afterlist">The first line gives the name of the function
in which the error is found.&nbsp; This is printed before the first
message reported for a function.&nbsp; The second line is the text
of the message.&nbsp; This message reports a memory
leak&#8212;storage allocated in a function is not deallocated
before the function returns.&nbsp; The file name, line and column
number where the error is located precedes the text.&nbsp;</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">The next line is a hint giving more
information about the suspected error, including information on how
the warning message may be suppressed.&nbsp; For this message,
using the <span class="Flag"><span style=
'font-size:10.0pt'>&#8209;mustfreefresh</span></span>&nbsp;flag
would prevent this warning from being reported.&nbsp; This flag can
be set at the command line, or more precisely just around the code
point in question by using annotations (see Section 1.3.2).</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">The final line of the message gives
additional location information.&nbsp; For this message, it tells
where the leaking storage was allocated.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="beforelist">The generic message format is (parts enclosed
in square brackets are optional):</p>
<p class="Verbatim" align="left"><span style=
'font-family:Arial'>&nbsp; [&lt;file&gt;:&lt;line&gt; (in
&lt;context&gt;)]</span></p>
<p class="Verbatim" align="left"><span style=
'font-family:Arial'>&nbsp;
&lt;file&gt;:&lt;line&gt;[,&lt;column&gt;]:
<i>message</i></span></p>
<p class="Verbatim" align="left"><span style=
'font-family:Arial'>&nbsp;&nbsp;&nbsp;&nbsp;
[<i>hint</i>]</span></p>
<p class="Verbatim" align="left"><span style=
'font-family:Arial'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
&lt;file&gt;:&lt;line&gt;,&lt;column&gt;: <i>extra location
information, if appropriate</i></span></p>
<center>
<center>
<p class="afterlist">Users can customize the format and content of
messages printed by Splint.&nbsp; The function context is not
printed if <span class="Flag"><span style=
'font-size:10.0pt'>-showfunc</span></span>&nbsp;is used.&nbsp;
Column numbers are not printed if <span class=
      "Flag"><span style='font-size:10.0pt'>&#8209;showcol</span></span>&nbsp;is
      used.&nbsp; The <span class="Flag"><span style=
      'font-size:10.0pt'>+parenfileformat</span></span>&nbsp;flag
      can be used to generate file locations in the format
      recognized by Microsoft Visual Studio.&nbsp; If <span class=
      "Flag"><span style=
      'font-size:10.0pt'>+parenfileformat</span></span> is set, the
      line number follows the file name in parentheses (e.g.,
      <span class="PlainText"><span style=
      'font-size:10.0pt;font-family:Arial'>sample.c(11)</span></span>.)&nbsp;
      Messages are split&nbsp;into lines of length less than the
      value set using <span class="Flag"><span style=
      'font-size:10.0pt'>-linelen
      <i>&lt;number&gt;</i></span></span>.&nbsp; The default line
      length is 80 characters.&nbsp; Splint attempts to split lines
      in a sensible place as near to the line length limit as
      possible.&nbsp;</p>
<p class="afterlist" style='margin-top:0in'>&nbsp;</p>
<p class="afterlist" style='margin-top:0in'>The <span class=
"Flag"><span style=
'font-size:10.0pt'>&#8209;hints</span></span>&nbsp;prevents any
hints from being printed.&nbsp; Normally, a hint is given only the
first time a class of error is reported.&nbsp; To have Splint print
a hint for every message regardless, use <span class=
"Flag"><span style=
'font-size:10.0pt'>+forcehints</span></span>.</p>
<h2 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974934"></a><a name="_Ref348343333"></a><a name=
"_Ref348343330"></a><a name="_Ref348092990"></a><a name=
"_Ref344882148"></a><a name="_Ref344870278"></a><a name=
"_Toc344355436">1.2<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Flags</a></h2>
<p class="TextFontCX">So that many programming styles can be
supported, Splint provides several hundred flags for controlling
checking and message reporting.&nbsp; Some of the flags are
introduced in the body of this document.&nbsp; Appendix B describes
every flag.&nbsp; Modes and shortcut flags are provided for setting
many flags at once.&nbsp; Individual flags can override the mode
settings.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Flags are preceded by <span class=
"Flag"><span style='font-size:10.0pt'>+</span></span> or
<span class="Flag"><span style=
'font-size:10.0pt'>-</span></span>.&nbsp; When a flag is preceded
by <span class="Flag"><span style=
'font-size:10.0pt'>+</span></span> we say it is <i>on</i>; when it
is preceded by <span class="Flag"><span style=
'font-size:10.0pt'>-</span></span> it is <i>off</i>. The precise
meaning of on and off depends on the type of flag.&nbsp;</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">The <span class="Flag"><span style=
'font-size:10.0pt'>+</span></span>/<span class=
      "Flag"><span style='font-size:10.0pt'>-</span></span> flag
      settings are used for consistency and clarity, but contradict
      standard UNIX usage and it is easy to accidentally use the
      wrong one.&nbsp; To reduce the likelihood of using the wrong
      flag, Splint issues warnings when a flag is set in an unusual
      way.&nbsp; Warnings are issued when a flag is redundantly set
      to the value it already had (these errors are not reported if
      the flag is set using a stylized comment), if a mode flag or
      special flag is set after a more specific flag that will be
      set by the general flag was already set, if value flags are
      given unreasonable values, of if flags are set in an
      inconsistent way. &nbsp;The <span class="Flag"><span style=
      'font-size: 10.0pt'>-warnflags</span></span>&nbsp;flag
      suppresses these warnings.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Default flag settings will be read from
<span class="Keyword"><span style=
'font-size:10.0pt;font-family: Arial;color:windowtext'>~/.splintrc</span></span>&nbsp;if
it is readable.&nbsp; If there is a <span class=
"Keyword"><span style=
'font-size:10.0pt;font-family:Arial;color:windowtext'>.splintrc</span></span>&nbsp;file
in the working directory, settings in this file will be read next
and its settings will override those in <span class=
"Keyword"><span style=
'font-size:10.0pt;font-family:Arial; color:windowtext'>~/.splintrc</span></span>.&nbsp;
Command-line flags override settings in either file.&nbsp; The
syntax of the <span class="Keyword"><span style=
'font-size:10.0pt;font-family:Arial;color:windowtext'>.splintrc</span></span>&nbsp;file
is the same as that of command-line flags, except that flags may be
on separate lines and the <span class="CodeText"><span style=
'font-size:10.0pt'>#</span></span> character may be used to
indicate that the remainder of the line is a comment. The
<span class="Flag"><span style=
'font-size:10.0pt'>-nof</span></span> flag prevents the
      <span class="Keyword"><span style=
      'font-size:10.0pt;font-family: Arial;color:windowtext'>~/.splintrc</span></span>&nbsp;file
      from being loaded.&nbsp; The <span class="Flag"><span style=
      'font-size:10.0pt'>-f</span></span> <span class=
      "Flag"><span style=
      'font-size:10.0pt'><i>&lt;filename&gt;</i></span></span> flag
      loads options from <i>filename</i>.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">To make flag names more readable, hyphens
(<span class="Flag"><span style=
'font-size:10.0pt'>-</span></span>), underscores
      (<span class="Flag"><span style=
      'font-size:10.0pt'>_</span></span>) and spaces in flags at
      the command line are ignored.&nbsp; Hence, <span class=
      "Flag"><span style=
      'font-size:10.0pt'>warnflags</span></span>, <span class=
      "Flag"><span style=
      'font-size:10.0pt'>warn-flags</span></span> and <span class=
      "Flag"><span style=
      'font-size:10.0pt'>warn_flags</span></span> all select the
      <span class="Flag"><span style=
      'font-size:10.0pt'>warnflags</span></span> option.</p>
<h2 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974935"></a><a name="_Toc344355442"></a><a name=
"_Ref343086686">1.3<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Stylized Comments</a></h2>
<p class="TextFontCX">Stylized comments are used to provide extra
information about a type, variable or function interface to improve
checking, or to control flag settings locally.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">All stylized comments begin with
      <span class="CodeText"><span style=
      'font-size:10.0pt'>/*@</span></span> and are closed by the
      end of the comment.&nbsp; The role of the <span class=
      "CodeText"><span style=
      'font-size:10.0pt'>@</span></span>&nbsp;may be played by any
      printable character.&nbsp; Use <span class=
      "Flag"><span style='font-size:10.0pt'>-commentchar</span></span><span class="Flag">
<span style=
'font-size:10.0pt'>&nbsp;<i>&lt;char&gt;</i></span></span> to
select a different stylized comment marker.</p>
<h3 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974936">1.3.1<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Annotations</a></h3>
<p class="TextFontCX">Annotations are stylized comments that follow
a definite syntax.&nbsp; Although they are comments, they may only
be used in fixed grammatical contexts (e.g., like a type
qualifier).</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Sections 2&#8211;6&#173; describe
annotations&nbsp;for expressing assumptions about variables,
parameters, return values, structure fields and
type&nbsp;definitions.&nbsp; For example, <span class=
"Annot"><span style='font-size:10.0pt'>/*@null@*/</span></span> is
used to express an assumption that a parameter may be NULL.&nbsp;
Section 7 describes annotations for describing function
interfaces.&nbsp; Other annotations are described in later sections
and Section 10 describes mechanisms users can employ to define new
annotations.&nbsp; A summary of annotations is found in Appendix
C.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Some annotations, known as control comments,
may appear between any two tokens in a C program (unlike regular C
comments, control comments should not be used within a single token
as they introduce new separators in the code).&nbsp; Syntactically,
they are no different from standard comments.&nbsp; Control
comments are used to provide source-level control of Splint
checking.&nbsp; They may be used to suppress spurious messages, set
flags, and control checking locally in other ways.</p>
<h3 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974937"></a><a name="_Ref534648584">1.3.2<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Setting Flags</a></h3>
<p class="TextFontCX">Most flags (all except those characterized as
&#8220;global&#8221; in Appendix B) can be set locally using
control comments.&nbsp; A control comment can set flags locally to
override the command line settings.&nbsp; The original flag
settings are restored before processing the next file. The syntax
for setting flags in control comments is the same as that of the
command line, except that flags may also be preceded by
      <span class="CodeText"><span style=
      'font-size:10.0pt'>=</span></span> to restore their setting
      to the original command-line value.&nbsp; For instance,</p>
<p class="example"><span class="Annot"><span style=
'font-size:10.0pt'>/*@+charint</span></span> <span class=
"Annot"><span style=
'font-size:10.0pt'>-modifies</span></span><span class=
"Annot"><span style=
'font-size:10.0pt'>=showfunc</span></span><span class=
"Annot"><span style='font-size:10.0pt'>@*/</span></span></p>
<p class="TextFontCX">sets <span class="Flag"><span style=
'font-size:10.0pt'>charint</span></span>&nbsp;on (this makes
<span class="CodeText"><span style=
'font-size:10.0pt'>char</span></span> and <span class=
"CodeText"><span style='font-size:10.0pt'>int</span></span>
indistinguishable types), sets <span class=
      "Flag"><span style='font-size:10.0pt'>modifies</span></span>
      off (this prevents reporting of modification errors), and
      sets <span class="Flag"><span style=
      'font-size:10.0pt'>showfunc</span></span>&nbsp;to its
      original setting (this controls&nbsp; whether or not the name
      of a function <a name="_Toc344355449">is displayed before a
      message).</a><a name="_Ref348845205"></a><a name=
      "_Ref348845200"></a> <a name="_Ref348785779"></a></p>
<h1 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974938"></a><a name="_Ref534641443"></a><a name=
"_Ref534093860"></a><a name="_Ref534050017"></a><a name=
"_Ref534008843">2<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
<a id="null" name="null">Null Dereferences</a></a></h1>
<p class="TextFontCX">A common cause of program failures is when a
null&nbsp;pointer is dereferenced.&nbsp; Splint detects these
errors by distinguishing possibly <span class=
"CodeText"><span style='font-size:10.0pt'>NULL</span></span>
pointers at interface boundaries.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">The <span class="Annot"><span style=
'font-size:10.0pt'>null</span></span> annotation is used to
indicate that a pointer value may be <span class=
"CodeText"><span style='font-size:10.0pt'>NULL</span></span>.&nbsp;
A pointer declared with no <span class="Annot"><span style=
'font-size:10.0pt'>null</span></span> annotation, may not be
<span class="CodeText"><span style=
'font-size:10.0pt'>NULL</span></span>.&nbsp; If null checking is
turned on (controlled by <span class="Flag"><span style=
'font-size:10.0pt'>null</span></span>), Splint will report an error
when a possibly null pointer is passed as a parameter, returned as
a result, or assigned to an external reference with no
      <span class="Annot"><span style=
      'font-size:10.0pt'>null</span></span> qualifier.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">If a pointer is declared with the
      <span class="Annot"><span style=
      'font-size:10.0pt'>null</span></span> annotation, the code
      must check that it is not <span class="CodeText"><span style=
      'font-size:10.0pt'>NULL</span></span> on all paths leading to
      a dereference of the pointer (or the pointer being returned
      or passed as a value with no <span class="Annot"><span style=
      'font-size:10.0pt'>null</span></span> annotation).&nbsp;
      Dereferences of possibly null pointers may be protected by
      conditional statements or <span class="CodeText"><span style=
      'font-size:10.0pt'>assert</span></span>ions (to see how
      <span class="CodeText"><span style=
      'font-size:10.0pt'>assert</span></span> is declared see
      Section 8.1) that check the pointer is not <span class=
      "CodeText"><span style=
      'font-size:10.0pt'>NULL</span></span>.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Consider two implementations of
      <span class="CodeText"><span style=
      'font-size:10.0pt'>firstChar</span></span> in Figure 2. For
      <span class="CodeText"><span style=
      'font-size:10.0pt'>firstChar1</span></span>, Splint reports
      an error since the pointer that is dereferenced is declared
      with a <span class="Annot"><span style=
      'font-size:10.0pt'>null</span></span>&nbsp;annotation.&nbsp;
      For <span class="CodeText"><span style=
      'font-size:10.0pt'>firstChar2</span></span>, no error is
      reported since the true branch of the <span class=
      "CodeText"><span style='font-size:10.0pt'>s ==
      NULL</span></span> if statement returns, so the dereference
      of <span class="CodeText"><span style=
      'font-size:10.0pt'>s</span></span> is only reached if
      <span class="CodeText"><span style=
      'font-size:10.0pt'>s</span></span> is not <span class=
      "CodeText"><span style=
      'font-size:10.0pt'>NULL</span></span>.</p>
<center>
<table class="MsoNormalTable" border="0" cellspacing="0"
cellpadding="0" style=
'margin-left:5.4pt;border-collapse:collapse; margin-left:-2.25pt;margin-right:-2.25pt'>
<tr>
<td valign="top" style=
'width:207.0pt;border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX" align="center" style='text-align:center'>
<span class="Keyword"><b><span style=
'font-size:10.0pt; color:white'>null.c</span></b></span></p></td>
<td valign="top" style=
'width:220.5pt;border-top:solid black 1.5pt; border-left:none;border-bottom:none;border-right:solid black 1.5pt; background:black;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX" align="center" style='text-align:center'>
<b><span style='color:white'>Running
Splint</span></b></p></td></tr>
<tr>
<td valign="top" style=
'width:207.0pt;border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt'>
<p class="Verbatim"><span style='font-size:9.0pt'>&nbsp;</span></p>
<p class="Verbatim"><span style='font-size:9.0pt'>char firstChar1
(/*@null@*/ char *s)</span></p>
<p class="Verbatim"><span style='font-size:9.0pt'>{<br></span>
<span class="Line"><span style=
'font-size:8.0pt'>3</span></span><span style=
'font-size:9.0pt'>&nbsp; return *s;</span></p>
<p class="Verbatim"><span style='font-size:9.0pt'>}</span></p>
<p class="Verbatim"><span style='font-size:9.0pt'>&nbsp;</span></p>
<p class="Verbatim"><span style='font-size:9.0pt'>char firstChar2
(/*@null@*/ char *s)</span></p>
<p class="Verbatim"><span style='font-size:9.0pt'>{</span></p>
<p class="Verbatim"><span style='font-size:9.0pt'>&nbsp;&nbsp; if
(s == NULL) return &#8216;\0&#8217;;<br></span> <span class=
"Line"><span style=
      'font-size:8.0pt'>9</span></span><span style='font-size:9.0pt'>&nbsp;
      return *s;</span></p>
<p class="Verbatim"><span style='font-size:9.0pt'>}</span></p></td>
<td valign="top" style=
'width:220.5pt;border-top:none;border-left: none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
<p class="lclintrun">&gt; splint null.c</p>
<p class="lclintrun">Splint 3.0.1</p>
<p class="lclintrun">&nbsp;</p>
<p class="lclintrun">null.c: (in function firstChar1)</p>
<p class="lclintrun">null.c:3:11: Dereference of possibly null
pointer s: *s</p>
<p class="lclintrun">&nbsp;&nbsp; null.c:1:35: Storage s may become
null</p>
<p class="lclintrun">&nbsp;</p>
<p class="lclintrun">Finished checking --- 1 code warning found</p>
<p class="TextFontCX">&nbsp;</p></td></tr></table>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       style="border-collapse: collapse" bordercolor="#111111">
<tr>
<td valign="top" align="left" style=
'padding-top:6.5pt;padding-right: 9.35pt;padding-bottom:6.5pt;padding-left:9.35pt'>
<p class="MsoCaption"><a name="_Ref534981289"></a><a name=
"_Toc534824606"></a><a name="_Ref534981293">Figure 2</a>.&nbsp;
Null Checking</p>
<p class="MsoNormal" align="left" style=
'margin-top:0in;margin-right:26.55pt; margin-bottom:0in;margin-left:.5in;margin-bottom:.0001pt;text-align:left; background:white'>
<span style='font-size:10.0pt'>Output from running Splint is
displayed in</span> <span style=
'font-size:10.0pt;font-family:"Arial Narrow"'>sans-serif</span>
<span style='font-size:10.0pt'>font.&nbsp; The command line is
preceded by</span> <span style=
'font-size:10.0pt;font-family:Arial'>&gt;</span><span style=
'font-size: 10.0pt'>, the rest is output from Splint.&nbsp;
Explanations added to the code or splint output are shown in
<i>italics</i>. Code shown in the figures in this document is
available from the splint web site,</span> <span style=
'font-size:10.0pt;font-family:Arial'>http://www.splint.org</span><span style='font-size:10.0pt'>
.&nbsp; No error is reported for line 9, since the dereference is
reached only if</span> <span class="CodeText"><span style=
'font-size:10.0pt'>s</span></span> <span style=
'font-size:10.0pt'>is non-null.&nbsp; For most of the figures, the
options</span> <span class="Flag"><span style=
'font-size:9.0pt'>-linelen 55 -hints &#8211;showcol</span></span>
<span style='font-size:10.0pt'>were used to produce condensed
output, and</span> <span class="Flag"><span style=
'font-size:9.0pt'>&#8211;exportlocal</span></span>
      <span style='font-size:10.0pt'>to inhibit warnings about
      exported
      declarations.&nbsp;</span></p></td></tr></table></center>
<h3 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974939"></a><a name="_Ref344185475">2.1.1<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Predicate Functions</a></h3>
<p class="TextFontCX">Another way to protect null dereference, is
to declare a function using <span class="Annot"><span style=
'font-size:10.0pt'>nullwhentrue</span></span> or <span class=
"Annot"><span style=
'font-size:10.0pt'>falsewhennull</span></span>(these annotations
where originally <span class="Annot"><span style=
'font-size:10.0pt'>falsenull</span></span> and <span class=
"Annot"><span style='font-size:10.0pt'>truenull</span></span>, but
were renamed to clarify the logical asymmetry; <span class=
"Annot"><span style='font-size:10.0pt'>falsenull</span></span> and
<span class="Annot"><span style=
'font-size:10.0pt'>truenull</span></span> may still be used) and
call the function in a conditional statement before the
      <span class="Annot"><span style=
      'font-size:10.0pt'>null</span></span>-annotated pointer is
      dereferenced.&nbsp;</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">If a function annotated with
      <span class="Annot"><span style=
      'font-size:10.0pt'>nullwhentrue</span></span> returns true it
      means its first passed parameter is <span class=
      "CodeText"><span style='font-size:10.0pt'>NULL</span></span>.
      If it returns false, the parameter is not <span class=
      "CodeText"><span style=
      'font-size:10.0pt'>NULL</span></span>.&nbsp; Note that it may
      return true for a parameter that is not <span class=
      "CodeText"><span style=
      'font-size:10.0pt'>NULL</span></span>.&nbsp; A more
      descriptive name for <span class="Annot"><span style=
      'font-size:10.0pt'>nullwhentrue</span></span> would be
      &#8220;if the result is false, the parameter was not
      null&#8221;. For example, if <span class=
      "CodeText"><span style=
      'font-size:10.0pt'>isNull</span></span> is declared as,</p>
<p class="example">&nbsp;&nbsp; /*@nullwhentrue@*/ bool isNull
(/*@null@*/ char *x);</p>
<p class="beforelist">we could write <span class=
"CodeText"><span style=
'font-size: 10.0pt'>firstChar2</span></span>:</p>
<p class="Verbatim">&nbsp;&nbsp; char firstChar2 (/*@null@*/ char
*s)</p>
<p class="Verbatim">&nbsp;&nbsp; {</p>
<p class="Verbatim" style='margin-left:.5in'>if (isNull (s)) return
'\0';<br>
return *s;</p>
<p class="Verbatim">&nbsp;&nbsp; }</p>
<p class="afterlist">No error is reported since the dereference of
<span class="CodeText"><span style=
'font-size:10.0pt'>s</span></span> is only reached if
      <span class="CodeText"><span style=
      'font-size:10.0pt'>isNull(s)</span></span> is false, and
      since <span class="CodeText"><span style=
      'font-size:10.0pt'>isNull</span></span> is declared with the
      <span class="Annot"><span style=
      'font-size:10.0pt'>nullwhentrue</span></span> annotation this
      means <span class="CodeText"><span style=
      'font-size:10.0pt'>s</span></span> must not be null.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">The <span class="Annot"><span style=
'font-size:10.0pt'>falsewhennull</span></span> annotation is not
quite the logical opposite of <span class=
      "Annot"><span style='font-size:10.0pt'>nullwhentrue</span></span>.&nbsp;
      If a function declared with <span class="Annot"><span style=
      'font-size:10.0pt'>falsewhennull</span></span> returns true,
      it means its parameter is definitely not <span class=
      "CodeText"><span style=
      'font-size:10.0pt'>NULL</span></span>.&nbsp; If it returns
      false, the parameter may or may not be <span class=
      "CodeText"><span style=
      'font-size:10.0pt'>NULL</span></span>.&nbsp; That is a
      <span class="Annot"><span style=
      'font-size:10.0pt'>falsewhennull</span></span> always returns
      false when passed a <span class="CodeText"><span style=
      'font-size: 10.0pt'>NULL</span></span> parameter; it may
      sometimes return false when passed a non-<span class=
      "CodeText"><span style='font-size:10.0pt'>NULL</span></span>
      parameter.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="beforelist">For example, we could define
      <span class="CodeText"><span style=
      'font-size:10.0pt'>isNonEmpty</span></span> to return true if
      its parameter is not <span class="CodeText"><span style=
      'font-size:10.0pt'>NULL</span></span> and has least one
      character before the <span class="CodeText"><span style=
      'font-size:10.0pt'>NUL</span></span> terminator:</p>
<p class="Verbatim">&nbsp;&nbsp; /*@falsewhennull@*/ bool
isNonEmpty (/*@null@*/ char *x)</p>
<p class="Verbatim">&nbsp;&nbsp; {</p>
<p class="Verbatim">&nbsp;&nbsp;&nbsp;&nbsp; return (x != NULL
&amp;&amp; *x != &#8216;\0&#8217;);</p>
<p class="Verbatim">&nbsp;&nbsp; }</p>
<p class="afterlist">Splint does not check that the implementation
of a function declared with <span class="Annot"><span style=
'font-size:10.0pt'>nullwhentrue</span></span> or <span class=
"Annot"><span style='font-size:10.0pt'>falsewhennull</span></span>
is consistent with its annotation, but assumes the annotation is
correct when code that calls the function is checked.</p>
<h3 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974940">2.1.2<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Notnull Annotations</a></h3>
<p class="TextFontCX">The <span class="Annot"><span style=
'font-size:10.0pt'>notnull</span></span> annotation specifies that
a declarator is definitely not <span class=
      "CodeText"><span style='font-size:10.0pt'>NULL</span></span>.&nbsp;
      By default, this is assumed, but it may be necessary to use
      <span class="Annot"><span style=
      'font-size:10.0pt'>notnull</span></span> to override a
      <span class="Annot"><span style=
      'font-size:10.0pt'>null</span></span> in a type
      definition.&nbsp; The <span class="Annot"><span style=
      'font-size:10.0pt'>null</span></span> annotation may be used
      in a type definition to indicate that all instances of the
      type may be <span class="CodeText"><span style=
      'font-size:10.0pt'>NULL</span></span>.&nbsp; For declarations
      of a type declared using <span class="Annot"><span style=
      'font-size:10.0pt'>null</span></span>, the <span class=
      "Annot"><span style='font-size:10.0pt'>null</span></span>
      annotation in the type definition may be overridden with
      <span class="Annot"><span style=
      'font-size:10.0pt'>notnull</span></span>. This is
      particularly useful for parameters to hidden <span class=
      "CodeText"><span style=
      'font-size:10.0pt'>static</span></span> operations of
      abstract types (see Section 4.3) where the null test has
      already been done before the function is called, or function
      results known to never be <span class="CodeText"><span style=
      'font-size:10.0pt'>NULL</span></span>.&nbsp; For an abstract
      type, <span class="Flag"><span style=
      'font-size:10.0pt'>notnull</span></span> may not be used for
      parameters to external functions, since clients should not be
      aware of when the concrete representation may by <span class=
      "CodeText"><span style=
      'font-size:10.0pt'>NULL</span></span>.&nbsp; Parameters to
      static functions in the implementation module, however, may
      be declared using <span class="Annot"><span style=
      'font-size:10.0pt'>notnull</span></span>, since they may only
      be called from places where the representation is
      accessible.&nbsp; Return values for <span class=
      "CodeText"><span style=
      'font-size:10.0pt'>static</span></span> or external functions
      may be declared using <span class="Annot"><span style=
      'font-size:10.0pt'>notnull</span></span>.&nbsp;</p>
<h3 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974941"></a><a name="_Ref347853058">2.1.3<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Relaxing Null Checking</a></h3>
<p class="TextFontCX">An additional annotation, <span class=
"Annot"><span style='font-size:10.0pt'>relnull</span></span> may be
used to relax null checking.&nbsp; No error is reported when a
<span class="Annot"><span style=
'font-size:10.0pt'>relnull</span></span> value is dereferenced, or
when a possibly null value is assigned to an identifier declared
using <span class="Annot"><span style=
'font-size:10.0pt'>relnull</span></span>.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">This is generally used for structure fields
that may or may not be null depending on some other
constraint.&nbsp; Splint does not report and error when
      <span class="CodeText"><span style=
      'font-size:10.0pt'>NULL</span></span> is assigned to a
      <span class="Annot"><span style=
      'font-size:10.0pt'>relnull</span></span> reference, or when a
      <span class="Annot"><span style=
      'font-size:10.0pt'>relnull</span></span> reference is
      dereferenced.&nbsp; It is up to the programmer to ensure that
      this constraint is satisfied before the pointer is
      dereferenced.</p>
<h1 style='margin-left:0in;text-indent:0in'><a name=
"_Ref348845237"></a><a name="_Ref347254431"></a><a name=
"_Ref347169350"></a><a name="_Ref344916590"></a><a name=
"_Ref344907893"></a><a name="_Toc344355407"></a><a name=
"_Toc534974942"></a><a name="_Ref534641444"></a><a name=
"_Ref534093775"></a><a name="_Ref534093769"></a><a name=
"_Ref534049950">3<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
<a id="undefined" name="undefined">Undefined Values</a></a></h1>
<p class="TextFontCX">Like many static checkers, Splint detects
instances where the value of a location is used before it is
defined.&nbsp; This analysis is done at the procedural level.&nbsp;
If there is a path through the procedure that uses a local variable
before it is defined, a use before definition error is
reported.&nbsp; The <span class="Flag"><span style=
'font-size:10.0pt'>usedef</span></span> flag controls use before
definition checking.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Splint can do more checking than standard
checkers though, because the annotations can be used to describe
what storage must be defined and what storage may be undefined at
interface points. Unannotated references are expected to be
completely defined at interface points.&nbsp; This means all
storage reachable from a global variable, parameter to a function,
or function return value is defined before and after a function
call.</p>
<h3 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974943"></a><a name="_Ref347811030"></a><a name=
"_Ref347204458">3.1.1<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Undefined Parameters</a></h3>
<p class="TextFontCX">Sometimes, function parameters or return
values are expected to reference undefined or partially defined
storage.&nbsp; For example, a pointer parameter may be intended
only as an address to store a result, or a memory allocator may
return allocated but undefined storage.&nbsp; The
      <span class="Annot"><span style=
      'font-size:10.0pt'>out</span></span>&nbsp;annotation denotes
      a pointer to storage that may be undefined.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Splint does not report an error when a
pointer to allocated but undefined storage is passed as an
<span class="Annot"><span style=
'font-size:10.0pt'>out</span></span> parameter.&nbsp; Within the
body of a function, Splint will assume an <span class=
"Annot"><span style='font-size:10.0pt'>out</span></span> parameter
is allocated but not necessarily bound to a value, so an error is
reported if its value is used before it is defined.&nbsp;</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Splint reports an error if storage reachable
by the caller after the call is not defined when the function
returns.&nbsp; This can be suppressed by <span class=
"Flag"><span style=
'font-size: 10.0pt'>-must-define</span></span>.&nbsp; After a call
returns, an actual parameter corresponding to an <span class=
"Annot"><span style='font-size:10.0pt'>out</span></span> parameter
is assumed to be completely defined.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">When checking unannotated programs, many
spurious use before definition errors may be reported&nbsp;&nbsp;
If <span class="Flag"><span style=
'font-size:10.0pt'>impouts</span></span> is on, no error is
reported when an incompletely-defined parameter is passed to a
formal parameter with no definition annotation, and the actual
parameter is assumed to be defined after the call.&nbsp; The
<span class="Annot"><span style=
'font-size:10.0pt'>/*@in@*/</span></span>&nbsp;annotation can be
used to denote a parameter that must be completely defined, even if
<span class="Flag"><span style=
'font-size:10.0pt'>imp-outs</span></span> is on.&nbsp; If
<span class="Flag"><span style=
'font-size:10.0pt'>imp-outs</span></span> is off, there is an
implicit <span class="Annot"><span style=
'font-size:10.0pt'>in</span></span> annotation on every parameter
with no definition annotation.</p>
<p class="TextFontCX">&nbsp;</p>
<table class="MsoNormalTable" border="0" cellspacing="0"
cellpadding="0" style='margin-left:.9pt;border-collapse:collapse'>
<tr>
<td width="40%" valign="top" style=
'border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX" align="center" style='text-align:center'>
<span class="Keyword"><b><span style=
'font-size:10.0pt; color:white'>usedef.c</span></b></span></p></td>
<td valign="top" style=
'border-top:1.5pt solid black; border-left:medium none;border-bottom:medium none;border-right:1.5pt solid black; background:black;padding-left:5.4pt; padding-right:5.4pt; padding-top:0in; padding-bottom:0in'>
<p class="TextFontCX" align="center" style='text-align:center'>
<b><span style='color:white'>Running
Splint</span></b></p></td></tr>
<tr>
<td valign="top" style=
'border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt'>
<p class="MsoNormal"><span class="Keyword"><span style=
'font-size:10.0pt; color:windowtext'>extern void</span></span></p>
<p class="MsoNormal"><span class="Keyword"><span style=
'font-size:10.0pt; color:windowtext'>&nbsp; setVal (/*@out@*/ int
*x);</span></span></p>
<p class="MsoNormal"><span class="Keyword"><span style=
'font-size:10.0pt; color:windowtext'>extern int</span></span></p>
<p class="MsoNormal"><span class="Keyword"><span style=
'font-size:10.0pt; color:windowtext'>&nbsp; getVal (/*@in@*/ int
*x);</span></span></p>
<p class="MsoNormal"><span class="Keyword"><span style=
'font-size:10.0pt; color:windowtext'>extern int
mysteryVal</span></span></p>
<p class="MsoNormal"><span class="Keyword"><span style=
'font-size:10.0pt; color:windowtext'>&nbsp; (int
*x);</span></span></p>
<p class="MsoNormal"><span class="Keyword"><span style=
'font-size:10.0pt; color:windowtext'>&nbsp;</span></span></p>
<p class="MsoNormal" align="left" style='text-align:left'>
<span class="Keyword"><span style=
'font-size:10.0pt;color:windowtext'>int dumbfunc</span></span></p>
<p class="MsoNormal" align="left" style='text-align:left'>
<span class="Keyword"><span style=
'font-size:10.0pt;color:windowtext'>&nbsp;&nbsp; (/*@out@*/ int *x,
int i)</span></span></p>
<p class="MsoNormal"><span class="Keyword"><span style=
'font-size:10.0pt; color:windowtext'>{</span></span></p>
<p class="MsoNormal"><span class="Keyword"><span style=
'font-size:10.0pt; color:windowtext'>&nbsp; if (i &gt;
3)</span></span></p>
<p class="MsoNormal"><span class="Line"><span style=
'font-size:8.0pt'>11</span></span><span class=
      "Keyword"><span style='font-size:10.0pt;color:windowtext'>&nbsp;&nbsp;
      return *x;</span></span></p>
<p class="MsoNormal"><span class="Keyword"><span style=
'font-size:10.0pt; color:windowtext'>&nbsp; else if (i &gt;
1)</span></span></p>
<p class="MsoNormal"><span class="Line"><span style=
'font-size:8.0pt'>13</span></span><span class=
      "Keyword"><span style='font-size:10.0pt;color:windowtext'>&nbsp;&nbsp;
      return getVal (x);</span></span></p>
<p class="MsoNormal"><span class="Keyword"><span style=
'font-size:10.0pt; color:windowtext'>&nbsp; else if (i ==
0)</span></span></p>
<p class="MsoNormal"><span class="Line"><span style=
'font-size:8.0pt'>15</span></span><span class=
      "Keyword"><span style='font-size:10.0pt;color:windowtext'>&nbsp;&nbsp;
      return mysteryVal (x);</span></span></p>
<p class="MsoNormal"><span class="Keyword"><span style=
'font-size:10.0pt; color:windowtext'>&nbsp; else</span></span></p>
<p class="MsoNormal"><span class="Keyword"><span style=
'font-size:10.0pt; color:windowtext'>&nbsp;&nbsp;&nbsp;
{</span></span></p>
<p class="MsoNormal"><span class="Line"><span style=
'font-size:8.0pt'>18</span></span><span class=
      "Keyword"><span style='font-size:10.0pt;color:windowtext'>&nbsp;&nbsp;&nbsp;
      setVal (x);</span></span></p>
<p class="MsoNormal"><span class="Line"><span style=
'font-size:8.0pt'>19</span></span><span class=
      "Keyword"><span style='font-size:10.0pt;color:windowtext'>&nbsp;&nbsp;&nbsp;
      return *x;</span></span></p>
<p class="MsoNormal"><span class="Keyword"><span style=
'font-size:10.0pt; color:windowtext'>&nbsp;&nbsp;&nbsp;
}</span></span></p>
<p class="Verbatim"><span class="Keyword"><span style=
'color:windowtext'>}</span></span></p></td>
<td valign="top" style=
'border-top:medium none;border-left:medium none; border-bottom:1.5pt solid black;border-right:1.5pt solid black;padding-left:5.4pt; padding-right:5.4pt; padding-top:0in; padding-bottom:0in'>
<p class="lclintrun">&gt; splint usedef.c</p>
<p class="lclintrun">usedef.c:11: Value *x used before
definition</p>
<p class="lclintrun">usedef.c:13: Passed storage x not completely
defined</p>
<p class="lclintrun">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
(*x is undefined): getVal (x)</p>
<p class="lclintrun">usedef.c:15: Passed storage x not completely
defined</p>
<p class="lclintrun">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
(*x is undefined): mysteryVal (x)</p>
<p class="lclintrun">&nbsp;</p>
<p class="lclintrun">Finished checking --- 3 code warnings</p>
<p class="TextFontCX"><i>&nbsp;</i></p>
<p class="IndentText" style=
'margin-top:0in;margin-right:.85pt;margin-bottom: 0in;margin-left:0in;margin-bottom:.0001pt;page-break-after:avoid'>
<i>No error is reported for line 18, since the incompletely defined
storage</i> <span class="CodeText"><span style=
'font-size:10.0pt'>x</span></span> <i>is passed as an</i>
<span class="CodeText"><span style=
'font-size:10.0pt'>out</span></span> <i>parameter.&nbsp; After the
call,</i> <span class="CodeText"><span style=
'font-size: 10.0pt'>x</span></span> <i>may be dereferenced,
since</i> <span class="Annot"><span style=
'font-size:10.0pt'>setVal</span></span> <i>is assumed to completely
define its</i> <span class="Annot"><span style=
'font-size:10.0pt'>out</span></span> <i>parameter.&nbsp; The
warning for line 15 would not appear if</i> <span class=
"Flag"><span style='font-size:10.0pt'>+impouts</span></span>
<i>were used since there is no</i> <span class=
      "Annot"><span style='font-size:10.0pt'>in</span></span>
      <i>annotation on the parameter to</i> <span class=
      "Flag"><span style=
      'font-size: 10.0pt'>mysteryVal</span></span><i>.</i></p></td></tr></table>
<div>
<div align="center">
<center>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       style="border-collapse: collapse" bordercolor="#111111">
<tr>
<td valign="top" align="left" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="MsoCaption"><a name="_Ref347764461"></a><a name=
"_Ref347853047"></a><a name="_Toc534824607">Figure 3.&nbsp; Use
before Definition</a></p></td></tr></table></center></div></div>
<br clear="all">
 
<h3 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974944">3.1.2<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Relaxing Checking</a></h3>
<p class="TextFontCX">The <span class="Annot"><span style=
'font-size:10.0pt'>reldef</span></span>&nbsp;annotation relaxes
definition checking for a particular declaration.&nbsp; Storage
declared with a <span class="Annot"><span style=
'font-size:10.0pt'>reldef</span></span> annotation is assumed to be
defined when it is used, but no error is reported if it is not
defined before it is returned or passed as a parameter.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">It is up to the programmer to check
<span class="Annot"><span style=
'font-size:10.0pt'>reldef</span></span> fields are used
correctly.&nbsp;&nbsp; They should be avoided in most cases, but
may be useful for fields of structures that may or may not be
defined depending on other constraints.&nbsp;</p>
<h3 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974945"></a><a name="_Ref347853043">3.1.3<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Partially Defined Structures</a></h3>
<p class="TextFontCX">The <span class="Annot"><span style=
'font-size:10.0pt'>partial</span></span> annotation can be used to
relax checking of structure fields.&nbsp; A structure with
undefined fields may be passed as a <span class=
      "Annot"><span style='font-size: 10.0pt'>partial</span></span>
      parameter or returned as a <span class="Annot"><span style=
      'font-size:10.0pt'>partial</span></span> result.&nbsp; Inside
      a function body, no error is reported when the field of a
      <span class="Annot"><span style=
      'font-size:10.0pt'>partial</span></span> structure is
      used.&nbsp; After a call, all fields of a structure that is
      passed as a <span class="Annot"><span style=
      'font-size:10.0pt'>partial</span></span> parameter are
      assumed to be completely defined.</p>
<h1 style='margin-left:0in;text-indent:0in'><a name=
"_Ref534977413"></a><a name="_Toc534974946">4<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
<a id="types" name="types">
Types</a></a></h1>
<p class="TextFontCX">Strong type checking&nbsp;often reveals
programming errors.&nbsp; Splint can check primitive C types more
strictly and flexibly than typical compilers (4.1) and provides
support a Boolean type (4.2).&nbsp; In addition, users can define
abstract types that provide information hiding&nbsp;(0).</p>
<h2 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974947"></a><a name="_Ref534642132"></a><a name=
"_Ref533964147"></a><a name="_Toc344355401">4.1<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Built in C Types</a></h2>
<p align="right"><span style='font-size:9.0pt'><i>Two types
have</i> compatible <i>type if their types are the
same.</i></span></p>
<p class="TextFontCX" align="right" style='text-align:right'>
<span style='font-size:9.0pt'><span style='font-size:9.0pt'>ANSI C,
3.1.2.6.</span></span></p>
<p class="Sidebar">&nbsp;</p>
<br>
<br>
 
<p class="MsoListBullet" style='margin-left:0in;text-indent:0in'>
Splint supports stricter checking of built in C types.&nbsp; The
<span class="CodeText"><span style=
'font-size:10.0pt'>char</span></span> and <span class=
"CodeText"><span style='font-size:10.0pt'>enum</span></span> types
can be checked as distinct types, and the different numeric types
can be type-checked strictly.</p>
<h3 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974948">4.1.1<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Characters</a></h3>
<p class="TextFontCX">The primitive <span class=
"CodeText"><span style='font-size:10.0pt'>char</span></span> type
can be type-checked as a distinct type.&nbsp; If <span class=
"CodeText"><span style='font-size:10.0pt'>char</span></span> is
used as a distinct type, common errors involving assigning
<span class="CodeText"><span style=
'font-size:10.0pt'>int</span></span>s to <span class=
"CodeText"><span style='font-size:10.0pt'>char</span></span>s are
detected.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">The <span class="Flag"><span style=
'font-size:10.0pt'>+charint</span></span> flag can be used for
checking legacy programs where <span class=
      "CodeText"><span style='font-size:10.0pt'>char</span></span>
      and <span class="CodeText"><span style=
      'font-size:10.0pt'>int</span></span> are used
      interchangeably.&nbsp; If <span class="Flag"><span style=
      'font-size:10.0pt'>charint</span></span> is on, <span class=
      "CodeText"><span style='font-size:10.0pt'>char</span></span>
      types indistinguishable from <span class=
      "CodeText"><span style=
      'font-size:10.0pt'>int</span></span>s.&nbsp; To keep
      <span class="CodeText"><span style=
      'font-size:10.0pt'>char</span></span> and <span class=
      "Keyword"><span style='font-size:10.0pt'>int</span></span> as
      distinct types, but allow chars to be used to index arrays,
      use <span class="Flag"><span style=
      'font-size:10.0pt'>+charindex</span></span>.</p>
<h3 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974949">4.1.2<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Enumerators</a></h3>
<p class="TextFontCX">Standard C treats user-declared
      <span class="CodeText"><span style=
      'font-size:10.0pt'>enum</span></span> types just like
      integers.&nbsp; An arbitrary integral value may be assigned
      to an <span class="CodeText"><span style=
      'font-size:10.0pt'>enum</span></span> type, whether or not it
      was listed as an enumerator member.&nbsp; Splint checks each
      user-defined <span class="CodeText"><span style=
      'font-size:10.0pt'>enum</span></span> type as distinct
      type.&nbsp; An error is reported if a value that is not an
      enumerator member is assigned to the <span class=
      "CodeText"><span style='font-size:10.0pt'>enum</span></span>
      type, or if an <span class="CodeText"><span style=
      'font-size:10.0pt'>enum</span></span> type is used as an
      operand to an arithmetic operator.&nbsp; If the <span class=
      "Flag"><span style='font-size:10.0pt'>enumint</span></span>
      flag is on, <span class="CodeText"><span style=
      'font-size:10.0pt'>enum</span></span> and <span class=
      "CodeText"><span style='font-size:10.0pt'>int</span></span>
      types may be used interchangeably.&nbsp; Like <span class=
      "Flag"><span style=
      'font-size:10.0pt'>charindex</span></span>, if the
      <span class="Flag"><span style=
      'font-size:10.0pt'>enumindex</span></span> flag is on,
      <span class="CodeText"><span style=
      'font-size:10.0pt'>enum</span></span> types may be used to
      index arrays.</p>
<h3 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974950">4.1.3<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Numeric Types</a></h3>
<p class="TextFontCX">Splint reports where numeric types&nbsp;are
used in dangerous or inconsistent ways.&nbsp; With the strictest
checking, Splint will report an error anytime numeric types do not
match exactly.&nbsp; If the <span class="Flag"><span style=
'font-size:10.0pt'>relax-quals</span></span> flag is on, only those
inconsistencies that may corrupt values are reported.&nbsp; For
example, if an <span class="CodeText"><span style=
'font-size:10.0pt'>int</span></span> is assigned to a variable of
type <span class="CodeText"><span style=
'font-size: 10.0pt'>long</span></span> (or passed as a
      <span class="CodeText"><span style=
      'font-size:10.0pt'>long</span></span> formal parameter),
      Splint will not report an error if <span class=
      "Flag"><span style=
      'font-size:10.0pt'>relax-quals</span></span> is on since a
      <span class="CodeText"><span style=
      'font-size:10.0pt'>long</span></span> must have at least
      enough bits to store an <span class="CodeText"><span style=
      'font-size:10.0pt'>int</span></span> without data loss.&nbsp;
      On the other hand, an error would be reported if the
      <span class="CodeText"><span style=
      'font-size:10.0pt'>long</span></span> were assigned to an
      <span class="CodeText"><span style=
      'font-size:10.0pt'>int</span></span>, since the <span class=
      "CodeText"><span style='font-size:10.0pt'>int</span></span>
      type may not have enough bits to store the <span class=
      "CodeText"><span style='font-size:10.0pt'>long</span></span>
      value.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Similarly, if a <span class=
"CodeText"><span style='font-size:10.0pt'>signed</span></span>
value is assigned to an <span class="CodeText"><span style=
'font-size:10.0pt'>unsigned</span></span>, Splint will report an
error since an <span class="CodeText"><span style=
'font-size:10.0pt'>unsigned</span></span> type cannot represent all
<span class="CodeText"><span style=
'font-size:10.0pt'>signed</span></span> values correctly.&nbsp; If
the <span class="Flag"><span style=
'font-size:10.0pt'>+ignore-signs</span></span> flag is on, checking
is relaxed to ignore all sign qualifiers in type comparisons (this
is not recommended, since it will suppress reporting of real bugs,
but may be necessary for quickly checking certain legacy
code).&nbsp;</p>
<h3 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974951">4.1.4<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Arbitrary Integral Types</a></h3>
<p class="TextFontCX">Some types are declared to be integral types,
but the concrete type may be implementation dependent.&nbsp; For
example, the standard library declares the types <span class=
"CodeText"><span style='font-size:10.0pt'>size_t</span></span>,
<span class="CodeText"><span style=
'font-size:10.0pt'>ptr_diff</span></span> and <span class=
"CodeText"><span style='font-size:10.0pt'>wchar_t</span></span>,
but does not constrain their types other than limiting them to
integral types.&nbsp; Programs may rely on them being integral
types (e.g., can use <span class="CodeText"><span style=
'font-size:10.0pt'>+</span></span> operator on two
      <span class="CodeText"><span style=
      'font-size:10.0pt'>size_t</span></span> operands), but should
      not rely on a particular representation (e.g., <span class=
      "CodeText"><span style='font-size: 10.0pt'>long
      unsigned</span></span>).&nbsp;&nbsp;&nbsp;</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Splint supports three different kinds of
arbitrary integral types:</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>/*@integraltype@*/</span></span></p>
<p class="TextFontCX"><span class="Annot"><font size=
"2">&nbsp;&nbsp;&nbsp;</font></span> An arbitrary integral
type.&nbsp; The actual type may be any one of <span class=
"CodeText"><span style='font-size:10.0pt'>short</span></span>,
<span class="CodeText"><span style=
'font-size:10.0pt'>int</span></span>, <span class=
"CodeText"><span style='font-size:10.0pt'>long</span></span>,
<span class="CodeText"><span style='font-size:10.0pt'>unsigned
short</span></span>, <span class="CodeText"><span style=
'font-size:10.0pt'>unsigned</span></span>, or <span class=
"CodeText"><span style='font-size:10.0pt'>unsigned
long</span></span>.</p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>/*@unsignedintegraltype@*/</span></span></p>
<p class="TextFontCX"><span class="Annot"><font size=
"2">&nbsp;&nbsp;&nbsp;</font></span> An arbitrary unsigned integral
type.&nbsp; The actual type may be any one of <span class=
"CodeText"><span style='font-size:10.0pt'>unsigned
short</span></span>, <span class="CodeText"><span style=
'font-size:10.0pt'>unsigned</span></span>, or <span class=
"CodeText"><span style='font-size:10.0pt'>unsigned
long</span></span>.</p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>/*@signedintegraltype@*/</span></span></p>
<p class="TextFontCX"><span class="Annot"><font size=
"2">&nbsp;&nbsp;&nbsp;</font></span> An arbitrary signed integral
type.&nbsp; The actual type may be any one of <span class=
"CodeText"><span style='font-size:10.0pt'>short</span></span>,
<span class="CodeText"><span style=
'font-size:10.0pt'>int</span></span>, or <span class=
"CodeText"><span style='font-size:10.0pt'>long</span></span>.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Splint reports an error if the code depends
on the actual representation of a type declared as an arbitrary
integral.&nbsp; The <span class="Flag"><span style=
'font-size:10.0pt'>match-any-integral</span></span>&nbsp;flag
relaxes checking and allows an arbitrary integral type is allowed
to match any integral type.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Other flags set the arbitrary integral types
to a concrete type.&nbsp; These should only be used if portability
to platforms that may use different representations is not
important.&nbsp; The <span class="Flag"><span style=
'font-size:10.0pt'>long-integral</span></span>&nbsp;and
      <span class="Flag"><span style=
      'font-size:10.0pt'>long-unsigned-integral</span></span>&nbsp;flags
      set the type corresponding to <span class=
      "Annot"><span style='font-size: 10.0pt'>/*@integraltype@*/</span></span>&nbsp;to
      be <span class="CodeText"><span style=
      'font-size:10.0pt'>unsigned long</span></span> and
      <span class="CodeText"><span style=
      'font-size:10.0pt'>long</span></span> respectively.&nbsp; The
      <span class="Flag"><span style=
      'font-size:10.0pt'>long-unsigned-unsigned-integral</span></span>&nbsp;flag
      sets the type corresponding to <span class=
      "Annot"><span style=
      'font-size: 10.0pt'>/*@unsignedintegraltype@*/</span></span>
      to be <span class="CodeText"><span style=
      'font-size:10.0pt'>unsigned long</span></span>.&nbsp; The
      <span class="Flag"><span style=
      'font-size:10.0pt'>long-signed-integral</span></span>&nbsp;flag
      sets the type corresponding to <span class=
      "Annot"><span style=
      'font-size:10.0pt'>/*@signedintegraltype@*/</span></span> to
      be <span class="CodeText"><span style=
      'font-size:10.0pt'>long</span></span>.</p>
<h2 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974952"></a><a name="_Ref534642133"></a><a name=
"_Ref533964143"></a><a name="_Ref344892413"></a><a name=
"_Toc344355400">4.2<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Boolean Types</a></h2>
<p class="TextFontCX">Pre-ISO99 C had no Boolean representation
&#8211; the result of a comparison operator was an integer, and no
type checking is done for test expressions.&nbsp; C99 introduced a
Boolean type (<span class="CodeText"><span style=
'font-size:10.0pt'>_Bool</span></span> and <span class=
"CodeText"><span style='font-size:10.0pt'>bool</span></span>,
<span class="CodeText"><span style=
'font-size:10.0pt'>true</span></span> and <span class=
"CodeText"><span style='font-size:10.0pt'>false</span></span>
macros in <span style=
'font-size:10.0pt;font-family:Arial'>stdbool.h</span>), but did not
strengthen the type checking.&nbsp; Splint supports a Boolean type
that can be checked distinctly from integral types.&nbsp; Many
common errors can be detected by introducing a distinct Boolean
type and stronger type checking.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Splint checks that the test expression in an
<span class="CodeText"><span style=
'font-size:10.0pt'>if</span></span>, <span class=
"CodeText"><span style='font-size:10.0pt'>while</span></span>, or
<span class="CodeText"><span style=
'font-size:10.0pt'>for</span></span> statement or an operand of a
<span class="CodeText"><span style=
'font-size:10.0pt'>&amp;&amp;</span></span>, <span class=
"CodeText"><span style='font-size:10.0pt'>||</span></span> or
<span class="CodeText"><span style=
'font-size:10.0pt'>!</span></span>operator is a Boolean.&nbsp; If
the type of a test expression is not a Boolean, Splint will produce
a warning depending on the type of the test expression and flag
settings.&nbsp; If the test expression has pointer type, the
warning is inhibited by <span class="Flag"><span style=
'font-size:10.0pt'>&#8211;predboolptr</span></span> (this can be
used to prevent messages for the idiom of testing if a pointer is
not null without a comparison).&nbsp; If it is type
      <span class="CodeText"><span style=
      'font-size:10.0pt'>int</span></span>, the warnings is
      inhibited by <span class="Flag"><span style=
      'font-size:10.0pt'>-pred-bool-int</span></span>.&nbsp; For
      all other types, Splint warns unless <span class=
      "Flag"><span style=
      'font-size: 10.0pt'>-pred-bool-others</span></span> is
      set.&nbsp;&nbsp; Relations, comparisons and certain standard
      library functions are declared to return Booleans.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Since using <span class=
"CodeText"><span style='font-size:10.0pt'>=</span></span> instead
of <span class="CodeText"><span style=
'font-size:10.0pt'>==</span></span> is such a common bug, reporting
of test expressions that are assignments is controlled by the
separate <span class="Flag"><span style=
'font-size:10.0pt'>pred-assign</span></span> flag.&nbsp; The
message can be suppressed by adding extra parentheses around the
test expression.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Use the <span class="Flag"><span style=
'font-size:10.0pt'>&#8211;booltype
&lt;name&gt;</span></span>&nbsp;flag to select the type name is
used to represent Boolean values.&nbsp; There is no default Boolean
type, although <span class="CodeText"><span style=
'font-size: 10.0pt'>bool</span></span> is used by convention.&nbsp;
The names <span class="CodeText"><span style=
'font-size:10.0pt'>TRUE</span></span> and <span class=
"CodeText"><span style='font-size:10.0pt'>FALSE</span></span> are
assumed to represent true and false Boolean values.&nbsp; To change
the names of true and false, use <span class=
      "Flag"><span style='font-size:10.0pt'>-booltrue</span></span>
      and <span class="Flag"><span style=
      'font-size:10.0pt'>-boolfalse</span></span>.&nbsp; (The
      Splint distribution includes an implementation of
      <span class="CodeText"><span style=
      'font-size:10.0pt'>bool</span></span>, in <span class=
      "CodeText"><span style=
      'font-size:10.0pt;color:windowtext'>lib/bool.h</span></span>.&nbsp;
      However, it isn&#8217;t necessary to use this implementation
      to get the benefits of Boolean checking.)</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Figure 4 illustrates some of the Boolean
checking done by Splint.&nbsp;</p>
<p class="TextFontCX">&nbsp;</p>
<center>
<table class="MsoNormalTable" border="0" cellspacing="0"
cellpadding="0" style=
'margin-left:5.4pt;border-collapse:collapse; margin-left:-2.25pt;margin-right:-2.25pt'>
<tr style='height:13.3pt'>
<td valign="top" style=
'border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt;height:13.3pt'>
<p class="TextFontCX" align="center" style='text-align:center'>
<span class="Keyword"><b><span style=
'font-size:10.0pt; color:white'>bool.c</span></b></span></p></td>
<td valign="top" style=
'border-top:1.5pt solid black; border-left:medium none;border-bottom:medium none;border-right:1.5pt solid black; background:black;padding-left:5.4pt; padding-right:5.4pt; padding-top:0in; padding-bottom:0in'>
<p class="TextFontCX" align="center" style='text-align:center'>
<b><span style='color:white'>Running
Splint</span></b></p></td></tr>
<tr>
<td valign="top" style=
'width:2.0in;border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt;height:156.15pt'>
<p class="Verbatim"># include "bool.h"</p>
<p class="Verbatim">int f (int i, char *s,</p>
<p class="Verbatim">&nbsp;&nbsp;&nbsp;&nbsp; bool b1, bool b2)</p>
<p class="Verbatim">{</p>
<p class="Verbatim"><span class="Line"><span style=
'font-size:8.0pt'>&nbsp;6</span></span>&nbsp; if (i = 3)</p>
<p class="Verbatim"><span class="Line"><span style=
'font-size:8.0pt'>&nbsp;7</span></span>&nbsp;&nbsp;&nbsp; return
b1;</p>
<p class="Verbatim"><span class="Line"><span style=
'font-size:8.0pt'>&nbsp;8</span></span>&nbsp; if (!i || s)</p>
<p class="Verbatim"><span class="Line"><span style=
'font-size:8.0pt'>&nbsp;9</span></span>&nbsp;&nbsp;&nbsp; return
i;</p>
<p class="Verbatim"><span class="Line"><span style=
'font-size:8.0pt'>10</span></span>&nbsp; if (s)</p>
<p class="Verbatim"><span class="Line"><span style=
'font-size:8.0pt'>11</span></span>&nbsp;&nbsp;&nbsp; return 7;</p>
<p class="Verbatim"><span class="Line"><span style=
'font-size:8.0pt'>12</span></span>&nbsp; if (b1 == b2)</p>
<p class="Verbatim"><span class="Line"><span style=
'font-size:8.0pt'>13</span></span>&nbsp;&nbsp;&nbsp; return 3;</p>
<p class="Verbatim"><span class="Line"><span style=
'font-size:8.0pt'>14</span></span>&nbsp; return 2;</p>
<p class="Verbatim">}</p></td>
<td valign="top" style=
'border-top:medium none;border-left: medium none;border-bottom:1.5pt solid black;border-right:1.5pt solid black; padding-left:5.4pt; padding-right:5.4pt; padding-top:0in; padding-bottom:0in'>
<p class="lclintrun">&gt; splint bool.c +predboolptr
&#8211;booltype bool</p>
<p class="lclintrun">&nbsp;</p>
<p class="lclintrun">bool.c:6: Test expression for if is assignment
expression: i = 3</p>
<p class="lclintrun">bool.c:6: Test expression for if not bool,
type int: i = 3</p>
<p class="lclintrun">bool.c:7: Return value type bool does not
match declared type int: b1</p>
<p class="lclintrun">bool.c:8: Operand of ! is non-boolean (int):
!i</p>
<p class="lclintrun">bool.c:8: Right operand of || is non-boolean
(char *): !i || s</p>
<p class="lclintrun">bool.c:10: Test expression for if not bool,
type char *: s</p>
<p class="lclintrun">bool.c:12: Use of == with bool variables
(risks inconsistency because</p>
<p class="lclintrun">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
of multiple true values): b1 == b2</p>
<p class="lclintrun">&nbsp;</p>
<p class="lclintrun" style='page-break-after:avoid'>Finished
checking --- 7 code warnings found</p></td></tr></table>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
<tr>
<td valign="top" align="left" style=
'padding-top:.1in;padding-right: 9.35pt;padding-bottom:.1in;padding-left:9.35pt'>
<p class="MsoCaption"><a name="_Ref533964137"></a><a name=
"_Toc534824608"></a><a name="_Ref534821769">Figure 4</a>.&nbsp;
Boolean Checking</p></td></tr></table></center>
<h2 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974953"></a><a name="_Ref534970776">4.3<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Abstract Types</a></h2>
<p class="TextFontCX">Information hiding is a technique for
handling complexity.&nbsp; By hiding implementation details,
programs can be understood and developed in distinct modules and
the effects of a change can be localized.&nbsp; One technique for
information hiding&nbsp;is data abstraction.&nbsp; An
abstract&nbsp;type is used to represent some natural program
abstraction.&nbsp; It provides functions for manipulating instances
of the type.&nbsp; The module that implements these functions is
called the <i>implementation</i> module.&nbsp; We call the
functions that are part of the implementation of an abstract type
the <i>operations</i> of the type.&nbsp; Other modules that use the
abstract type are called <i>clients</i>.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Clients may use the type name and operations,
but should not manipulate or rely on the actual representation of
the type.&nbsp; Only the implementation module may manipulate the
representation of an abstract type.&nbsp; This hides information,
since implementers and maintainers of client modules should not
need to know anything about how the abstract type is implemented.
It provides modularity, since the representation of an abstract
type can be changed without having to change any client code.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Splint supports abstract types by detecting
places where client code depends on the concrete representation of
an abstract type.&nbsp; Some examples of abstraction violations
detected by Splint are shown in Figure 5.</p>
<p class="beforelist">&nbsp;</p>
<p class="beforelist">To declare an abstract type, the
      <span class="Annot"><span style=
      'font-size:10.0pt'>abstract</span></span>&nbsp;annotation is
      added to a <span class="CodeText"><span style=
      'font-size:10.0pt'>typedef</span></span>.&nbsp; For example
      (in <span class="Keyword"><span style=
      'font-size:10.0pt;font-family: Arial;color:windowtext'>mstring.h</span></span>),</p>
<p class="example">typedef /*@abstract@*/ char *mstring;</p>
<p class="TextFontCX">declares <span class=
      "CodeText"><span style='font-size:10.0pt'>mstring</span></span>
      as an abstract type.&nbsp; It is implemented using a
      <span class="CodeText"><span style='font-size:10.0pt'>char
      *</span></span>, but clients of the type should not depend on
      or need to be aware of this.&nbsp; If it later becomes
      apparent that a better representation such as a string table
      should be used, we should be able to change the
      implementation of <span class="CodeText"><span style=
      'font-size: 10.0pt'>mstring</span></span> without having to
      change or inspect any client code.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">In a client module, abstract types are
checked by name, not structure.&nbsp; Splint reports an error if an
instance of <span class="CodeText"><span style=
'font-size:10.0pt'>mstring</span></span> is passed as a
      <span class="CodeText"><span style='font-size:10.0pt'>char
      *</span></span> (for instance, as an argument to <span class=
      "CodeText"><span style=
      'font-size: 10.0pt'>strlen</span></span>), since the
      correctness of this call depends on the representation of the
      abstract type.&nbsp; Splint also reports errors if any C
      operator except assignment (<span class=
      "CodeText"><span style='font-size:10.0pt'>=</span></span>) or
      <span class="CodeText"><span style=
      'font-size:10.0pt'>sizeof</span></span> is used on an
      abstract type.&nbsp; The assignment operator is allowed since
      its semantics do not depend on the representation of the type
      (for abstract types whose instances can change value, a
      client does need to know if assignment has copy or sharing
      semantics as discussed in Section 4.3.2).&nbsp; The use of
      <span class="CodeText"><span style=
      'font-size:10.0pt'>sizeof</span></span>&nbsp;is also
      permitted, since this is the only way for clients to allocate
      pointers to the abstract type.&nbsp; Type casting objects to
      or from abstract types in a client module is an abstraction
      violation and will generate a warning message.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Normally, Splint will assume a type
definition is not abstract unless the <span class=
"Annot"><span style='font-size:10.0pt'>/*@abstract@*/</span></span>
qualifier is used.&nbsp; If instead you want all user-defined types
to be abstract types unless they are marked as <span class=
"Annot"><span style='font-size:10.0pt'>concrete</span></span>, the
<span class="Flag"><span style=
'font-size:10.0pt'>+imp-abstract</span></span> flag can be
used.&nbsp; This adds an implicit <span class=
      "Annot"><span style='font-size:10.0pt'>abstract</span></span>
      annotation to any <span class="CodeText"><span style=
      'font-size:10.0pt'>typedef</span></span> that is not marked
      with <span class="Annot"><span style=
      'font-size:10.0pt'>/*@concrete@*/</span></span>.</p>
<p class="TextFontCX">&nbsp;</p>
<center>
<table class="MsoNormalTable" border="0" cellspacing="0"
cellpadding="0" style=
'width:418.5pt;margin-left:.9pt;border-collapse:collapse; margin-left:-2.25pt;margin-right:-2.25pt'>
<tr style='height:13.45pt'>
<td valign="top" style=
'width:211.5pt;border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt;height:13.45pt'>
<p class="TextFontCX" align="center" style='text-align:center'>
<span class="Keyword"><b><span style=
'font-size:10.0pt; color:white'>palindrome.c</span></b></span></p></td>
<td valign="top" style=
'width:207.0pt;border-top:solid black 1.5pt; border-left:none;border-bottom:none;border-right:solid black 1.5pt; background:black;padding:0in 5.4pt 0in 5.4pt;height:13.45pt'>
<p class="TextFontCX" align="center" style='text-align:center'>
<b><span style='color:white'>Running
Splint</span></b></p></td></tr>
<tr style='height:196.2pt'>
<td valign="top" style=
'width:211.5pt;border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt;height:196.2pt'>
<p class="Verbatim"><span style='font-size:9.0pt'># include
"bool.h"</span></p>
<p class="Verbatim"><span style='font-size:9.0pt'># include
"mstring.h"</span></p>
<p class="Verbatim"><span style='font-size:9.0pt'>&nbsp;</span></p>
<p class="Verbatim"><span style='font-size:9.0pt'>bool isPalindrome
(mstring s)</span></p>
<p class="Verbatim"><span style='font-size:9.0pt'>{</span></p>
<p class="Verbatim"><span class="Line"><span style=
'font-size:8.0pt'>&nbsp;6</span></span> <span style=
'font-size:9.0pt'>char *current = (char *) s;</span></p>
<p class="Verbatim"><span class="Line"><span style=
'font-size:8.0pt'>&nbsp;7</span></span> <span style=
'font-size:9.0pt'>int i, len = (int) strlen (s);</span></p>
<p class="Verbatim"><span style='font-size:9.0pt'>&nbsp;</span></p>
<p class="Verbatim"><span style='font-size:9.0pt'>&nbsp; for (i =
0; i &lt;= (len+1) / 2; i++)</span></p>
<p class="Verbatim"><span style=
'font-size:9.0pt'>&nbsp;&nbsp;&nbsp; {</span></p>
<p class="Verbatim"><span class="Line"><span style=
'font-size:8.0pt'>11</span></span><span style=
'font-size:9.0pt'>&nbsp;&nbsp;&nbsp; if (current[i] !=
s[len-i-1])</span></p>
<p class="Verbatim"><span style=
'font-size:9.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; return
FALSE;</span></p>
<p class="Verbatim"><span style=
'font-size:9.0pt'>&nbsp;&nbsp;&nbsp; }</span></p>
<p class="Verbatim"><span style='font-size:9.0pt'>&nbsp; return
TRUE;</span></p>
<p class="Verbatim"><span style='font-size:9.0pt'>}</span></p>
<p class="Verbatim"><span style='font-size:9.0pt'>&nbsp;</span></p>
<p class="Verbatim"><span style='font-size:9.0pt'>bool callPal
(void)</span></p>
<p class="Verbatim"><span style='font-size:9.0pt'>{</span></p>
<p class="Verbatim"><span class="Line"><span style=
'font-size:8.0pt'>19</span></span><i><span style=
'font-size:9.0pt;font-family:Arial'>&nbsp;</span></i>
      <span style='font-size:9.0pt'>return (isPalindrome
      ("bob"));</span></p>
<p class="Verbatim"><span style='font-size:9.0pt'>}</span></p></td>
<td valign="top" style=
'width:207.0pt;border-top:none;border-left: none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt;height:196.2pt'>
<p class="lclintrun">&gt; splint palindrome.c</p>
<p class="lclintrun">&nbsp;</p>
<p class="lclintrun">palindrome.c:6: Cast from underlying</p>
<p class="lclintrun">&nbsp;&nbsp;&nbsp; abstract type mstring:
(char *)s</p>
<p class="lclintrun">palindrome.c:7: Function strlen expects
arg</p>
<p class="lclintrun">&nbsp;&nbsp;&nbsp; 1 to be char * gets
mstring: s</p>
<p class="lclintrun">palindrome.c:11: Array fetch from
non-array</p>
<p class="lclintrun">&nbsp;&nbsp;&nbsp; (mstring): s[len - i -
1]</p>
<p class="lclintrun">palindrome.c:19: Function isPalindrome</p>
<p class="lclintrun">&nbsp;&nbsp;&nbsp; expects arg 1 to be mstring
gets char *:</p>
<p class="lclintrun">&nbsp;&nbsp;&nbsp; "bob"</p>
<p class="TextFontCX">&nbsp;</p>
<p class="lclintrun">Finished checking --- 4 code warnings</p>
<p class="TextFontCX"><span style=
'font-size: 9.0pt;font-family:Times'>&nbsp;</span></p></td></tr></table>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
<tr>
<td valign="top" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="MsoCaption"><a name="_Toc534824609"></a><a name=
"_Toc347255385"></a><a name="_Ref344908730"></a><a name=
"_Ref344908735">Figure 5</a>.&nbsp; Information Hiding
Violations</p></td></tr></table></center>
<p align="right"><i><span style=
'font-size:9.0pt'>&nbsp;Traditionally, programming books wax
mathematical when they arrive at the topic of abstract data
types&#8230;<br>
Such books make it seem as if you&#8217;d never actually use an
abstract data type except as a sleep aid.</span></i></p>
 
<p class="TextFontCX" align="right" style='text-align:right'>
<i><span style=
'font-size:9.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></i>
<span style='font-size:9.0pt'>&nbsp;&nbsp;&nbsp;Steve
McConnell</span></p>
<p class="TextFontCX"><i>&nbsp;</i></p>
<h3 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974954"></a><a name="_Ref344892422"></a><a name=
"_Ref344870884"></a><a name="_Toc344355398">4.3.1<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Controlling Access</a></h3>
<p class="TextFontCX">Where code may manipulate the representation
of an abstract type, we say the code has <i>access</i> to that
type.&nbsp; If code has access to an abstract type, the
representation of the type and the abstract type are
indistinguishable.&nbsp; Usually, a single program module that is
the only code that has access to the type representation implements
an abstract type.&nbsp; Sometimes, more complicated access control
is desired if the implementation of an abstract type is split
across program files, or particular client code needs to access the
representation.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="beforelist">There are a several ways of selecting what
code has access the representation of an abstract type:</p>
<p class="TextFontCX" style=
'margin-left:12.95pt; text-indent:-12.95pt'><span style=
'font-family:Symbol'>&#183;<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
Modules.&nbsp; An abstract type defined in <i><span style=
'font-size: 10.0pt;font-family:Arial'>M</span></i><span class="Keyword">
<span style=
'font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>
is accessible in <i><span style=
'font-size:10.0pt;font-family:Arial'>M</span></i><span class=
"Keyword"><span style=
'font-size:10.0pt;font-family:Arial;color:windowtext'>.c</span></span>.&nbsp;
Controlled by the <span class="Flag"><span style=
'font-size:10.0pt'>accessmodule</span></span> flag.&nbsp; This
means when <span class="Flag"><span style=
'font-size:10.0pt'>accessmodule</span></span> is on, as it is by
default, the module access rule is in effect.&nbsp; If
      <span class="Flag"><span style=
      'font-size:10.0pt'>accessmodule</span></span> is off (when
      <span class="Flag"><span style=
      'font-size:10.0pt'>-access-module</span></span> is used), the
      module access rule is not in effect and an abstract type
      defined in <i><span style=
      'font-size:10.0pt;font-family:Arial'>M</span></i><span class=
      "Keyword"><span style=
      'font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>
      is not necessarily accessible in <i><span style=
      'font-size:10.0pt;font-family: Arial'>M</span></i><span class="Keyword">
<span style=
'font-size:10.0pt; font-family:Arial;color:windowtext'>.c</span></span>.</p>
<p class="TextFontCX" style=
'margin-left:12.95pt; text-indent:-12.95pt'><span style=
'font-family:Symbol'>&#183;<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
File names.&nbsp; An abstract type named <span class=
"CodeText"><i><span style='font-size:10.0pt'>type</span></i></span>
is accessible in files named <span class=
      "CodeText"><i><span style='font-size:10.0pt'>type.&lt;extension&gt;</span></i></span>.&nbsp;
      For example, the representation of <span class=
      "CodeText"><span style=
      'font-size: 10.0pt'>mstring</span></span> is accessible in
      <span class="CodeText"><span style=
      'font-size:10.0pt'>mstring.h</span></span> and <span class=
      "CodeText"><span style=
      'font-size:10.0pt'>mstring.c</span></span>.&nbsp; Controlled
      by the <span class="Flag"><span style=
      'font-size:10.0pt'>access-file</span></span>&nbsp;flag.</p>
<p class="MsoListBullet"><span style=
'font-family:Symbol'>&#183;<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
Function names.&nbsp; An abstract type named <span class=
"CodeText"><i><span style=
'font-size: 10.0pt'>type</span></i></span> may be accessible in a
function named <span class="CodeText"><i><span style=
'font-size:10.0pt'>type_name</span></i></span> or
      <span class="CodeText"><i><span style=
      'font-size:10.0pt'>typeName</span></i></span>.&nbsp; For
      example, <span class="CodeText"><span style=
      'font-size:10.0pt'>mstring_length</span></span> and
      <span class="CodeText"><span style=
      'font-size:10.0pt'>mstringLength</span></span> would have
      access to the <span class="CodeText"><span style=
      'font-size:10.0pt'>mstring</span></span> abstract type.&nbsp;
      Controlled by <span class="Flag"><span style=
      'font-size:10.0pt'>accessfunction</span></span>&nbsp;and the
      naming convention&nbsp;(see Section 12).</p>
<p class="TextFontCX" style=
'margin-left:12.95pt; text-indent:-12.95pt'><span style=
'font-family:Symbol'>&#183;<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
Access control comments. The syntax <span class=
      "Annot"><span style='font-size:10.0pt'>/*@access
      <i>type</i>,<sup>+</sup>@*/</span></span><a href="#_ftn2"
      name="_ftnref2" title=""><span class=
      "MsoFootnoteReference"><span class=
      "MsoFootnoteReference"><span style=
      'font-size:11.0pt;font-family:"Times New Roman"'>[2]</span></span></span></a>
      allows the following code to access the representation of
      <span class="CodeText"><i><span style=
      'font-size:10.0pt'>type</span></i></span>.&nbsp; Similarly,
      <span class="Annot"><span style=
      'font-size:10.0pt'>/*@noaccess</span></span> <span class=
      "Annot"><span style=
      'font-size:10.0pt'><i>type</i>,<sup>+</sup>@*/</span></span>
      restricts access to the representation of <span class=
      "CodeText"><i><span style=
      'font-size: 10.0pt'>type</span></i></span>.&nbsp; The type in
      a <span class="Annot"><span style=
      'font-size:10.0pt'>noaccess</span></span> comment must have
      been declared as an abstract type.</p>
<h3 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974955"></a><a name="_Toc344355399"></a><a name=
"_Ref343240525"></a><a name="_Ref343240518">4.3.2<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Mutability</a></h3>
<p class="TextFontCX">We can view types as being <i>mutable</i> or
<i>immutable</i>.&nbsp; A type is mutable if passing it as a
parameter to a function call can change the value of an instance of
the type.&nbsp; For example, the primitive type <span class=
"CodeText"><span style='font-size:10.0pt'>int</span></span> is
immutable.&nbsp; If <span class="CodeText"><span style=
'font-size:10.0pt'>i</span></span> is a local variable of type
<span class="CodeText"><span style=
'font-size:10.0pt'>int</span></span> and no variables point to the
location where <span class="CodeText"><span style=
'font-size:10.0pt'>i</span></span> is stored, the value of
<span class="CodeText"><span style=
'font-size:10.0pt'>i</span></span> must be the same before and
after the call <span class="CodeText"><span style=
'font-size:10.0pt'>f (i)</span></span>.&nbsp; Structure and union
types are also immutable, since they are copied when they are
passed as arguments.&nbsp; On the other hand, pointer types are
mutable.&nbsp; If <span class="CodeText"><span style=
'font-size:10.0pt'>x</span></span> is a local variable of type
<span class="CodeText"><span style='font-size:10.0pt'>int
*</span></span>, the value of <span class=
      "CodeText"><span style='font-size:10.0pt'>*x</span></span>
      (and hence, the value of the object <span class=
      "CodeText"><span style='font-size:10.0pt'>x</span></span>)
      can be changed by the function call <span class=
      "CodeText"><span style=
      'font-size:10.0pt'>g(x)</span></span>.&nbsp;</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">The mutability of a concrete type is
determined by its type definition. For abstract types, mutability
does not depend on the type representation but on what operations
the type provides. If an abstract type has operations that may
change the value of instances of the type, the type is
mutable.&nbsp; If not, it is immutable.&nbsp; The value of an
instance of an immutable type never changes.&nbsp; Since object
sharing is noticeable only for mutable types, they are checked
differently from immutable types.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="beforelist">The <span class="Annot"><span style=
'font-size:10.0pt'>/*@mutable@*/</span></span> and
      <span class="Annot"><span style=
      'font-size:10.0pt'>/*@immutable@*/</span></span> annotations
      are used to declare an abstract type as mutable or
      immutable.&nbsp; (If neither is used, the abstract type is
      assumed to be mutable.)&nbsp; For example,</p>
<p class="Verbatim">&nbsp;&nbsp; typedef /*@abstract@*/
/*@mutable@*/ char *mstring;</p>
<p class="Verbatim">&nbsp;&nbsp; typedef /*@abstract@*/
/*@immutable@*/ int weekDay;</p>
<p class="afterlist">declares <span class=
      "CodeText"><span style='font-size:10.0pt'>mstring</span></span>
      as a mutable abstract type and <span class=
      "CodeText"><span style=
      'font-size: 10.0pt'>weekDay</span></span> as an immutable
      abstract type.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Clients of a mutable abstract type need to
know the semantics of assignment.&nbsp; After the assignment
expression <span class="CodeText"><span style='font-size:10.0pt'>s
= t</span></span>, do <span class="CodeText"><span style=
'font-size:10.0pt'>s</span></span> and <span class=
"CodeText"><span style='font-size:10.0pt'>t</span></span> refer to
the same object (that is, will changes to the value of
      <span class="CodeText"><span style=
      'font-size:10.0pt'>s</span></span> also change the value of
      <span class="CodeText"><span style=
      'font-size:10.0pt'>t</span></span>).</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Splint prescribes that all abstract types
have sharing semantics, so <span class=
      "CodeText"><span style='font-size:10.0pt'>s</span></span> and
      <span class="CodeText"><span style=
      'font-size:10.0pt'>t</span></span> would indeed be the same
      object.&nbsp; Splint will produce a warning if a mutable type
      is implemented with a representation (e.g., a <span class=
      "CodeText"><span style=
      'font-size:10.0pt'>struct</span></span>) that does not
      provide sharing semantics (controlled by <span class=
      "Flag"><span style=
      'font-size:10.0pt'>mutrep</span></span>&nbsp;flag).&nbsp;</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">The mutability of an abstract type is not
necessarily the same as the mutability of its representation. We
could use the immutable concrete type <span class=
"CodeText"><span style='font-size:10.0pt'>int</span></span> to
represent mutable strings using an index into a string table, or
declare <span class="CodeText"><span style=
'font-size:10.0pt'>mstring</span></span> as immutable as long as no
operations are provided that modify the value of an
      <span class="CodeText"><span style=
      'font-size:10.0pt'>mstring</span></span>.</p>

      
<h2 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974956"></a><a name="_Toc344355422"></a><a name=
"_Ref343109614">4.3.3<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Semi-Abstract Types</a></h2>
<p class="TextFontCX">
Sometimes it is useful to have a type that is abstract in some ways, but can be used with the standard numerical operators.  Splint supports numabstract types for this purpose.  The <span class="CodeText"><span style='font-size:10.0pt'>/*@numabstract@*/</span></span> annotation denotes a numabstract type.  Splint will report warnings when numabstract types are used inconsistently, but allow binary numeric operators to operate on two values of the same numabstract type.

Several flags control the strictness of type checking for numabstract types:
<span class="flag"><span style=
      'font-size:10.0pt'>numabstract, numabstractcast, numabstractlit,  numabstractindex,
</span></span>
 and
<span class="flag"><span style=
      'font-size:10.0pt'> numabstractprint
</span></span>.
</p>


<h2 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974956"></a><a name="_Toc344355422"></a><a name=
"_Ref343109614">4.4<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Polymorphism</a></h2>
<p class="TextFontCX">In C, all declarators must be declared to
have exactly one type.&nbsp; This makes it impossible to write
functions that operate on more than one type of parameter &#8211;
for example, we cannot use the same square function for
      <span class="CodeText"><span style=
      'font-size:10.0pt'>int</span></span>s and <span class=
      "CodeText"><span style=
      'font-size:10.0pt'>float</span></span>s.&nbsp; Because of the
      stricter type checking made possible by Splint, it is often
      useful to declare a parameter that has more than one possible
      type.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Splint provides alternate types to indicate
that a declaration may be one of several possible types.&nbsp; The
<span class="Annot"><span style='font-size:10.0pt'>/*@alt
<i>type</i>,<sup>+</sup>@*/</span></span> annotation creates a
union type.&nbsp; For example, <span class=
      "CodeText"><span style='font-size:10.0pt'>int</span></span>
      <a href="mailto:/*@alt"><span class="Annot"><span style=
      'font-size:10.0pt'>/*@alt</span></span></a><span class=
      "Annot"><span style='font-size:10.0pt'>char,
      unsigned</span></span> <a href="mailto:char@*/"><span class=
      "Annot"><span style=
      'font-size:10.0pt'>char@*/</span></span></a><span class=
      "CodeText"><span style='font-size:10.0pt'>c</span></span>
      declares <span class="CodeText"><span style=
      'font-size:10.0pt'>c</span></span> such that either an
      <span class="CodeText"><span style=
      'font-size:10.0pt'>int</span></span>, <span class=
      "CodeText"><span style='font-size:10.0pt'>char</span></span>
      or <span class="CodeText"><span style=
      'font-size:10.0pt'>unsigned char</span></span> value may be
      assigned to it without warning.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">One use of alternate types is to specify the
type of a macro that operates on multiple types of operands (see
Section 11.2.1).&nbsp; Alternate types are also useful for
declaring functions for which the return value may be safely
ignored (see Section 8.4.2).&nbsp; A function can be declared to
return <span class="CodeText"><i><span style=
'font-size:10.0pt'>t</span></i></span> <a href=
"mailto:/*@alt"><span class="Annot"><span style=
'font-size:10.0pt'>/*@alt</span></span></a><a href=
"mailto:void@*/"><span class="Annot"><span style=
'font-size:10.0pt'>void@*/</span></span></a> to indicate that it
returns a value of type <span class=
      "CodeText"><i><span style='font-size:10.0pt'>t</span></i></span>,
      but there should be not warning if that value is ignored.</p>
<h1 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974957"></a><a name="_Ref534008388">5<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
<a id="memory" name="memory">
Memory Management</a>
</a></h1>
<p class="TextFontCX">About half the bugs in typical C programs can
be attributed to memory management problems.&nbsp; Memory
management bugs are notoriously difficult to detect through
traditional techniques.&nbsp; Often, the symptom of the bug is far
removed from its actual source.&nbsp; Memory management bugs often
only appear sporadically and some bugs may only be apparent when
compiler optimizations are turned on or the code is compiled on a
different platform.&nbsp; Run-time tools offer some help, but are
cumbersome to use and limited to detecting errors that occur when
test cases are run.&nbsp; By detecting these errors statically, we
can be confident that certain types of errors will never occur and
provide verified documentation on the memory management behavior of
a program.&nbsp;</p>
<p class="TextFontCX">&nbsp;</p>
<p class="beforelist">Splint can detect many memory management
errors at compile time including using storage that may have been
deallocated (Section 5.2), memory leaks&nbsp;(Section 5.2), or
returning a pointer to stack-allocated storage&nbsp;(Section
5.2.6).</p>
<p align="right"><i><span style='font-size:9.0pt'>Yea, from the
table of my memory I'll wipe away all trivial fond records, all
saws of books,<br>
all forms, all pressures past, that youth and observation copied
there.</span></i><br>
 <span style='font-size:9.0pt'>Hamlet prefers
garbage&nbsp;collection (Shakespeare, Hamlet. Act I, Scene
v)</span></p>
<p class="afterlist">Most of these checks depend on annotations
added to programs to document assumptions related to memory
management and pointer values.&nbsp; By documenting these
assumptions for function interfaces, variables, type definitions
and structure fields, memory management bugs can be detected at
their source &#8212; where an assumption is violated.&nbsp; In
addition, precise documentation about memory management decisions
makes it easier to change code.</p>
<h2 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974958"></a><a name="_Toc344355408">5.1<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Storage Model</a></h2>
<p class="TextFontCX">This section describes execution-time
concepts for describing the state of storage more precisely than
can be done using standard C terminology.&nbsp; Certain uses of
storage are likely to indicate program bugs, and are reported as
anomalies.<a href="#_ftn3" name="_ftnref3" title=
      ""><span class="MsoFootnoteReference"><b><span class=
      "MsoFootnoteReference"><b><span style=
      'font-size:11.0pt;font-family:"Times New Roman"'>[3]</span></b></span></b></span></a></p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Splint assumes a CLU-like object storage
model.<a href="#_ftn4" name="_ftnref4" title=""><span class=
"MsoFootnoteReference"><span class=
"MsoFootnoteReference"><span style=
'font-size:11.0pt;font-family:"Times New Roman"'>[4]</span></span></span></a>&nbsp;
An <i>object</i> is a typed region of storage.&nbsp; Some objects
use a fixed amount of storage that is allocated and deallocated
automatically by the compiler.&nbsp; Other objects use dynamic
storage that must be managed by the program.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Storage is <i>undefined</i> if it has not
been assigned a value, and <i>defined</i> after it has been
assigned a value.&nbsp; An object is <i>completely defined</i> if
all storage that may be reached from it is defined.&nbsp; What
storage is reachable from an object depends on the type and value
of the object.&nbsp; For example, if <span class=
"CodeText"><span style='font-size:10.0pt'>p</span></span> is a
pointer to a structure, <span class="CodeText"><span style=
'font-size:10.0pt'>p</span></span> is completely defined if the
value of <span class="CodeText"><span style=
'font-size:10.0pt'>p</span></span> is <span class=
"CodeText"><span style='font-size:10.0pt'>NULL</span></span>, or if
every field of the structure <span class=
      "CodeText"><span style='font-size:10.0pt'>p</span></span>
      points to is completely defined.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">When an expression is used as the left side
of an assignment expression we say it is <i>used as an
lvalue</i>.&nbsp; Its location in memory is used, but not its
value.&nbsp; Undefined storage may be used as an lvalue since only
its location is needed.&nbsp; When storage is used in any other
way, such as on the right side of an assignment, as an operand to a
primitive operator (including the indirection operator,
      <span class="CodeText"><span style=
      'font-size:10.0pt'>*</span></span>),<a href="#_ftn5" name=
      "_ftnref5" title=""><span class=
      "MsoFootnoteReference"><span class=
      "MsoFootnoteReference"><span style=
      'font-size:11.0pt;font-family:"Times New Roman"'>[5]</span></span></span></a>
      or as a function parameter, we say it is <i>used as an
      rvalue</i>.&nbsp; It is an anomaly to use undefined storage
      as an rvalue.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">A <i>pointer</i> is a typed memory
address.&nbsp; A pointer is either <i>live</i> or
<i>dead</i>.&nbsp; A live pointer is either <span class=
"CodeText"><span style='font-size:10.0pt'>NULL</span></span> or an
address within allocated storage.&nbsp; A pointer that points to an
object is an <i>object</i> pointer.&nbsp; A pointer that points
inside an object (e.g., to the third element of an allocated block)
is an <i>offset</i> pointer.&nbsp; A pointer that points to
allocated storage that is not defined is an <i>allocated</i>
pointer.&nbsp; The result of dereferencing an allocated pointer is
undefined storage.&nbsp; Hence, it is an anomaly to use it as an
rvalue.&nbsp; A dead (or &#8220;dangling&#8221;) pointer does not
point to allocated storage.&nbsp; A pointer becomes dead if the
storage it points to is deallocated (e.g., the pointer is passed to
the <span class="CodeText"><span style=
'font-size:10.0pt'>free</span></span> library function.)&nbsp; It
is an anomaly to use a dead pointer as an rvalue.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">There is a special object <i>null</i>
corresponding to the <span class="CodeText"><span style=
'font-size:10.0pt'>NULL</span></span>pointer in a C program.&nbsp;
A pointer that may have the value <span class=
"CodeText"><span style='font-size:10.0pt'>NULL</span></span> is a
<i>possibly-null</i> pointer.&nbsp; It is an anomaly to use a
possibly-null pointer where a non-null pointer is expected (e.g.,
certain function arguments or the indirection operator).</p>
<h2 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974959"></a><a name="_Ref347476065"></a><a name=
"_Ref347469133"></a><a name="_Ref347465595"></a><a name=
"_Ref344893840"></a><a name="_Toc344355409">5.2<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Deallocation Errors</a></h2>
<p class="TextFontCX">There are two kinds of deallocation errors
with which we are concerned:&nbsp; deallocating storage when there
are other live references to the same storage, or failing to
deallocate storage before the last reference to it is lost.&nbsp;
To handle these deallocation errors, we introduce a concept of an
obligation to release storage.&nbsp; Every time storage is
allocated, it creates an obligation to release the storage.&nbsp;
This obligation is attached to the reference to which the storage
is assigned.<a href="#_ftn6" name="_ftnref6" title=
      ""><span class="MsoFootnoteReference"><span class=
      "MsoFootnoteReference"><span style=
      'font-size:11.0pt;font-family:"Times New Roman"'>[6]</span></span></span></a>&nbsp;
      Before the scope of the reference is exited or it is assigned
      to a new value, the storage to which it points must be
      released.&nbsp; Annotations&nbsp;can be used to indicate that
      this obligation is transferred through a return value,
      function parameter or assignment to an external
      reference.</p>
<p align="right"><i><span style='font-size:9.0pt'>&#8216;Tis in my
memory lock&#8217;d, and you yourself shall keep the key of
it.</span></i><br>
<span style='font-size:9.0pt'>Ophelia prefers&nbsp;explicit
deallocation (Hamlet. Act I, Scene iii)</span></p>
<h3 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974960">5.2.1<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Unshared References</a></h3>
<p class="TextFontCX">The <span class="Annot"><span style=
'font-size:10.0pt'>only</span></span> annotation is used to
indicate a reference is the only pointer to the object it points
to.&nbsp; We can view the reference as having an obligation to
release this storage.&nbsp; This obligation is satisfied by
transferring it to some other reference in one of three ways:</p>
<p class="MsoListBullet"><span style=
'font-family:Symbol'>&#183;<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
pass it as an actual parameter corresponding to a formal parameter
declared with an <span class="Annot"><span style=
'font-size:10.0pt'>only</span></span>
annotation&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</p>
<p class="MsoListBullet"><span style=
'font-family:Symbol'>&#183;<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
assign it to an external reference declared with an
      <span class="Annot"><span style=
      'font-size:10.0pt'>only</span></span> annotation</p>
<p class="MsoListBullet"><span style=
'font-family:Symbol'>&#183;<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
return it as a result declared with an <span class=
"Annot"><span style='font-size:10.0pt'>only</span></span>
annotation</p>
<p class="afterlist">After the release obligation is transferred,
the original reference is a dead pointer and the storage it points
to may not be used.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">All obligations to release storage stem from
primitive allocation routines (e.g., <span class=
"CodeText"><span style='font-size:10.0pt'>malloc</span></span>),
and are ultimately satisfied by calls to <span class=
"CodeText"><span style='font-size:10.0pt'>free</span></span>.&nbsp;
The standard library declared the primitive allocation and
deallocation routines.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">The basic memory allocator,
      <span class="CodeText"><span style=
      'font-size:10.0pt'>malloc</span></span>, is declared:</p>
<p class="example"><a href="mailto:/*@only@*/">/*@only@*/</a>
/*@null@*/ void *malloc (size_t size);</p>
<p class="TextFontCX">It returns an object that is referenced only
by the function return value.&nbsp;</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">The deallocator, <span class=
"CodeText"><span style='font-size:10.0pt'>free</span></span>, is
declared:<a href="#_ftn7" name="_ftnref7" title=
      ""><span class="MsoFootnoteReference"><span class=
      "MsoFootnoteReference"><span style=
      'font-size:11.0pt;font-family:"Times New Roman"'>[7]</span></span></span></a></p>
<p class="example">void free (/*@only@*/ <a href=
"mailto:/*@out@*/">/*@out@*/</a> <a href=
"mailto:/*@null@*/">/*@null@*/</a> void *ptr);</p>
<center>
<table class="MsoNormalTable" border="0" cellspacing="0"
cellpadding="0" style=
'margin-left:5.4pt;border-collapse:collapse;margin-left:-2.25pt; margin-right:-2.25pt'>
<tr>
<td valign="top" style=
'width:193.5pt;border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX" align="center" style='text-align:center'>
<a name="_Ref344990094"><span class="Keyword"><b><span style=
'font-size:10.0pt;color:white'>only.c</span></b></span></a></p></td>
<td valign="top" style=
'width:225.0pt;border-top:solid black 1.5pt; border-left:none;border-bottom:none;border-right:solid black 1.5pt; background:black;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX" align="center" style='text-align:center'>
<b><span style='color:white'>Running
Splint</span></b></p></td></tr>
<tr>
<td valign="top" style=
'width:193.5pt;border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt'>
<p class="Verbatim"><i><span style=
'font-size:8.0pt;font-family:Arial'>1&nbsp;</span></i>
      <span style='font-size:9.5pt'>extern /*@only@*/ int
      *glob;</span></p>
<p class="Verbatim"><span style='font-size:9.5pt'>&nbsp;</span></p>
<p class="Verbatim"><span style='font-size:9.5pt'>/*@only@*/ int
*</span></p>
<p class="Verbatim"><span style='font-size:9.5pt'>f (/*@only@*/ int
*x, int *y,</span></p>
<p class="Verbatim"><span style='font-size:9.5pt'>&nbsp;&nbsp; int
*z)</span></p>
<p class="Verbatim"><span style='font-size:9.5pt'>&nbsp; /*@globals
glob;@*/</span></p>
<p class="Verbatim"><span style='font-size:9.5pt'>{</span></p>
<p class="Verbatim"><i><span style=
'font-size:8.0pt;font-family:Arial'>&nbsp;8</span></i>
      <span style='font-size:9.5pt'>int *m = (int *)</span></p>
<p class="Verbatim"><i><span style=
'font-size:8.0pt;font-family:Arial'>&nbsp;9</span></i><span style='font-size:9.5pt'>
&nbsp;&nbsp;&nbsp; malloc (sizeof (int));</span></p>
<p class="Verbatim"><span style='font-size:9.5pt'>&nbsp;</span></p>
<p class="Verbatim"><i><span style=
'font-size:8.0pt;font-family:Arial'>11</span></i>
      <span style='font-size:9.5pt'>glob =
      y;&nbsp;&nbsp;&nbsp;</span> <i><span style=
      'font-size:9.5pt; font-family:"Times New Roman"'>Memory
      leak</span></i></p>
<p class="Verbatim"><i><span style=
'font-size:8.0pt;font-family:Arial'>12</span></i>
      <span style='font-size:9.5pt'>free (x);</span></p>
<p class="Verbatim"><i><span style=
'font-size:8.0pt;font-family:Arial'>13</span></i>
      <span style='font-size:9.5pt'>*m =
      *x;&nbsp;&nbsp;&nbsp;&nbsp;</span> <i><span style=
      'font-size:9.5pt; font-family:"Times New Roman"'>Use after
      free</span></i></p>
<p class="Verbatim"><i><span style=
'font-size:8.0pt;font-family:Arial'>14</span></i>
      <span style='font-size:9.5pt'>return
      z;&nbsp;&nbsp;&nbsp;</span> <i><span style=
      'font-size:9.5pt; font-family:"Times New Roman"'>Memory leak
      detected</span></i><i><span style=
      'font-size:9.5pt;font-family:Arial'>&nbsp;</span></i></p>
<p class="TextFontCX"><span style=
'font-size: 9.5pt'>}</span></p></td>
<td valign="top" style=
'width:225.0pt;border-top:none;border-left: none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
<p class="lclintrun">&gt; splint only.c</p>
<p class="lclintrun">only.c:11: Only storage glob (type int *) not
released</p>
<p class="lclintrun">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
before assignment: glob = y</p>
<p class="lclintrun">&nbsp;&nbsp; only.c:1: Storage glob becomes
only</p>
<p class="lclintrun">only.c:11: Implicitly temp storage y assigned
to only:</p>
<p class="lclintrun">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
glob = y</p>
<p class="lclintrun">only.c:13: Dereference of possibly null
pointer m: *m</p>
<p class="lclintrun">&nbsp;&nbsp; only.c:8: Storage m may become
null</p>
<p class="lclintrun">only.c:13: Variable x used after being
released</p>
<p class="lclintrun">&nbsp;&nbsp; only.c:12: Storage x released</p>
<p class="lclintrun">only.c:14: Implicitly temp storage z returned
as only: z</p>
<p class="lclintrun">only.c:14: Fresh storage m not released before
return</p>
<p class="lclintrun" style='page-break-after:avoid'>&nbsp;&nbsp;
only.c:9: Fresh storage m
allocated&nbsp;&nbsp;</p></td></tr></table>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
<tr>
<td valign="top" align="left" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="MsoCaption"><a name="_Toc534824610">Figure 6.&nbsp;
Memory Management</a></p></td></tr></table>
<p class="TextFontCX">The parameter to <span class=
"CodeText"><span style='font-size:10.0pt'>free</span></span> must
reference an unshared object.&nbsp; Since the parameter is declared
using <span class="Annot"><span style=
'font-size:10.0pt'>only</span></span>, the caller may not use the
referenced object after the call, and may not pass in a reference
to a shared object.&nbsp; There is nothing special about
<span class="CodeText"><span style=
'font-size:10.0pt'>malloc</span></span> and <span class=
"CodeText"><span style='font-size:10.0pt'>free</span></span>
&#8212; their behavior can be described entirely in terms of the
provided annotations.</p>
<h3 style='margin-left:0in;text-indent:0in'><a name=
"_Ref347468963"></a><a name="_Toc534974961"></a><a name=
"_Ref347469360">5.2.2<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Temporary Parameters</a></h3>
<p class="TextFontCX">The <span class="Annot"><span style=
'font-size:10.0pt'>temp</span></span>&nbsp;annotation is used to
declare a function parameter that is used temporarily by the
function.&nbsp; An error is reported if the function releases the
storage associated with a <span class="Annot"><span style=
'font-size:10.0pt'>temp</span></span> formal parameter or creates
new aliases to it that are visible after the function
returns.&nbsp; Any storage may be passed as a <span class=
"Annot"><span style='font-size:10.0pt'>temp</span></span>
parameter, and it satisfies its original memory constraints after
the function returns.</p>
<h3 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974962">5.2.3<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Owned and Dependent References</a></h3>
<p class="TextFontCX">In real programs it is sometimes necessary to
have storage that is shared between several possibly
references.&nbsp; The <span class="Annot"><span style=
'font-size:10.0pt'>owned</span></span> and <span class=
"Annot"><span style='font-size:10.0pt'>dependent</span></span>
annotations provide a more flexible way of managing storage, at the
cost of less checking.&nbsp; The <span class=
      "Annot"><span style='font-size:10.0pt'>owned</span></span>
      annotation denotes a reference with an obligation to release
      storage.&nbsp; Unlike <span class="Annot"><span style=
      'font-size:10.0pt'>only</span></span>, however, other
      external references marked with <span class=
      "Annot"><span style=
      'font-size:10.0pt'>dependent</span></span> annotations may
      share this object.&nbsp; It is up to the programmer to ensure
      that the lifetime of a <span class="Annot"><span style=
      'font-size:10.0pt'>dependent</span></span> reference is
      contained within the lifetime of the corresponding
      <span class="Annot"><span style=
      'font-size:10.0pt'>owned</span></span> reference.</p>
<h3 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974963"></a><a name="_Ref347805800">5.2.4<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Keep Parameters</a></h3>
<p class="TextFontCX">The <span class="Annot"><span style=
'font-size:10.0pt'>keep</span></span> annotation is similar to
<span class="Annot"><span style=
'font-size:10.0pt'>only</span></span>, except the caller may use
the reference after the call.&nbsp; The called function must assign
the <span class="Annot"><span style=
'font-size:10.0pt'>keep</span></span> parameter to an
      <span class="Annot"><span style=
      'font-size:10.0pt'>only</span></span> reference, or pass it
      as a <span class="Annot"><span style=
      'font-size:10.0pt'>keep</span></span> parameter to another
      function.&nbsp; It is up to the programmer to make sure that
      the calling function does not use this reference after it is
      released.&nbsp; The <span class="Annot"><span style=
      'font-size:10.0pt'>keep</span></span> annotation is useful
      for adding an object to a collection (e.g., a symbol table),
      where it is known that it will not be deallocated until the
      collection is.</p>
<h3 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974964"></a><a name="_Ref347469304">5.2.5<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Shared References</a></h3>
<p class="TextFontCX">If Splint is used to check a program designed
to be used in a garbage-collected environment, there may be storage
that is shared by one or more references and never explicitly
released.&nbsp; The <span class="Annot"><span style=
'font-size:10.0pt'>shared</span></span> annotation declares storage
that may be shared arbitrarily, but never released.</p>
<h3 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974965"></a><a name="_Ref348341639">5.2.6<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Stack References</a></h3>
<p class="TextFontCX">Local variables that are not allocated
dynamically are stored on a call stack. &nbsp;When a function
returns, its stack frame is deallocated, destroying the storage
associated with the function&#8217;s local variables.&nbsp; A
memory error occurs if a pointer into this storage is live after
the function returns.&nbsp; Splint detects errors involving stack
references exported from a function through return values or
assignments to references reachable from global variables or actual
parameters.&nbsp; No annotations are needed to detect stack
reference errors, since it is clear from a declaration if storage
is allocated on the function stack.&nbsp; Figure 7 gives and
example of errors reported involving stack-allocated storage.</p>
<center>
<table class="MsoNormalTable" border="0" cellspacing="0"
cellpadding="0" style=
'margin-left:5.4pt;border-collapse:collapse;margin-left:-2.25pt; margin-right:-2.25pt'>
<tr>
<td valign="top" style=
'width:2.25in;border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX" align="center" style='text-align:center'>
<span class="Keyword"><b><span style=
'font-size:10.0pt; color:white'>stack.c</span></b></span></p></td>
<td valign="top" style=
'width:256.5pt;border-top:solid black 1.5pt; border-left:none;border-bottom:none;border-right:solid black 1.5pt; background:black;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX" align="center" style='text-align:center'>
<b><span style='color:white'>Running
Splint</span></b></p></td></tr>
<tr>
<td valign="top" style=
'width:2.25in;border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt'>
<p class="Verbatim">int *glob;</p>
<p class="Verbatim">&nbsp;</p>
<p class="Verbatim">/*@dependent@*/ int *</p>
<p class="Verbatim">&nbsp; f (int **x)</p>
<p class="Verbatim">{</p>
<p class="Verbatim">&nbsp; int sa[2] = { 0, 1 };</p>
<p class="Verbatim">&nbsp; int loc = 3;</p>
<p class="Verbatim">&nbsp;</p>
<p class="Verbatim"><span class="Line"><span style=
'font-size:8.0pt'>&nbsp;9</span></span> glob = &amp;loc;</p>
<p class="Verbatim"><span class="Line"><span style=
'font-size:8.0pt'>10</span></span> *x = &amp;sa[0];</p>
<p class="Verbatim">&nbsp;</p>
<p class="Verbatim"><span class="Line"><span style=
'font-size:8.0pt'>12</span></span> return &amp;loc;</p>
<p class="Verbatim">}&nbsp;</p></td>
<td valign="top" style=
'width:256.5pt;border-top:none;border-left: none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
<p class="lclintrun">&gt; splint stack.c</p>
<p class="lclintrun">stack.c:12: Stack-allocated storage &amp;loc
reachable</p>
<p class="lclintrun">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
from return value: &amp;loc</p>
<p class="lclintrun">stack.c:12: Stack-allocated storage *x
reachable from</p>
<p class="lclintrun">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
parameter x</p>
<p class="lclintrun">&nbsp;&nbsp; stack.c:10: Storage *x becomes
stack</p>
<p class="lclintrun">stack.c:12: Stack-allocated storage glob
reachable</p>
<p class="lclintrun">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
from global glob</p>
<p class="lclintrun">&nbsp;&nbsp; stack.c:9: Storage glob becomes
stack</p>
<p class="lclintrun">&nbsp;</p>
<p class="TextFontCX" align="left" style=
'text-align:left;page-break-after:avoid'><i>A</i>
      <span class="Annot"><span style=
      'font-size:10.0pt'>dependent</span></span> <i>annotation is
      used on the return value.&nbsp; Without this, other warnings
      would be reported, since the result would have an
      implicit</i> <span class="Annot"><span style=
      'font-size: 10.0pt'>only</span></span>
      <i>annotation.</i></p></td></tr></table>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
<tr>
<td valign="top" style=
'padding-top:5.05pt;padding-right: 9.35pt;padding-bottom:5.05pt;padding-left:9.35pt'>
<p class="MsoCaption"><a name="_Toc534824611"></a><a name=
"_Ref534821941">Figure 7</a>.&nbsp; Stack-Allocated
Storage</p></td></tr></table></center>
<h3 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974966">5.2.7<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Inner Storage</a></h3>
<p class="TextFontCX">An annotation always applies to the outermost
level of storage.&nbsp; For example,</p>
<p class="example">/*@only@*/ int **x;</p>
<p class="beforelist">declares <span class=
      "CodeText"><span style='font-size:10.0pt'>x</span></span> as
      an unshared pointer to a pointer to an <span class=
      "CodeText"><span style=
      'font-size:10.0pt'>int</span></span>.&nbsp; The <span class=
      "Flag"><span style='font-size:10.0pt'>only</span></span>
      annotation applies to <span class="CodeText"><span style=
      'font-size:10.0pt'>x</span></span>, but not to <span class=
      "CodeText"><span style=
      'font-size:10.0pt'>*x</span></span>.&nbsp; To apply
      annotations to inner storage a type definition may be
      used:</p>
<p class="Verbatim">&nbsp; typedef /*@only@*/ int *oip;</p>
<p class="Verbatim">&nbsp; /*@only@*/ oip *x;</p>
<p class="afterlist">Now, x is an <span class=
      "Annot"><span style='font-size:10.0pt'>only</span></span>
      pointer to an <span class="Annot"><span style=
      'font-size:10.0pt'>oip</span></span>, which is an
      <span class="Annot"><span style=
      'font-size:10.0pt'>only</span></span> pointer to an
      <span class="Annot"><span style=
      'font-size:10.0pt'>int</span></span>.</p>
<p class="afterlist">When annotations are used in type definitions,
they may be overridden in instance declarations.&nbsp; For
example,</p>
<p class="example">/*@dependent@*/ oip x;</p>
<p class="TextFontCX">makes <span class=
      "CodeText"><span style='font-size:10.0pt'>x</span></span> a
      <span class="Annot"><span style=
      'font-size:10.0pt'>dependent</span></span> pointer to an
      <span class="CodeText"><span style=
      'font-size:10.0pt'>int</span></span>.&nbsp; Another way to
      apply annotations to inner storage is to use a state clause
      (see Section 7.4).</p>
<h2 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974967"></a><a name="_Ref347812243"></a><a name=
"_Ref344893978"></a><a name="_Toc344355410">5.3<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Implicit Memory Annotations</a></h2>
<p class="TextFontCX">Since it is important that Splint can check
unannotated programs effectively, the meaning of declarations with
no memory annotations is chosen to minimize the number of
annotations needed to get useful checking on an unannotated
program.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">An implicit memory management annotation may
be assumed for declarations with no explicit memory management
annotation.&nbsp; Implicit annotations are checked identically to
the corresponding explicit annotation, except error messages
indicate that they result from an implicit annotation.&nbsp; Figure
8 illustrates some implicit annotations.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Unannotated function parameters are assumed
to be <span class="Annot"><span style=
'font-size:10.0pt'>temp</span></span>.&nbsp; This means if memory
checking is turned on for an unannotated program, all functions
that release storage referenced by a parameter or assign a global
variable to alias the storage will produce error messages.&nbsp;
(Controlled by <span class="Flag"><span style=
'font-size:10.0pt'>paramimptemp</span></span>.)</p>
<p class="TextFontCX">&nbsp;</p>
<center>
<table class="MsoNormalTable" border="0" cellspacing="0"
cellpadding="0" style=
'width:423.0pt;margin-left:.9pt;border-collapse:collapse; margin-left:-2.25pt;margin-right:-2.25pt'>
<tr style='page-break-inside:avoid'>
<td colspan="2" valign="top" style=
'width:423.0pt;border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX" align="center" style='text-align:center'>
<span class="Keyword"><b><span style=
'font-size:10.0pt; color:white'>implicit.c</span></b></span></p></td></tr>
<tr>
<td valign="top" style=
'width:207.0pt;border-top:none;border-left: solid black 1.5pt;border-bottom:solid black 1.5pt;border-right:none; padding:0in 5.4pt 0in 5.4pt'>
<p class="Verbatim">typedef struct {</p>
<p class="Verbatim">&nbsp;&nbsp; <span class=
"implicit"><b>only</b></span> char *name;</p>
<p class="Verbatim">&nbsp;&nbsp; int&nbsp;&nbsp; val;</p>
<p class="Verbatim">} *rec;</p>
<p class="Verbatim">&nbsp;</p>
<p class="Verbatim">extern <span class=
"implicit"><b>only</b></span> rec rec_last ;</p>
<p class="Verbatim">&nbsp;</p>
<p class="Verbatim">extern <span class=
"implicit"><b>only</b></span> rec</p>
<p class="Verbatim">&nbsp;&nbsp; rec_create (<span class=
"implicit"><b>temp</b></span> char *name,</p>
<p class="Verbatim">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
int val) ;</p>
<p class="TextFontCX"><i>Annotations in</i> <span class=
"Keyword"><b><i><span style=
'font-size:10.0pt;color:windowtext'>italics</span></i></b></span>
<i>are not present in the code, but may be implied depending on
flag settings.</i></p></td>
<td valign="top" style=
'width:3.0in;border-top:none;border-left:none; border-bottom:solid black 1.5pt;border-right:solid black 1.5pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX" align="left" style='text-align:left'>
<i>Implicit</i> <span class="Annot"><i><span style=
'font-size:10.0pt'>only</span></i></span> <i>annotation on mutable
structure field if</i> <span class="Flag"><span style=
'font-size:10.0pt'>structimponly</span></span> <i>is on.</i></p>
<p class="lclintrun"><i>&nbsp;</i></p>
<p class="TextFontCX" align="left" style='text-align:left'>
<i>Implicit</i> <span class="Annot"><span style=
'font-size:10.0pt'>only</span></span> <i>annotation on mutable
global variables if</i> <span class="Flag"><span style=
'font-size:10.0pt'>globimponly</span></span> <i>is on.</i></p>
<p class="TextFontCX" align="left" style='text-align:left'>
<i>&nbsp;</i></p>
<p class="TextFontCX" align="left" style=
'text-align:left;page-break-after:avoid'><i>Implicit</i>
<span class="Annot"><span style=
'font-size:10.0pt'>only</span></span> <i>annotation on mutable
function result if</i> <span class="Flag"><span style=
'font-size: 10.0pt'>retimponly</span></span> <i>is set.
Implicit</i> <span class="Annot"><span style=
'font-size:10.0pt'>temp</span></span> <i>annotation on mutable
parameter if</i> <span class="Flag"><span style=
'font-size:10.0pt'>paramimptemp</span></span> <i>is
set.</i></p></td></tr></table>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
<tr>
<td valign="top" align="left" style=
'padding-top:.1in;padding-right: 9.35pt;padding-bottom:.1in;padding-left:9.35pt'>
<p class="MsoCaption"><a name="_Toc534824612"></a><a name=
"_Ref534822006">Figure 8</a>.&nbsp; Implicit
Annotations</p></td></tr></table></center>
<p class="TextFontCX">Unannotated return values, structure fields
and global variables are assumed to be <span class=
"Annot"><span style='font-size:10.0pt'>only</span></span>.&nbsp;
With implicit annotations (on by default), turning on memory
checking for an unannotated program will produce errors for any
function that does not return unshared storage or assignment of
shared storage to a global variable or structure field.&nbsp; If an
exposure qualifier is used (see Section 6.2), the implied
<span class="Annot"><span style=
'font-size: 10.0pt'>dependent</span></span> annotation is used
instead of the more generally implied <span class=
"Annot"><span style='font-size:10.0pt'>only</span></span>
annotation.&nbsp; (Controlled by <span class=
      "Flag"><span style='font-size:10.0pt'>retimponly</span></span>,
      <span class="Flag"><span style=
      'font-size:10.0pt'>structimponly</span></span> and
      <span class="Flag"><span style=
      'font-size:10.0pt'>globimponly</span></span>.&nbsp; The
      <span class="Flag"><span style=
      'font-size:10.0pt'>allimponly</span></span>&nbsp;flag sets
      all of the implicit only flags.) &nbsp;&nbsp;</p>
<h2 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974968"></a><a name="_Ref534970957"></a><a name=
"_Ref347469058"></a><a name="_Ref344907383"></a><a name=
"_Toc344355411">5.4<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Reference Counting</a></h2>
<p class="TextFontCX">Another approach to memory management is to
add a field to a type to explicitly keep track of the number of
references to that storage.&nbsp; Every time a reference is added
or lost the reference count is adjusted accordingly; if it would
become zero, the storage is released.&nbsp; Reference counting it
difficult to do without automatic checking since it is easy to
forget to increment or decrement the reference count, and
exceedingly difficult to track down these errors.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Splint supports reference counting by using
annotations to constrain the use of reference counted storage in a
manner similar to other memory management annotations.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">A reference counted type is declared using
the <span class="Annot"><span style=
'font-size:10.0pt'>refcounted</span></span> annotation.&nbsp; Only
pointer to <span class="CodeText"><span style=
'font-size:10.0pt'>struct</span></span> types may be declared as
<span class="Annot"><span style=
'font-size:10.0pt'>refcounted</span></span>, since reference
counted storage must have a field to count the references.&nbsp;
One field in the structure (or integral type) is preceded by the
<span class="Annot"><span style=
'font-size:10.0pt'>refs</span></span> annotation to indicate that
the value of this field is the number of live references to the
structure. For example (in <span class="Keyword"><span style=
'font-size:10.0pt;font-family:Arial; color:windowtext'>rstring.h</span></span>),</p>
<p class="Verbatim" style='margin-top:6.0pt'>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; typedef /*@abstract@*/
/*@refcounted@*/ struct {</p>
<p class="Verbatim">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;
/*@refs@*/ int refs;</p>
<p class="Verbatim">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; char
*contents;</p>
<p class="Verbatim">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; } *rstring;</p>
<p class="afterlist">declares <span class=
      "CodeText"><span style='font-size:10.0pt'>rstring</span></span>
      as an abstract, reference-counted type.&nbsp; The
      <span class="CodeText"><span style=
      'font-size:10.0pt'>refs</span></span> field counts the number
      of references and the <span class="CodeText"><span style=
      'font-size:10.0pt'>contents</span></span> field holds the
      contents of a string.</p>
<p class="TextFontCX">&nbsp;</p>
<center>
<table class="MsoNormalTable" border="0" cellspacing="0"
cellpadding="0" style=
'width:425.5pt;margin-left:.2in;border-collapse:collapse'>
<tr>
<td valign="top" style=
'width:267.05pt;border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX" align="center" style='text-align:center'>
<span class="Keyword"><b><span style=
'font-size:10.0pt; color:white'>rstring.c</span></b></span></p></td>
<td valign="top" style=
'width:158.45pt;border-top:solid black 1.5pt; border-left:none;border-bottom:none;border-right:solid black 1.5pt; background:black;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX" align="center" style='text-align:center'>
<b><span style='color:white'>Running
Splint</span></b></p></td></tr>
<tr>
<td valign="top" style=
'width:267.05pt;border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt'>
<p class="Verbatim"><span style='font-size:9.0pt'># include
"rstring.h"</span></p>
<p class="Verbatim"><span style='font-size:9.0pt'>&nbsp;</span></p>
<p class="Verbatim"><span style='font-size:9.0pt'>static rstring
rstring_ref (rstring r)</span></p>
<p class="Verbatim"><span style='font-size:9.0pt'>{</span></p>
<p class="Verbatim"><span style='font-size:9.0pt'>&nbsp;
r-&gt;refs++;</span></p>
<p class="Verbatim"><span class="Line"><span style=
'font-size:8.0pt'>6</span></span> <span style=
'font-size:9.0pt'>return r;</span></p>
<p class="Verbatim"><span style='font-size:9.0pt'>}</span></p>
<p class="Verbatim"><span style='font-size:9.0pt'>&nbsp;</span></p>
<p class="Verbatim"><span style='font-size:9.0pt'>rstring
rstring_first (rstring r1, rstring r2)</span></p>
<p class="Verbatim"><span style='font-size:9.0pt'>{</span></p>
<p class="Verbatim"><span style='font-size:9.0pt'>&nbsp; if (strcmp
(r1-&gt;contents, r2-&gt;contents) &lt; 0)</span></p>
<p class="Verbatim"><span class="Line"><span style=
'font-size:8.0pt'>12</span></span><span style=
'font-size:9.0pt'>&nbsp;&nbsp; return r1;</span></p>
<p class="Verbatim"><span style='font-size:9.0pt'>&nbsp;&nbsp;
else</span></p>
<p class="Verbatim"><span class="Line"><span style=
'font-size:8.0pt'>14</span></span><span style=
'font-size:9.0pt'>&nbsp;&nbsp;&nbsp;&nbsp; return rstring_ref
(r2);</span></p>
<p class="Verbatim"><span style='font-size:9.0pt'>}</span></p></td>
<td valign="top" style=
'width:158.45pt;border-top:none;border-left: none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
<p class="lclintrun">&gt; splint rstring.c</p>
<p class="lclintrun">rstring.c:12: Reference counted&nbsp;</p>
<p class="lclintrun">&nbsp;&nbsp; storage returned without
modifying</p>
<p class="lclintrun">&nbsp;&nbsp; reference count: r1</p>
<p class="lclintrun"><i>&nbsp;</i></p>
<p class="TextFontCX" align="left" style='text-align:left'>
<i><span style='font-size:10.0pt'>No error is reported for line 6
since the reference count was incremented.&nbsp; No error is
reported for line 14, since</span></i> <span class=
"CodeText"><i><span style=
'font-size:10.0pt'>rstring_ref</span></i></span><i><span style='font-size:10.0pt'>
returns a new reference.</span></i></p>
<p class="TextFontCX" align="left" style=
'text-align:left;page-break-after:avoid'><span style=
'font-size:10.0pt'>&nbsp;</span></p></td></tr></table>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       align="center">
<tr>
<td valign="top" align="left" style=
'padding-top:.1in;padding-right: 0in;padding-bottom:.1in;padding-left:0in'>
<p class="MsoCaption"><a name="_Toc534824613"></a><a name=
"_Ref534822069">Figure 9</a>.&nbsp; Reference
Counting</p></td></tr></table></center>
<br clear="all">
 
<p class="TextFontCX">All functions that return <span class=
"Annot"><span style='font-size:10.0pt'>refcounted</span></span>
storage must increase the reference count before returning.&nbsp;
Splint cannot determine if the reference count was increased, so
any function that directly returns a reference to
      <span class="Annot"><span style=
      'font-size:10.0pt'>refcounted</span></span> storage will
      produce an error.&nbsp; This is avoided, by using a function
      to return a new reference (e.g., <span class=
      "CodeText"><span style=
      'font-size:10.0pt'>rstring_ref</span></span> in Figure
      9).</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">A reference counted type may be passed as a
<span class="Annot"><span style=
'font-size:10.0pt'>temp</span></span> or <span class=
"Annot"><span style='font-size:10.0pt'>dependent</span></span>
parameter.&nbsp; It may not be passed as an <span class=
"Annot"><span style='font-size:10.0pt'>only</span></span>
parameter.&nbsp; Instead, the <span class=
      "Annot"><span style='font-size:10.0pt'>killref</span></span>
      annotation is used to denote a parameter whose reference is
      eliminated by the function call.&nbsp; Like <span class=
      "Annot"><span style='font-size:10.0pt'>only</span></span>
      parameters, an actual parameter corresponding to a
      <span class="Annot"><span style=
      'font-size:10.0pt'>killref</span></span> formal parameter may
      not be used in the calling function after the call.&nbsp;
      Splint checks that the implementation of a function releases
      all <span class="Annot"><span style=
      'font-size:10.0pt'>killref</span></span> parameters, either
      by passing them as <span class="Annot"><span style=
      'font-size: 10.0pt'>killref</span></span> parameters, or
      assigning or returning them without increasing the reference
      count.</p>
<h1 style='margin-left:0in;text-indent:0in'><a name=
"_Ref348845247"></a><a name="_Ref348796245"></a><a name=
"_Toc344355413"></a><a name="_Ref344355210"></a><a name=
"_Ref343064238"></a><a name="_Ref343064188"></a><a name=
"_Toc534974969"></a><a name="_Ref534642796"></a><a name=
"_Ref534642146">6<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
<a id="sharing" name="sharing">
Sharing</a></a></h1>
<p class="TextFontCX">Errors involving unexpected sharing of
storage can cause serious problems.&nbsp; Undocumented sharing may
lead to unpredictable modifications, and some library calls (e.g.,
<span class="CodeText"><span style=
'font-size:10.0pt'>strcpy</span></span>) have undefined behavior if
parameters share storage.&nbsp; Another class of sharing errors
occurs when clients of an abstract type may obtain a reference to
mutable storage that is part of the abstract representation.&nbsp;
This exposes the representation of the abstract type, since clients
may modify an instance of the abstract type indirectly through this
shared storage.</p>
<h2 style='margin-left:0in;text-indent:0in'><a name=
"_Ref534977801"></a><a name="_Toc534974970">6.1<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Aliasing</a></h2>
<p class="TextFontCX">Splint detects errors involving dangerous
aliasing of parameters.&nbsp; Some of these errors are already
detected through the standard memory annotations (e.g.,
      <span class="Annot"><span style=
      'font-size:10.0pt'>only</span></span>&nbsp;parameters may not
      be aliases.)&nbsp;&nbsp; Two additional annotations are
      provided for constraining aliasing of parameters and return
      values.</p>
<h3 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974971"></a><a name="_Ref347469444">6.1.1<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Unique Parameters</a></h3>
<p class="TextFontCX">The <span class="Annot"><span style=
'font-size:10.0pt'>unique</span></span>&nbsp;annotation denotes a
parameter that may not be aliased by any other storage reachable
from the function implementation &#8212; that is, any storage
reachable through the other parameters or global variables used by
the function.&nbsp; The <span class="Annot"><span style=
'font-size:10.0pt'>unique</span></span> annotation places similar
constraints on function parameters as the <span class=
"Annot"><span style='font-size:10.0pt'>only</span></span>
annotation, but it does not transfer the obligation to release
storage.&nbsp; Splint will report an error if a <span class=
"Annot"><span style='font-size:10.0pt'>unique</span></span>
parameter may be aliased by another parameter or global
variable.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Splint reports an error if a function returns
a reference to storage reachable from one of its parameters (if
<span class="Flag"><span style=
'font-size:10.0pt'>retalias</span></span> is on) since this may
introduce unexpected aliases in the body of the calling function
when the result is assigned.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Figure 10 illustrated sharing checks.&nbsp;
An error is reported since the first parameter to the library
function <span class="CodeText"><span style=
'font-size:10.0pt'>strcpy</span></span> is declared with
unique.&nbsp; If a <span class="CodeText"><span style=
'font-size:10.0pt'>unique</span></span> qualifier were added to the
parameter declaration for <span class="CodeText"><span style=
'font-size:10.0pt'>s</span></span> or <span class=
"CodeText"><span style='font-size:10.0pt'>t</span></span>, no error
would be reported.&nbsp;</p>
<center>
<table class="MsoNormalTable" border="0" cellspacing="0"
cellpadding="0" style=
'margin-left:5.4pt;border-collapse:collapse; margin-left:-2.25pt;margin-right:-2.25pt'>
<tr>
<td valign="top" style=
'border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX" align="center" style='text-align:center'>
<span class="Keyword"><b><span style=
'font-size:10.0pt; color:white'>unique.c</span></b></span></p></td>
<td valign="top" style=
'border-top:solid black 1.5pt; border-left:none;border-bottom:none;border-right:solid black 1.5pt; background:black;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX" align="center" style='text-align:center'>
<b><span style='color:white'>Running
Splint</span></b></p></td></tr>
<tr>
<td valign="top" style=
'border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt'>
<p class="Verbatim"># include &lt;string.h&gt;</p>
<p class="Verbatim">&nbsp;</p>
<p class="Verbatim">void&nbsp;</p>
<p class="Verbatim">capitalize (/*@out@*/ char *s,</p>
<p class="Verbatim">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;char *t)</p>
<p class="Verbatim">{</p>
<p class="Verbatim"><span class="Line"><span style=
'font-size:8.0pt'>&nbsp;7</span></span>&nbsp; strcpy (s, t);</p>
<p class="Verbatim">&nbsp;&nbsp; *s = toupper (*s);</p>
<p class="Verbatim">}</p></td>
<td valign="top" style=
'border-top:none;border-left: none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
<p class="lclintrun">&gt; splint unique.c</p>
<p class="lclintrun">&nbsp;</p>
<p class="lclintrun">unique.c: (in function capitalize)</p>
<p class="lclintrun">unique.c:7: Parameter 1 (s) to function strcpy
is</p>
<p class="lclintrun">&nbsp;&nbsp;&nbsp; declared unique but may be
aliased externally by</p>
<p class="lclintrun">&nbsp;&nbsp;&nbsp; parameter 2 (t)</p>
<p class="lclintrun">&nbsp;</p></td></tr></table>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
<tr>
<td valign="top" align="left" style=
'padding-top:6.5pt;padding-right: 9.35pt;padding-bottom:6.5pt;padding-left:9.35pt'>
<p class="MsoCaption"><a name="_Toc534824614"></a><a name=
"_Ref534822167">Figure 10</a>.&nbsp; Unique
parameters</p></td></tr></table></center>
<h3 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974972"></a><a name="_Ref347469448">6.1.2<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Returned Parameters</a></h3>
<p class="TextFontCX">The <span class="Annot"><span style=
'font-size:10.0pt'>returned</span></span> annotation denotes a
parameter that may be aliased by the return value.&nbsp; Splint
checks the call assuming the result may be an alias to the
<span class="Annot"><span style=
'font-size:10.0pt'>returned</span></span> parameter.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Consider the following code excerpt:</p>
<p class="TextFontCX">&nbsp;</p>
<p class="Verbatim">extern intSet intSet_insert (/*@returned@*/
intSet s, int x);</p>
<p class="Verbatim">&nbsp;</p>
<p class="Verbatim">intSet intSet_singleton (int x)</p>
<p class="Verbatim">{</p>
<p class="Verbatim"><span class="Line"><span style=
'font-size:8.0pt'>7</span></span>&nbsp; return (intSet_insert
(intSet_new (), x));</p>
<p class="TextFontCX">}</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Without the <span class=
      "Annot"><span style='font-size:10.0pt'>returned</span></span>
      qualifier on the parameter to <span class=
      "CodeText"><span style=
      'font-size:10.0pt'>intSet_insert</span></span>, a memory leak
      error would be reported for line 7, since the <span class=
      "Annot"><span style='font-size:10.0pt'>only</span></span>
      storage returned by <span class="CodeText"><span style=
      'font-size:10.0pt'>intSet_new</span></span> is not
      released.&nbsp; Because of the <span class=
      "Annot"><span style='font-size:10.0pt'>returned</span></span>
      qualifier, Splint assumes the result of <span class=
      "CodeText"><span style=
      'font-size:10.0pt'>intSet_insert</span></span> is the same
      storage as its first parameter, in this case the storage
      returned by <span class="CodeText"><span style=
      'font-size:10.0pt'>intSet_new</span></span>.&nbsp; No error
      is reported, since the only storage is then transferred
      through the return value (which has an implicit only
      annotation, see Section 5.3).</p>
<h2 style='margin-left:0in;text-indent:0in'><a name=
"_Ref344907981"></a><a name="_Ref344894258"></a><a name=
"_Ref344809320"></a><a name="_Toc344355414"></a><a name=
"_Toc534974973"></a><a name="_Ref345591408"></a><a name=
"_Ref345591053">6.2<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Exposure</a></h2>
<p class="TextFontCX">Splint detects places where the
representation of an abstract type is exposed.&nbsp; This occurs if
a client has a pointer to storage that is part of the
representation of an instance of the abstract type.&nbsp; The
client can then modify or examine the storage this points to, and
manipulate the value of the abstract type instance without using
its operations.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">There are three ways a representation may be
exposed:</p>
<p class="TextFontCX" style=
'margin-left:.25in; text-indent:-.25in'>1.<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Returning (or assigning to a global variable) an object that
includes a pointer to a mutable component of an abstract
type&nbsp;representation.&nbsp; (Controlled by <span class=
"Flag"><span style=
'font-size:10.0pt'>ret-expose</span></span>).</p>
<p class="TextFontCX" style=
'margin-left:.25in; text-indent:-.25in'>2.<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Assigning a mutable component of an abstract object to storage
reachable from an actual parameter or a global variable that may be
used after the call. &nbsp;&nbsp;This means the client may
manipulate the abstract object using the actual parameter after the
call.&nbsp; Note that if the corresponding formal parameter is
declared <span class="Annot"><span style=
'font-size:10.0pt'>only</span></span>, the caller may not use the
actual parameter after the call so the representation is not
exposed.&nbsp; (Controlled by <span class="Flag"><span style=
'font-size:10.0pt'>assign-expose</span></span>).</p>
<p class="TextFontCX" style=
'margin-left:.25in; text-indent:-.25in'>3.<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Casting mutable storage to or from an abstract type.&nbsp;
(Controlled by <span class="Flag"><span style=
'font-size:10.0pt'>cast-expose</span></span>).</p>
<p class="afterlist">Annotations may be used to allow exposed
storage to be returned safely by restricting how the caller may use
the returned storage.</p>
<h3 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974974"></a><a name="_Ref347469553">6.2.1<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Read-Only Storage</a></h3>
<p class="beforelist">It is often useful for a function to return a
pointer to internal storage (or an instance of a mutable abstract
type) that is intended only as an <i>observer</i>.&nbsp; The caller
may use the result, but should not modify the storage it points
to.&nbsp; For example, consider a na&#239;ve implementation of the
<span class="CodeText"><span style=
'font-size:10.0pt'>employee_getName</span></span> operation for the
abstract <span class="CodeText"><span style=
'font-size:10.0pt'>employee</span></span> type:</p>
<p class="Verbatim">&nbsp;&nbsp; typedef /*@abstract@*/ struct
{</p>
<p class="Verbatim">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; char *name;</p>
<p class="Verbatim">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; int id;</p>
<p class="Verbatim">&nbsp;&nbsp; } *employee;</p>
<p class="Verbatim">&nbsp;&nbsp; &#8230;</p>
<p class="Verbatim">&nbsp;&nbsp; char *employee_getName (employee
e) { return e-&gt;name; }</p>
<p class="afterlist">Splint produces a message to indicate that the
return value exposes the representation.&nbsp; One solution would
be to return a fresh copy of <span class=
      "CodeText"><span style='font-size:10.0pt'>e-&gt;name</span></span>.&nbsp;
      This is expensive, though, especially if we expect
      <span class="CodeText"><span style=
      'font-size:10.0pt'>employee_getName</span></span> is used
      mainly just to get a string for searching or printing.&nbsp;
      Instead, we could change the declaration of <span class=
      "CodeText"><span style=
      'font-size:10.0pt'>employee_getName</span></span> to:</p>
<p class="example">extern /*@observer@*/ char *employee_getName
(employee e);</p>
<p class="TextFontCX">Now, the original implementation is
correct.&nbsp; The declaration indicates that the caller may not
modify the result, so it is acceptable to return shared
storage.&nbsp; (The program must also not use the returned observer
storage after any other calls to the abstract type module using the
same parameter.&nbsp; Splint does not attempt to check this, and in
practice it is rarely a problem.)&nbsp; Splint checks that the
caller does not modify the return value.&nbsp; An error is reported
if observer storage is modified directly, passed as a function
parameter that may be modified, assigned to a global variable or
reference derivable from a global variable that is not declared
with an <span class="Annot"><span style=
'font-size: 10.0pt'>observer</span></span> annotation , or returned
as a function result or a reference derivable from the function
result that is not annotation with an <span class=
"Annot"><span style='font-size:10.0pt'>observer</span></span>
annotation.</p>
<h4 style='margin-left:0in;text-indent:0in'><a name=
"_Ref347469563"></a><a name="_Ref348017065">String
Literals</a></h4>
<p class="TextFontCX">A program that attempts to modify&nbsp;a
string literal has undefined&nbsp;behavior [ISO, 6.4.5]. This is
not enforced by most C compilers, and can lead to particularly
pernicious bugs that only appear when optimizations are turned on
and the compiler attempts to minimize storage for string
literals.&nbsp; Splint can be used to check that string literals
are not modified, by treating them as -<span class=
"Annot"><span style=
'font-size:10.0pt'>observer</span></span>&nbsp;storage.&nbsp; If
<span class="Flag"><span style=
'font-size:10.0pt'>+read-only-strings</span></span> is set (default
in standard mode), Splint will report an error if a string literal
is modified.</p>
<h3 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974975">6.2.2<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Exposed Storage</a></h3>
<p class="TextFontCX">Sometimes it is necessary to expose the
representation of an abstract type.&nbsp; This may be evidence of a
design flaw, but in some cases is justified for efficiency
reasons.&nbsp; The <span class="Annot"><span style=
'font-size:10.0pt'>exposed</span></span> annotation&nbsp;denotes
storage that is exposed.&nbsp; It may be used on a return value for
results that reference storage internal to an abstract
representation, on a parameter value to indicate a parameter that
may be assigned directly to part of an abstract representation
(note that if the parameter is annotated with <span class=
"Annot"><span style='font-size:10.0pt'>only</span></span>, it is
not an error to assign it to part of an abstract representation,
since the caller may not use the storage after the call returns),
or on a field of an abstract representation to indicate that
external references to the storage may exist.&nbsp; <a name=
"_Toc344355415"></a><a name="_Ref343064165"></a><a name=
"_Ref347254440"></a><a name="_Ref347169365">An error is reported
if</a> <span class="Annot"><span style=
'font-size:10.0pt'>exposed</span></span> storage is released, but
unlike an <span class="Annot"><span style=
'font-size:10.0pt'>observer</span></span>, no error is reported if
it is modified.&nbsp; Figure 11 shows examples of exposure problems
detected by Splint.</p>
<p class="TextFontCX">&nbsp;</p>
<center>
<table class="MsoNormalTable" border="0" cellspacing="0"
cellpadding="0" style=
'margin-left:6.75pt;border-collapse:collapse; margin-left:-2.25pt;margin-right:-2.25pt'>
<tr>
<td width="45%" valign="top" style=
'border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX" align="center" style='text-align:center'>
<span class="Keyword"><b><span style=
'font-size:10.0pt; color:white'>exposure.c</span></b></span></p></td>
<td valign="top" style=
'border-top:solid black 1.5pt; border-left:none;border-bottom:none;border-right:solid black 1.5pt; background:black;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX" align="center" style='text-align:center'>
<b><span style='color:white'>Running
Splint</span></b></p></td></tr>
<tr>
<td valign="top" style=
'border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt'>
<p class="Verbatim"># include "employee.h"</p>
<p class="Verbatim">&nbsp;</p>
<p class="Verbatim">char *</p>
<p class="Verbatim">employee_getName (employee e)</p>
<p class="Verbatim">{</p>
<p class="Verbatim"><span class="Line"><span style=
'font-size:8.0pt'>6</span></span>&nbsp; return e-&gt;name;</p>
<p class="Verbatim">}</p>
<p class="Verbatim">&nbsp;</p>
<p class="Verbatim">/*@observer@*/ char *</p>
<p class="Verbatim">employee_obsName (employee e)</p>
<p class="Verbatim">{ return e-&gt;name; }</p>
<p class="Verbatim">&nbsp;</p>
<p class="Verbatim">/*@exposed@*/ char *</p>
<p class="Verbatim">employee_exposeName (employee e)</p>
<p class="Verbatim">{ return e-&gt;name; }</p>
<p class="Verbatim">&nbsp;</p>
<p class="Verbatim">void</p>
<p class="Verbatim">employee_capName (employee e)</p>
<p class="Verbatim">{</p>
<p class="Verbatim">&nbsp; char *name;</p>
<p class="Verbatim">&nbsp;</p>
<p class="Verbatim">&nbsp; name = employee_obsName (e);</p>
<p class="Verbatim"><span class="Line"><span style=
'font-size:8.0pt'>23</span></span> *name = toupper (*name);</p>
<p class="Verbatim">}</p></td>
<td valign="top" style=
'border-top:none;border-left:none; border-bottom:solid black 1.5pt;border-right:solid black 1.5pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="lclintrun">&gt; splint exposure.c +checks</p>
<p class="lclintrun">&nbsp;</p>
<p class="lclintrun">exposure.c:6: Function returns reference
to</p>
<p class="lclintrun">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
parameter e: e-&gt;name</p>
<p class="lclintrun">exposure.c:6: Return value exposes rep of</p>
<p class="lclintrun">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
employee: e-&gt;name</p>
<p class="lclintrun">exposure.c:6: Released storage e-&gt;name
reachable</p>
<p class="lclintrun">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
from parameter at return point</p>
<p class="lclintrun">&nbsp;&nbsp; exposure.c:6: Storage e-&gt;name
is released</p>
<p class="lclintrun">exposure.c:23: Suspect modification of
observer</p>
<p class="lclintrun">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
name: *name = toupper(*name)</p>
<p class="TextFontCX" style='page-break-after: avoid'>&nbsp;</p>
<p class="TextFontCX" align="left" style=
'text-align:left;page-break-after:avoid'><i><span style=
'font-size: 10.0pt'>Three messages are reported for line 6 where a
mutable field of an abstract type is returned with no sharing
qualifier (without</span></i> <span class="Flag"><span style=
'font-size:10.0pt'>+checks</span></span><i><span style=
'font-size:10.0pt'>only the third one would be reported.)&nbsp; The
error for line 23 reports a modification of an observer.&nbsp; If
the call in line 22 were changed to call</span></i>
      <span class="CodeText"><span style=
      'font-size: 10.0pt'>employee_exposeName</span></span><i><span style='font-size:10.0pt'>
, no error would be reported.</span></i></p></td></tr></table>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
<tr>
<td valign="top" style=
'padding-top:.1in;padding-right: 9.35pt;padding-bottom:.1in;padding-left:9.35pt'>
<p class="MsoCaption"><a name="_Toc534824615">Figure 11.&nbsp;
Exposure</a></p></td></tr></table></center>
<p class="TextFontCX">&nbsp;</p>
<h1 style='margin-left:0in;text-indent:0in'><a name=
"_Ref361649198"></a><a name="_Ref361649165"></a><a name=
"_Ref354415790"></a><a name="_Ref350062908"></a><a name=
"_Ref348845273"></a><a name="_Ref345591297"></a><a name=
"_Ref344916609"></a><a name="_Ref344894369"></a><a name=
"_Ref344891459"></a><a name="_Ref344798185"></a><a name=
"_Toc344355418"></a><a name="_Toc534974976"></a><a name=
"_Ref534014913"></a><a name="_Ref534014715"></a><a name=
"_Ref348871484">7<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
<a id="function" name="function">
Function Interfaces</a></a></h1>
<p class="TextFontCX">Functions communicate with their calling
environment through an interface.&nbsp; The caller communicates the
values of actual parameters and global variables to the function,
and the function communicates to the caller through the return
value, global variables and storage reachable from the actual
parameters.&nbsp; By keeping interfaces narrow (restricting the
amount of information visible across a function interface), we can
understand and implement functions independently.&nbsp;</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">A function prototype documents the interface
to a function.&nbsp; It serves as a contract between the function
and its caller.&nbsp; In early versions of C, the function
&#8220;prototype&#8221; was very limited.&nbsp; It described the
type returned by the function but nothing about its
parameters.&nbsp; ANSI C (1989) provided function prototypes with
the ability to add information on the number and types of parameter
to a function.&nbsp; Splint provides the means to express much more
about a function interface such as what global variable the
function may use and what values visible to the caller it may
modify.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">The extra interface information places
constraints on both how the function may be called and how it may
be implemented.&nbsp; Splint reports places where these constraints
are not satisfied.&nbsp; Typically, these indicate bugs in the code
or errors in the interface documentation.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">This section describes annotations that may
be added to a function declaration to document what global
variables the function implementation may use and what values
visible to its caller it may modify.</p>
<h2 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974977"></a><a name="_Ref348845225"></a><a name=
"_Ref344908335"></a><a name="_Ref344892358"></a><a name=
"_Toc344355403">7.1<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Modifications</a></h2>
<p class="TextFontCX">The modifies clause lists what values visible
to the caller may be modified by a function.&nbsp; Modifies clauses
limit what values a function may modify, but they do not require
that listed values are always modified.&nbsp; The declaration,</p>
<p class="example">int f (int *p, int *q) /*@modifies *p@*/;</p>
<p class="TextFontCX">declares a function <span class=
"CodeText"><span style='font-size:10.0pt'>f</span></span> that may
modify the value pointed to by its first argument but may not
modify the value of its second argument or any global state.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Splint checks that a function does not modify
any caller-visible value not encompassed by its modifies clause and
does modify all values listed in its modifies clause on some
possible execution of the function.&nbsp; Figure 12 shows an
example of modifies checking done by Splint.</p>
<p class="TextFontCX">&nbsp;</p>
<center>
<table class="MsoNormalTable" border="0" cellspacing="0"
cellpadding="0" style='margin-left:5.4pt;border-collapse:collapse'
width="80%">
<tr>
<td width="40%" valign="top" style=
'border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt;height:13.5pt'>
<p class="TextFontCX" align="center" style='text-align:center'>
<a name="_Ref344908343"><span class="Keyword"><b><span style=
'font-size:10.0pt;color:white'>modify.c</span></b></span></a></p></td>
<td width="60%" valign="top" style=
'border-top:solid black 1.5pt; border-left:none;border-bottom:none;border-right:solid black 1.5pt; background:black;padding:0in 5.4pt 0in 5.4pt;height:13.5pt'>
<p class="TextFontCX" align="center" style='text-align:center'>
<b><span style='color:white'>Running
Splint</span></b></p></td></tr>
<tr style='height:120.9pt'>
<td valign="top" style=
'border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt;height:120.9pt'>
<p class="Verbatim">void setx (int *x, int *y)</p>
<p class="Verbatim">&nbsp; /*@modifies *x@*/</p>
<p class="Verbatim">{</p>
<p class="Verbatim"><span class="Line"><span style=
'font-size:8.0pt'>4</span></span>&nbsp; *y = *x;</p>
<p class="Verbatim">}</p>
<p class="Verbatim">&nbsp;</p>
<p class="Verbatim">void sety (int *x, int *y)</p>
<p class="Verbatim">&nbsp; /*@modifies *y@*/</p>
<p class="Verbatim">{</p>
<p class="Verbatim">&nbsp;&nbsp; setx (y, x);</p>
<p class="Verbatim">}</p></td>
<td width="60%" valign="top" style=
'border-top:none;border-left: none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt;height:120.9pt'>
<p class="lclintrun">&gt; splint modify.c +checks</p>
<p class="lclintrun">modify.c:4: Undocumented modification of *y:
*y = *x</p>
<p class="lclintrun">modify.c:5: Suspect object listed in modifies
of setx</p>
<p class="lclintrun">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
not modified: *x</p>
<p class="lclintrun">&nbsp;&nbsp; modify.c:1: Declaration of
setx</p>
<p class="TextFontCX"><i><span style=
'font-size: 10.0pt'>&nbsp;</span></i></p>
<p class="TextFontCX" style='page-break-after: avoid'>
<i><span style='font-size:10.0pt'>There are
n</span></i><i><span style='font-size:10.0pt'>o errors
for</span></i> <span class="CodeText"><span style=
'font-size:10.0pt'>sety</span></span><i><span style=
'font-size:10.0pt'>&#8211; the call to</span></i>
      <span class="CodeText"><span style=
      'font-size:10.0pt'>setx</span></span><i><span style=
      'font-size:10.0pt'>modifies the value<br>
 pointed to by its first parameter (</span></i><span class=
"CodeText"><span style=
'font-size:10.0pt'>y</span></span><i><span style=
'font-size:10.0pt'>) as documented by the<br>
 modifies clause.&nbsp; The</span></i> <span class=
"Flag"><span style=
'font-size:10.0pt'>checks</span></span><i><span style=
'font-size:10.0pt'>mode turns on</span></i> <span class=
"Flag"><span style=
'font-size:10.0pt'>mustmod</span></span><i><span style=
'font-size:10.0pt'>checking,<br>
 so the second error concerning missing documented<br>
 modifications is reported.</span></i></p></td></tr>
<tr height="0">
<td style='border:none'></td>
<td style='border:none'></td></tr></table>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
<tr>
<td valign="top" style=
'padding-top:4.3pt;padding-right: .3in;padding-bottom:4.3pt;padding-left:.3in'>
<p class="MsoCaption"><a name="_Toc534824616"></a><a name=
"_Ref534822865">Figure 12</a>.&nbsp;
Modification</p></td></tr></table></center>
<br clear="all">
 
<h3 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974978">7.1.1<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
State Modifications</a></h3>
<p class="beforelist">A few special names are provided for
describing function modifications that effect state not
identifiable through parameters or global variables:</p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>internalState</span></span></p>
<p class="IndentText">The function modifies some internal state
(that is, the value of a <span class="CodeText"><span style=
'font-size:10.0pt'>static</span></span> variable).&nbsp; Even
though a client cannot access the internal state directly, it is
important to know that something may be modified by the function
call both for clear documentation and for checking undefined order
of evaluation (Section 8.2) and side effect free parameters
(Section 11.2.1).</p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>fileSystem</span></span></p>
<p class="IndentText">The function modifies the file system.&nbsp;
Any modification that may change the system state is considered a
file system modification.&nbsp; All functions that modify an object
of type pointer to <span class="CodeText"><span style=
'font-size:10.0pt'>FILE</span></span> also modify the file
system.&nbsp; In addition, functions that do not modify a
<span class="CodeText"><span style=
'font-size:10.0pt'>FILE</span></span> pointer but modify some state
that is visible outside this process also modify the file system
(e.g., <span class="CodeText"><span style=
'font-size:10.0pt'>rename</span></span>).&nbsp;&nbsp; The flag
<span class="Flag"><span style=
'font-size:10.0pt'>mod-file-system</span></span> controls reporting
of undocumented file system modifications.</p>
<p class="MsoListBullet"><span class="Annot"><span style=
'font-size:10.0pt'>nothing</span></span></p>
<p class="IndentText">The function modifies nothing (i.e., it is
side effect free).</p>
<p class="TextFontCX" style='margin-left:.5in'>&nbsp;</p>
<p class="TextFontCX">The annotation, <span class=
"Annot"><span style='font-size:10.0pt'>/*@*/</span></span> in a
function declaration or definition (after the parameter list,
before the semi-colon or function body) denotes a function that
modifies nothing and does not use any global variables (see Section
7.2).</p>
<h3 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974979"></a><a name="_Ref345591515">7.1.2<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Missing Modifies Clauses</a></h3>
<p class="TextFontCX">Splint is designed so programs with many
functions that are declared without modifies clauses can be checked
effectively.&nbsp; Unless <span class="Flag"><span style=
'font-size:10.0pt'>modnomods</span></span> is in on, no
modification errors are reported checking a function declared with
no modifies clause.&nbsp;</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">A function with no modifies clause is an
<i>unconstrained</i> function since there are no documented
constraints on what it may modify.&nbsp; When an unconstrained
function is called, it is checked differently from a function
declared with a modifies clause.&nbsp; To prevent spurious errors,
no modification error is reported at the call site unless the
<span class="Flag"><span style=
'font-size:10.0pt'>mod-uncon</span></span>&nbsp;flag is on.&nbsp;
Flags control whether errors involving unconstrained functions are
reported for other checks that depend on modifications (side effect
free macro parameters (Section 11.2.1), undefined&nbsp;evaluation
order (Section 8.2), and likely infinite loops&nbsp;(Section
8.3.1).)</p>
<h2 style='margin-left:0in;text-indent:0in'><a name=
"_Ref534980042"></a><a name="_Toc534974980"></a><a name=
"_Ref534972121"></a><a name="_Ref348845219"></a><a name=
"_Ref347475720"></a><a name="_Ref347171487"></a><a name=
"_Ref344908307"></a><a name="_Ref344893725"></a><a name=
"_Toc344355404">7.2<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Global Variables</a></h2>
<p class="TextFontCX">Another aspect of a function&#8217;s
interface, is the global variables it uses.&nbsp; A globals list in
a function declaration lists external variables that may be used in
the function body.&nbsp; Splint checks that global variables used
in a procedure match those listed in its globals list. A global is
used in a function if it appears in the body directly, or it is in
the globals list of a function called in the body. Splint reports
if a global that is used in a procedure is not listed in its
globals list, and if a listed global is not used in the function
implementation.&nbsp; Figure 13 shows an example function
definition with a globals list and associated checking done by
Splint.</p>
<center>
<table class="MsoNormalTable" border="0" cellspacing="0"
cellpadding="0" style=
'margin-left:9.9pt;border-collapse:collapse;margin-left:-2.25pt; margin-right:-2.25pt'>
<tr style='height:13.25pt'>
<td valign="top" style=
'width:202.5pt;border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt;height:13.25pt'>
<p class="TextFontCX" align="center" style='text-align:center'>
<span class="Keyword"><b><span style=
'font-size:10.0pt; color:white'>globals.c</span></b></span></p></td>
<td valign="top" style=
'width:220.5pt;border-top:solid black 1.5pt; border-left:none;border-bottom:none;border-right:solid black 1.5pt; background:black;padding:0in 5.4pt 0in 5.4pt;height:13.25pt'>
<p class="TextFontCX" align="center" style='text-align:center'>
<b><span style='color:white'>Running
Splint</span></b></p></td></tr>
<tr style='height:70.65pt'>
<td valign="top" style=
'width:202.5pt;border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt;height:70.65pt'>
<p class="Verbatim"><span style='font-size:9.5pt'>int glob1,
glob2;</span></p>
<p class="Verbatim"><span style='font-size:9.5pt'>&nbsp;</span></p>
<p class="Verbatim"><span class="Line"><span style=
'font-size:8.0pt'>3</span></span> <span style='font-size:9.5pt'>int
f (void) /*@globals glob1;@*/</span></p>
<p class="Verbatim"><span style='font-size:9.5pt'>{</span></p>
<p class="Verbatim"><span class="Line"><span style=
'font-size:8.0pt'>5&nbsp;</span></span> <span style=
'font-size:9.5pt'>return glob2;</span></p>
<p class="Verbatim"><span style='font-size:9.5pt'>}</span></p></td>
<td valign="top" style=
'width:220.5pt;border-top:none;border-left: none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt;height:70.65pt'>
<p class="lclintrun">&gt; splint globals.c +checks</p>
<p class="lclintrun">&nbsp;</p>
<p class="lclintrun">globals.c:5: Undocumented use of global
glob2</p>
<p class="lclintrun">globals.c:3: Global glob1 listed but not
used</p>
<p class="lclintrun">&nbsp;</p>
<p class="lclintrun" style='page-break-after:avoid'>
&nbsp;</p></td></tr></table>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
<tr>
<td valign="top" align="left" style=
'padding-top:8.65pt;padding-right: 9.35pt;padding-bottom:8.65pt;padding-left:9.35pt'>
<p class="MsoCaption"><a name="_Ref349498221"></a><a name=
"_Ref349498215"></a><a name="_Ref347468808"></a><a name=
"_Ref347468791"></a><a name="_Ref344908072"></a><a name=
"_Ref344908069"></a><a name="_Ref344893745"></a><a name=
"_Toc344355405"></a><a name="_Toc534824617"></a><a name=
"_Ref534822988">Figure 13</a>.&nbsp; Global
Variables</p></td></tr></table></center>
<h3 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974981">7.2.1<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Controlling Globals Checking</a></h3>
<p class="TextFontCX">Whether on not an error is reported for a use
of a global variable in a given function depends on the scope of
the variable (file <span class="CodeText"><span style=
'font-size:10.0pt'>static</span></span> or external), the checking
annotation used in the variable declaration or the implicit
annotation if no checking annotation is used, whether or not the
function is declared with a globals list, and flag settings.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="beforelist">A global or file static variable declaration
may be preceded by an annotation to indicate how the variable
should be checked.&nbsp; In order of decreasing checks, the
annotations are:</p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>/*@checkedstrict@*/</span></span></p>
<p class="IndentText">Strictest checking.&nbsp; Undocumented uses
and modifications of the variable are reported in all functions
whether or not they have a globals list (unless <span class=
"Flag"><span style=
'font-size:10.0pt'>check-strict-globs</span></span> is off).</p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>/*@checked@*/</span></span></p>
<p class="IndentText">Undocumented use of the variable is reported
in a function with a globals list, but not in a function declared
with no globals (unless <span class="Flag"><span style=
'font-size:10.0pt'>glob-noglobs</span></span> is on).<a name=
"here"></a></p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>/*@checkmod@*/</span></span></p>
<p class="IndentText">Undocumented uses of the variable are not
reported, but undocumented modifications are reported.&nbsp;&nbsp;
(If <span class="Flag"><span style=
'font-size:10.0pt'>mod-globs-nomods</span></span> is on, errors are
reported even in functions declared with no modifies&nbsp;clause or
globals list.)</p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>/*@unchecked@*/</span></span></p>
<p class="IndentText">No messages are reported for undocumented use
or modification of this global variable.</p>
<p class="afterlist">If a variable has none of these annotations,
an implicit annotation is determined by the flag
settings.&nbsp;</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Different flags control the implicit
annotation for variables declared with global scope and variables
declared with file scope (i.e., using the <span class=
"CodeText"><span style='font-size:10.0pt'>static</span></span>
storage qualifier). To set the implicit annotation for global
variables declared in <span class="Flag"><i><span style=
'font-size:10.0pt'>context</span></i></span> (<span class=
"Flag"><span style='font-size:10.0pt'>globs</span></span> for
external variables or <span class="Flag"><span style=
'font-size:10.0pt'>statics</span></span> for file static variable)
to be <span class="Flag"><i><span style=
'font-size:10.0pt'>annotation</span></i></span> (<span class=
"Flag"><span style='font-size:10.0pt'>checked</span></span>,
<span class="Flag"><span style=
'font-size:10.0pt'>checkmod</span></span>, <span class=
"Flag"><span style='font-size:10.0pt'>checkedstrict</span></span>)
use <span class="Flag"><span style=
'font-size:10.0pt'>imp<i>&lt;annotation&gt;
&lt;context&gt;</i></span></span>.&nbsp; For example,
      <span class="Flag"><span style=
      'font-size:10.0pt'>+imp-checked-strict-statics</span></span>
      makes the implicit checking on unqualified file static
      variables <span class="Flag"><span style=
      'font-size:10.0pt'>checkedstrict</span></span>.&nbsp; See
      Appendix B for a complete list of globals checking flags.</p>
<h3 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974982"></a><a name="_Ref534971010">7.2.2<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></a>
Definition State</h3>
<p class="TextFontCX">Annotations can be used in the globals list
of a function declaration to describe the states of global
variables before and after the call.&nbsp; If a global is preceded
by <span class="Annot"><span style=
'font-size:10.0pt'>undef</span></span>, it is assumed to be
undefined before the call. Thus, no error is reported if the global
is not defined when the function is called, but an error is
reported if the global is used in the function body before it is
defined.&nbsp; The <span class="Annot"><span style=
'font-size:10.0pt'>killed</span></span> annotation denotes a
global&nbsp;variable that may be undefined when the call
returns.&nbsp; For globals that contain dynamically allocated
storage, a <span class="Annot"><span style=
'font-size:10.0pt'>killed</span></span> global variable is similar
to an <span class="Annot"><span style=
'font-size:10.0pt'>only</span></span>&nbsp;parameter (Section
5.2).&nbsp; An error is reported if it contains the only reference
to storage that is not released before the call returns.&nbsp;
Figure 14 illustrated <span class="Annot"><span style=
'font-size:10.0pt'>killed</span></span> and <span class=
"Annot"><span style='font-size:10.0pt'>undef</span></span>
globals.</p>
<center>
<table class="MsoNormalTable" border="0" cellspacing="0"
cellpadding="0" style=
'margin-left:.9pt;border-collapse:collapse; margin-left:-2.25pt;margin-right:-2.25pt'>
<tr>
<td valign="top" style=
'border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt;height:13.45pt'>
<p class="TextFontCX" align="center" style='text-align:center'>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
<span class="Keyword"><b><span style=
'font-size:10.0pt;color:white'>annotglobs.c</span></b></span></p></td>
<td valign="top" style=
'width:198.8pt;border-top:solid black 1.5pt; border-left:none;border-bottom:none;border-right:solid black 1.5pt; background:black;padding:0in 5.4pt 0in 5.4pt;height:13.45pt'>
<p class="TextFontCX" align="center" style='text-align:center'>
<b><span style='color:white'>Running
Splint</span></b></p></td></tr>
<tr>
<td valign="top" style=
'border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt;height:236.7pt'>
<p class="Verbatim">int globnum;</p>
<p class="Verbatim">&nbsp;</p>
<p class="Verbatim">struct {</p>
<p class="Verbatim">&nbsp; char *firstname, *lastname;</p>
<p class="Verbatim">&nbsp; int id;</p>
<p class="Verbatim">} globname;</p>
<p class="Verbatim">&nbsp;</p>
<p class="Verbatim">void</p>
<p class="Verbatim">initialize (/*@only@*/ char *name)</p>
<p class="Verbatim">&nbsp; /*@globals undef globnum,</p>
<p class="Verbatim">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
undef globname @*/</p>
<p class="Verbatim">{</p>
<p class="Verbatim"><span class="Line"><span style=
'font-size:8.0pt'>13</span></span> globname.id = globnum;</p>
<p class="Verbatim">&nbsp; globname.lastname = name;</p>
<p class="Verbatim"><span class="Line"><span style=
'font-size:8.0pt'>15</span></span>}</p>
<p class="Verbatim">&nbsp;</p>
<p class="Verbatim">void finalize (void)</p>
<p class="Verbatim">&nbsp; /*@globals killed globname@*/</p>
<p class="Verbatim">{</p>
<p class="Verbatim">&nbsp; free (globname.lastname);</p>
<p class="Verbatim"><span class="Line"><span style=
'font-size:8.0pt'>21</span></span> }</p></td>
<td valign="top" style=
'width:198.8pt;border-top:none;border-left: none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt;height:236.7pt'>
<p class="lclintrun">&gt; splint annotglobs.c</p>
<p class="lclintrun">&nbsp;</p>
<p class="lclintrun">annotglobs.c:13: Undef global globnum used</p>
<p class="lclintrun">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
before definition</p>
<p class="lclintrun">annotglobs.c:15: Global storage globname</p>
<p class="lclintrun">&nbsp;&nbsp;&nbsp; contains 1 undefined field
when call</p>
<p class="lclintrun">&nbsp;&nbsp;&nbsp; returns: firstname</p>
<p class="lclintrun">annotglobs.c:21: Only storage</p>
<p class="lclintrun">&nbsp;&nbsp;&nbsp; globname.firstname (type
char *) derived</p>
<p class="lclintrun">&nbsp;&nbsp;&nbsp; from killed global is not
released</p>
<p class="lclintrun" style='page-break-after:avoid'>
&nbsp;&nbsp;&nbsp; (memory leak)</p></td></tr></table>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
<tr>
<td valign="top" align="left" style=
'padding-top:10.1pt;padding-right: 9.35pt;padding-bottom:10.1pt;padding-left:9.35pt'>
<p class="MsoCaption"><a name="_Toc534824618"></a><a name=
"_Ref534823055">Figure 14</a>.&nbsp; Annotated Globals
Lists</p></td></tr></table></center>
<h2 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974983"></a><a name="_Ref344894947"></a><a name=
"_Toc344355406">7.3<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Declaration Consistency</a></h2>
<p class="TextFontCX">Splint checks that function declarations and
definitions are consistent.&nbsp; The general rule is that the
<i>first</i> declaration of a function implies all later
declarations and definitions.&nbsp; If a function is declared in a
header file, the first declaration processed is its first
declaration (if it is declared in more than one header file an
error is reported if <span class="Flag"><span style=
'font-size:10.0pt'>redecl</span></span>&nbsp;is set)
      <span style='display:none'>(if the same function is declared
      in more than one header file ???)</span>.&nbsp; Otherwise,
      the first declaration in the file defining the function is
      its first declaration.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Later declarations may not include variables
in the globals list that were not included in the first
declaration.&nbsp; The exception to this is when the first
declaration is in a header file and the later declaration or
definition includes file static variables.&nbsp; Since these are
not visible in the header file, they can not be included in the
header file declaration.&nbsp; Similarly, the modifies clause of a
later declaration may not include objects that are not modifiable
in the first declaration.&nbsp; The later declaration may be more
specific.&nbsp; For example, if the header declaration is:</p>
<p class="example" style='text-indent:.3in'>extern void setName
(employee e, char *s) /*@modifies e@*/;</p>
<p class="TextFontCX">the later declaration could be,</p>
<p class="example">&nbsp;&nbsp; void setName (employee e, char *)
/*@modifies e-&gt;name@*/;</p>
<p class="TextFontCX">If <span class="CodeText"><span style=
'font-size:10.0pt'>employee</span></span> is an abstract type, the
declaration in the header should not refer to a particular
implementation (i.e., it shouldn&#8217;t rely on there being a
<span class="CodeText"><span style=
'font-size:10.0pt'>name</span></span> field), but the
implementation declaration can be more specific.&nbsp;</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">This rule also applies to file static
variables.&nbsp; The header declaration for a function that
modifies a file static variable should use <span class=
"Annot"><span style='font-size:10.0pt'>modifies
internalState</span></span> since file static variables are not
visible to clients.&nbsp; The implementation declaration should
list the actual file static variables that may be modified.</p>
<h2 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974984"></a><a name="_Ref354411787">7.4<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
State Clauses</a></h2>
<p class="TextFontCX">Sometimes it is necessary to specify function
interfaces at a lower level than is possible with the standard
annotations.&nbsp; For example, if a function defines some fields
of a returned structure but does not define all the fields.&nbsp;
The <span class="Annot"><span style=
'font-size:10.0pt'>/*@special@*/</span></span> annotation is used
to mark a parameter, global variable, or return value that is
described using state clauses.&nbsp;</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">State clauses may be used to constrain the
state of a parameter or return value before or after a call.&nbsp;
One or more state clauses may appear in a function declaration,
before the modifies or globals clauses.&nbsp; State clauses may be
listed in any order, but the same state clause should not be used
more than once.&nbsp; In a state clause list, <span class=
"CodeText"><span style='font-size:10.0pt'>result</span></span> is
used to refer to the return value of the function.&nbsp;</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX" style='margin-bottom:6.0pt'>The following
state clauses are used to describe the definition state or
parameters before and after the function is called and the return
value after the function returns:</p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>/*@uses
<i>&lt;references&gt;</i>@*/</span></span></p>
<p class="indentbefore0">References in a <span class=
"Annot"><span style='font-size:10.0pt'>uses</span></span> clause
must be completely defined before the function is called.&nbsp;
They are assumed to be defined at function entrance when the
function is checked.</p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>/*@sets
<i>&lt;references&gt;</i>@*/</span></span></p>
<p class="indentbefore0">References in a <span class=
"Annot"><span style='font-size:10.0pt'>sets</span></span> clause
must be allocated before the function is called.&nbsp; They are
completely defined after the function returns. They are assumed to
be allocated but undefined storage at function entrance and an
error is reported if there is a path on which they are not defined
before the function returns.</p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>/*@defines
<i>&lt;references&gt;</i>@*/</span></span></p>
<p class="indentbefore0">References in a <span class=
"Annot"><span style='font-size:10.0pt'>defines</span></span> clause
must not refer to unshared, allocated storage before the function
is called.&nbsp; They are completely defined after the function
returns. When the function is checked, they are assumed to be
undefined at function entrance and an error is reported if there is
a path on which they are not defined before the function
returns.</p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>/*@allocates
<i>&lt;references&gt;</i>@*/</span></span></p>
<p class="indentbefore0">References in an <span class=
"Annot"><span style='font-size:10.0pt'>allocates</span></span>
clause must be unallocated before the function is called.&nbsp;
They are allocated but not necessarily defined after the function
returns. An error is reported if there is a path through the
function on which they are not allocated before the function
returns.</p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>/*@releases
&lt;references&gt;@*/</span></span></p>
<p class="IndentText">References in the <span class=
"Annot"><span style='font-size:10.0pt'>releases</span></span>
clause are deallocated by the function.&nbsp; They must be storage
that could be passed as an <span class="Annot"><span style=
'font-size:10.0pt'>only</span></span>&nbsp;parameter before the
function is called, and are dead pointers after the function
returns.&nbsp; They are assumed to be defined at function entrance
and an error is reported if they refer to live, allocated storage
at any return point.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Some examples of state clauses are shown in
Figure 15. The <span class="Annot"><span style=
'font-size: 10.0pt'>defines</span></span> clause for
      <span class="CodeText"><span style=
      'font-size:10.0pt'>record_new</span></span> indicates that
      the <span class="CodeText"><span style=
      'font-size:10.0pt'>id</span></span> field of the structure
      pointed to by the result is defined, but the <span class=
      "CodeText"><span style='font-size:10.0pt'>name</span></span>
      field is not.&nbsp; So, <span class="CodeText"><span style=
      'font-size:10.0pt'>record_create</span></span> needs to call
      <span class="CodeText"><span style=
      'font-size:10.0pt'>record_setName</span></span> to define the
      name field.&nbsp; Similarly, the <span class=
      "Annot"><span style='font-size:10.0pt'>releases</span></span>
      clause for <span class="CodeText"><span style=
      'font-size:10.0pt'>record_clearName</span></span> indicates
      that no storage is associated with the <span class=
      "CodeText"><span style='font-size:10.0pt'>name</span></span>
      field of its parameter after the return, so no failure to
      deallocate storage message is produced for the call to
      <span class="CodeText"><span style=
      'font-size:10.0pt'>free</span></span> in <span class=
      "CodeText"><span style=
      'font-size:10.0pt'>record_free</span></span>.&nbsp; The
      <span class="Annot"><span style='font-size:10.0pt'>ensures
      isnull</span></span> clause is described in the next
      section.</p>
<center>
<table class="MsoNormalTable" border="0" cellspacing="0"
cellpadding="0" style=
'margin-left:9.9pt;border-collapse:collapse;margin-left:-2.25pt; margin-right:-2.25pt'>
<tr>
<td valign="top" style=
'width:423.0pt;border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX" align="center" style='text-align:center'>
<span class="Keyword"><b><span style=
'font-size:10.0pt; color:white'>clauses.c</span></b></span></p></td></tr>
<tr>
<td valign="top" style=
'width:423.0pt;border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt'>
<p class="Verbatim">typedef struct</p>
<p class="Verbatim">{</p>
<p class="Verbatim">&nbsp; int id;</p>
<p class="Verbatim">&nbsp; /*@only@*/ char *name;</p>
<p class="Verbatim">} *record;</p>
<p class="Verbatim">&nbsp;</p>
<p class="Verbatim">static /*@special@*/ record record_new
(void)</p>
<p class="Verbatim">&nbsp; /*@defines result-&gt;id@*/</p>
<p class="Verbatim">{</p>
<p class="Verbatim">&nbsp; record r = (record) malloc (sizeof
(*r));</p>
<p class="Verbatim">&nbsp;</p>
<p class="Verbatim">&nbsp; assert (r != NULL);</p>
<p class="Verbatim">&nbsp; r-&gt;id = 3;</p>
<p class="Verbatim">&nbsp; return r;</p>
<p class="Verbatim">}</p>
<p class="Verbatim">&nbsp;</p>
<p class="Verbatim">static void</p>
<p class="Verbatim">&nbsp;&nbsp; record_setName (/*@special@*/
record r, /*@only@*/ char *name)</p>
<p class="Verbatim">&nbsp;&nbsp; /*@defines r-&gt;name@*/</p>
<p class="Verbatim">{</p>
<p class="Verbatim">&nbsp; r-&gt;name = name;</p>
<p class="Verbatim">}</p>
<p class="Verbatim">&nbsp;</p>
<p class="Verbatim">record record_create (/*@only@*/ char
*name)</p>
<p class="Verbatim">{</p>
<p class="Verbatim">&nbsp; record r = record_new ();</p>
<p class="Verbatim">&nbsp; record_setName (r, name);</p>
<p class="Verbatim">&nbsp; return r;</p>
<p class="Verbatim">}</p>
<p class="Verbatim">&nbsp;</p>
<p class="Verbatim">void record_clearName (/*@special@*/ record
r)</p>
<p class="Verbatim">&nbsp;&nbsp; /*@releases r-&gt;name@*/</p>
<p class="Verbatim">&nbsp;&nbsp; /*@ensures isnull
r-&gt;name@*/</p>
<p class="Verbatim">{</p>
<p class="Verbatim">&nbsp; free (r-&gt;name);</p>
<p class="Verbatim">&nbsp; r-&gt;name = NULL;</p>
<p class="Verbatim">}</p>
<p class="Verbatim">&nbsp;</p>
<p class="Verbatim">void record_free (/*@only@*/ record r)</p>
<p class="Verbatim">{</p>
<p class="Verbatim">&nbsp; record_clearName (r);</p>
<p class="Verbatim">&nbsp; free (r);</p>
<p class="Verbatim">}</p>
<p class="Verbatim" style='page-break-after:avoid'>
&nbsp;</p></td></tr></table>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
<tr>
<td valign="top" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="MsoCaption"><a name="_Toc534824619"></a><a name=
"_Ref354412972">Figure 15</a>.&nbsp; State
Clauses</p></td></tr></table></center>
<p class="TextFontCX"><span class="Keyword"><span style=
'font-size:10.0pt'>&nbsp;</span></span></p>
<h2 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974985"></a><a name="_Ref534888798">7.5<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Requires and Ensures Clauses</a></h2>
<p class="TextFontCX">More general assumptions about state of
parameters and globals before and after a function is called can be
described using <span class="Annot"><i><span style=
'font-size:10.0pt'>requires</span></i></span> and
      <span class="Annot"><i><span style=
      'font-size:10.0pt'>ensures</span></i></span> clauses.&nbsp; A
      <span class="Annot"><span style=
      'font-size:10.0pt'>requires</span></span> clause specifies a
      predicate that must be true at a call site; when checking a
      function implementation Splint assumes the constraints given
      in its <span class="Annot"><span style=
      'font-size:10.0pt'>requires</span></span> clauses are true at
      function entry.&nbsp; An <span class="Annot"><span style=
      'font-size:10.0pt'>ensures</span></span> clause specifies a
      predicate that is true at a call site after the call returns;
      when checking a function implementation Splint warns if there
      is an execution path that does not return with a state that
      satifies the constraints given in its <span class=
      "Annot"><span style='font-size:10.0pt'>ensures</span></span>
      clauses.&nbsp; A function declaration can have many
      <span class="Annot"><span style=
      'font-size:10.0pt'>requires</span></span> and <span class=
      "Annot"><span style='font-size:10.0pt'>ensures</span></span>
      clauses as long as their meanings are not contradictory.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">The following constraints can be stated using
<span class="Annot"><span style=
'font-size:10.0pt'>requires</span></span> and <span class=
"Annot"><span style='font-size:10.0pt'>ensures</span></span>
clauses:</p>
<h6 style='margin-left:0in;text-indent:0in'><b>Aliasing
Annotations</b></h6>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>/*@requires
only<i>&lt;references&gt;</i>@*/</span></span>; <span class=
"Annot"><span style='font-size:10.0pt'>/*@ensures
only<i>&lt;references&gt;</i>@*/</span></span></p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>/*@requires
shared<i>&lt;references&gt;</i>@*/</span></span>;
      <span class="Annot"><span style='font-size:10.0pt'>/*@ensures
      shared<i>&lt;references&gt;</i>@*/</span></span></p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>/*@requires
owned<i>&lt;references&gt;</i>@*/</span></span>; <span class=
"Annot"><span style='font-size:10.0pt'>/*@ensures
owned<i>&lt;references&gt;</i>@*/</span></span></p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>/*@requires
dependent<i>&lt;references&gt;</i>@*/</span></span>;
      <span class="Annot"><span style='font-size:10.0pt'>/*@ensures
      dependent<i>&lt;references&gt;</i>@*/</span></span></p>
<p class="IndentText">References refer to <span class=
"Annot"><span style='font-size:10.0pt'>only</span></span>,
<span class="Annot"><span style=
'font-size:10.0pt'>shared</span></span>, <span class=
"Annot"><span style='font-size:10.0pt'>owned</span></span> or
<span class="Annot"><span style=
'font-size:10.0pt'>dependent</span></span> storage before
(<span class="Annot"><span style=
'font-size:10.0pt'>requires</span></span>) or after
      (<span class="Annot"><span style=
      'font-size:10.0pt'>ensures</span></span>) the call.</p>
<h6 style='margin-left:0in;text-indent:0in'><b>Exposure
Annotations</b></h6>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>/*@requires
observer<i>&lt;references&gt;</i>@*/</span></span>;
      <span class="Annot"><span style='font-size:10.0pt'>/*@ensures
      observer<i>&lt;references&gt;</i>@*/</span></span></p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>/*@requires
exposed<i>&lt;references&gt;</i>@*/</span></span>;
      <span class="Annot"><span style='font-size:10.0pt'>/*@ensures
      exposed <i>&lt;references&gt;</i>@*/</span></span></p>
<p class="IndentText">References refer to <span class=
"Annot"><span style='font-size:10.0pt'>observer</span></span> or
<span class="Annot"><span style=
'font-size:10.0pt'>exposed</span></span> storage before
(<span class="Annot"><span style=
'font-size:10.0pt'>requires</span></span>) or after
      (<span class="Annot"><span style=
      'font-size:10.0pt'>ensures</span></span>) the call.</p>
<h6 style='margin-left:0in;text-indent:0in'><b>Null</b>
<b>State</b><b>Annotations</b></h6>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>/*@requires
isnull<i>&lt;references&gt;</i>@*/</span></span>;
      <span class="Annot"><span style='font-size:10.0pt'>/*@ensures
      isnull<i>&lt;references&gt;</i>@*/</span></span></p>
<p class="IndentText">References have the value <span class=
"CodeText"><span style='font-size:10.0pt'>NULL</span></span> before
(<span class="Annot"><span style=
'font-size:10.0pt'>requires</span></span>) or after
      (<span class="Annot"><span style=
      'font-size:10.0pt'>ensures</span></span>) the call.&nbsp;
      Note, this is not the same name or meaning as the
      <span class="Annot"><span style=
      'font-size:10.0pt'>null</span></span> annotation (which means
      the value may or may not be <span class="Annot"><span style=
      'font-size:10.0pt'>NULL</span></span>.)</p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>/*@requires
notnull<i>&lt;references&gt;</i>@*/</span></span>;
      <span class="Annot"><span style='font-size:10.0pt'>/*@ensures
      notnull<i>&lt;references&gt;</i>@*/</span></span></p>
<p class="IndentText">References do not have the value
      <span class="CodeText"><span style=
      'font-size:10.0pt'>NULL</span></span> before (<span class=
      "Annot"><span style=
      'font-size:10.0pt'>requires</span></span>) or after
      (<span class="Annot"><span style=
      'font-size:10.0pt'>ensures</span></span>) the call.</p>
<p class="TextFontCX">&nbsp;</p>
<h1 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974986"></a><a name="_Ref534642886"></a><a name=
"_Ref483663682">8<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
<a id="control" name="control">
Control Flow</a></a></h1>
<p class="TextFontCX">The section describes checking done by Splint
related to control flow.&nbsp; Many of these checks are
significantly improved because of the extra information that is
known about the program when annotations are provided.</p>
<h2 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974987"></a><a name="_Ref345859337"></a><a name=
"_Ref344907653"></a><a name="_Ref344894343"></a><a name=
"_Ref344873752"></a><a name="_Toc344355417">8.1<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Execution</a></h2>
<p class="TextFontCX">To detect certain errors and avoid spurious
errors, it is important to know something about the control flow
behavior of called functions. Without additional information,
Splint assumes that all functions eventually return and execution
continues normally at the call site.&nbsp;</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">The <span class="Annot"><span style=
'font-size:10.0pt'>noreturn</span></span>&nbsp;annotation is used
to denote a function that never returns<a href="#_ftn8" name=
"_ftnref8" title=""><span class=
      "MsoFootnoteReference"><span class="MsoFootnoteReference"><span style='font-size:11.0pt;font-family:"Times New Roman"'>
[8]</span></span></span></a>.&nbsp; For example,</p>
<p class="example"><span class="Annot"><span style=
'font-size:10.0pt'>extern /*@noreturn@*/ void fatalerror
(/*@observer@*/ char *s);</span></span></p>
<p class="beforelist">declares <span class=
      "CodeText"><span style='font-size:10.0pt'>fatalerror</span></span>
      to never return.&nbsp; This enables Splint to correctly
      analyze code like,</p>
<p class="TextFontCX"><span class="Keyword"><span style=
'font-size:10.0pt'>&nbsp;&nbsp; if (x == NULL) fatalerror
("Yikes!");</span></span></p>
<p class="TextFontCX"><span class="Keyword"><span style=
'font-size:10.0pt'>&nbsp;&nbsp; *x = 3;</span></span></p>
<p class="afterlist">Other functions may return, but sometimes (or
usually) return normally.&nbsp; The <span class=
      "Annot"><span style='font-size:10.0pt'>maynotreturn</span></span>
      annotation denotes a function that may or may not
      return.&nbsp; This may be useful for documentation, but does
      not help checking much, since Splint must assume that a
      function declared with <span class="Annot"><span style=
      'font-size:10.0pt'>maynotreturn</span></span> returns
      normally when checking the code.&nbsp; The <span class=
      "Annot"><span style=
      'font-size:10.0pt'>alwaysreturns</span></span> annotation
      denotes a function that always returns (but Splint does no
      checking to verify this).</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">To describe non-returning functions more
precisely, the <span class="Annot"><span style=
'font-size:10.0pt'>noreturnwhentrue</span></span>&nbsp;and
<span class="Annot"><span style=
'font-size:10.0pt'>noreturnwhenfalse</span></span>&nbsp;annotations
may be used.&nbsp; Similar to <span class=
      "Annot"><span style='font-size: 10.0pt'>nullwhentrue</span></span>
      and <span class="Annot"><span style=
      'font-size:10.0pt'>falsewhennull</span></span> (see Section
      2.1.1), <span class="Annot"><span style=
      'font-size:10.0pt'>noreturnwhentrue</span></span>&nbsp;and
      <span class="Annot"><span style=
      'font-size:10.0pt'>noreturnwhenfalse</span></span> mean that
      a function never returns if the value of its first argument
      is true (<span class="Annot"><span style=
      'font-size:10.0pt'>noreturnwhentrue</span></span>) or false
      (<span class="Annot"><span style=
      'font-size:10.0pt'>noreturnwhenfalse</span></span>).&nbsp;
      They may be used only on functions whose first argument is a
      Boolean.&nbsp;&nbsp;</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX" style='margin-bottom:6.0pt'>Hence, a function
declared with <span class="Annot"><span style=
'font-size:10.0pt'>noreturnwhenwfalse</span></span> must not return
if the value of its argument is false.&nbsp; For example, the
standard library declares <span class="Keyword"><span style=
'font-size:10.0pt'>assert</span></span>&nbsp;as<a href="#_ftn9"
name="_ftnref9" title=""><span class=
"MsoFootnoteReference"><span class=
"MsoFootnoteReference"><span style=
'font-size:11.0pt;font-family:"Times New Roman"'>[9]</span></span></span></a>:</p>
<p class="example" style=
'margin-top:0in;margin-right:.2in;margin-bottom:0in; margin-left:0in;margin-bottom:.0001pt;text-indent:.5in'>
/*@noreturnwhenfalse@*/ void</p>
<p class="example" style=
'margin-top:0in;margin-right:.2in;margin-bottom:0in; margin-left:0in;margin-bottom:.0001pt;text-indent:.5in'>
assert (/*@sef@*/ bool /*@alt int@*/ pred);</p>
<p class="beforelist" style='margin-top:6.0pt'>This way, code
like,</p>
<p class="Verbatim">&nbsp;&nbsp; assert (x != NULL);</p>
<p class="Verbatim">&nbsp;&nbsp; *x = 3;</p>
<p class="TextFontCX">is checked without reporting a false warning,
since the <span class="Annot"><span style=
'font-size:10.0pt'>noreturnwhenwfalse</span></span> annotation on
<span class="CodeText"><span style=
'font-size:10.0pt'>assert</span></span> means the deference of
<span class="CodeText"><span style=
'font-size:10.0pt'>x</span></span> is not reached is
      <span class="CodeText"><span style='font-size:10.0pt'>x !=
      NULL</span></span> is false.</p>
<h2 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974988"></a><a name="_Ref350066608">8.2<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Undefined</a> Behavior</h2>
<p class="TextFontCX">The order in which side effects take place in
a C program is not entirely defined by the code.&nbsp; Certain
execution points are known as <i>sequence points</i> &#8212; a
function call (after the arguments have been evaluated), the end of
a full expression (an initializer, expression in an expression
statement, the control expression of an <span class=
"CodeText"><span style='font-size:10.0pt'>if</span></span>,
<span class="CodeText"><span style=
'font-size:10.0pt'>switch</span></span>, <span class=
"CodeText"><span style='font-size:10.0pt'>while</span></span> or
<span class="CodeText"><span style=
'font-size:10.0pt'>do</span></span> statement, each expression of a
<span class="CodeText"><span style=
'font-size:10.0pt'>for</span></span> statement, and the expression
in a <span class="CodeText"><span style=
'font-size: 10.0pt'>return</span></span> statement), and after the
first operand or a <span class="CodeText"><span style=
'font-size:10.0pt'>&amp;&amp;</span></span>, <span class=
"CodeText"><span style='font-size:10.0pt'>||</span></span>,
<span class="CodeText"><span style=
'font-size:10.0pt'>?</span></span> or <span class=
"CodeText"><span style='font-size:10.0pt'>,</span></span>
operand.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">All side effects before a sequence point must
be complete before the sequence point, and no evaluations after the
sequence point shall have taken place.&nbsp; Between sequence
points, side effects and evaluations may take place in any
order.&nbsp; Hence, the order in which expressions or arguments are
evaluated is not specified.&nbsp; Compilers are free to evaluate
function arguments and parts of expressions (that do not contain
sequence points) in any order.&nbsp; The behavior of code is
undefined if it uses a value that is modified by another expression
that is not required to be evaluated before or after the other
use.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Splint detects instances where undetermined
order of evaluation produces undefined&nbsp;behavior.&nbsp; If
modifies clauses and globals lists are used, this checking is
enabled in expressions involving function calls. Evaluation order
checking is controlled by the <span class="Flag"><span style=
'font-size:10.0pt'>eval-order</span></span> flag.</p>
<center>
<table class="MsoNormalTable" border="0" cellspacing="0"
cellpadding="0" style=
'margin-left:13.05pt;border-collapse:collapse; margin-left:-2.25pt;margin-right:-2.25pt'>
<tr>
<td valign="top" style=
'border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt;height:13.45pt'>
<p class="TextFontCX" align="center" style='text-align:center'>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
<span class="Keyword"><b><span style=
'font-size:10.0pt;color:white'>order.c</span></b></span></p></td>
<td valign="top" style=
'width:198.8pt;border-top:solid black 1.5pt; border-left:none;border-bottom:none;border-right:solid black 1.5pt; background:black;padding:0in 5.4pt 0in 5.4pt;height:13.45pt'>
<p class="TextFontCX" align="center" style='text-align:center'>
<b><span style='color:white'>Running
Splint</span></b></p></td></tr>
<tr>
<td valign="top" style=
'width:148.95pt;border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt'>
<p class="Verbatim">extern int glob;</p>
<p class="Verbatim">&nbsp;</p>
<p class="Verbatim">extern int mystery (void);</p>
<p class="Verbatim">&nbsp;</p>
<p class="Verbatim">extern int modglob (void)</p>
<p class="Verbatim">&nbsp;&nbsp; /*@globals glob@*/</p>
<p class="Verbatim">&nbsp;&nbsp; /*@modifies glob@*/;</p>
<p class="Verbatim">&nbsp;</p>
<p class="Verbatim">int f (int x, int y[])</p>
<p class="Verbatim">{</p>
<p class="Verbatim"><span class="Line"><span style=
'font-size:8.0pt'>11</span></span> int i = x++ * x;</p>
<p class="Verbatim">&nbsp;</p>
<p class="Verbatim"><span class="Line"><span style=
'font-size:8.0pt'>13</span></span> y[i] = i++;</p>
<p class="Verbatim"><span class="Line"><span style=
'font-size:8.0pt'>14</span></span> i += modglob() * glob;</p>
<p class="Verbatim"><span class="Line"><span style=
'font-size:8.0pt'>15</span></span> i += mystery() * glob;</p>
<p class="Verbatim"><span class="Line"><span style=
'font-size:8.0pt'>16</span></span> return i;</p>
<p class="Verbatim">}</p></td>
<td valign="top" style=
'width:275.4pt;border-top:none;border-left: none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
<p class="lclintrun">&gt; splint order.c +evalorderuncon</p>
<p class="lclintrun">order.c:11: Expression has undefined behavior
(value of</p>
<p class="lclintrun">&nbsp;&nbsp;&nbsp; right operand modified by
left operand): x++ * x</p>
<p class="lclintrun">order.c:13: Expression has undefined behavior
(left operand</p>
<p class="lclintrun">&nbsp;&nbsp;&nbsp; uses i, modified by right
operand): y[i] = i++</p>
<p class="lclintrun">order.c:14: Expression has undefined behavior
(value of</p>
<p class="lclintrun">&nbsp;&nbsp;&nbsp; right operand modified by
left operand):</p>
<p class="lclintrun">&nbsp;&nbsp;&nbsp; modglob() * glob</p>
<p class="lclintrun">order.c:15: Expression has undefined
behavior</p>
<p class="lclintrun">&nbsp;&nbsp;&nbsp; (unconstrained function
mystery used in left operand</p>
<p class="lclintrun">&nbsp;&nbsp;&nbsp; may set global variable
glob used in right operand):</p>
<p class="lclintrun">&nbsp;&nbsp;&nbsp; mystery() * glob</p>
<p class="TextFontCX" align="left" style='text-align:left'>
<i>&nbsp;</i></p>
<p class="TextFontCX" align="left" style=
'text-align:left;page-break-after:avoid'><i>The warning for line 14
is reported because the modifies clause of</i> <span class=
"CodeText"><span style='font-size:10.0pt'>modglob</span></span>
<i>indicated that it may modify</i> <span class=
"CodeText"><span style=
'font-size:10.0pt'>glob</span></span><i>.&nbsp; The behavior is
undefined since we don&#8217;t&nbsp; know if</i> <span class=
"CodeText"><span style='font-size:10.0pt'>glob</span></span> <i>is
evaluated before, after or during the</i> <i>modification.&nbsp;
The line 15 warning would not be reported without</i>
      <span class="Flag"><span style=
      'font-size:10.0pt'>+evalorderuncon</span></span><i>.</i></p></td></tr></table>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
<tr>
<td valign="top" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="MsoCaption"><a name="_Toc534824620"></a><a name=
"_Ref534823183">Figure 16</a>.&nbsp; Evaluation
Order</p></td></tr></table></center>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">When checking systems without modifies and
globals information (see Section 7), evaluation order checking may
report errors when unconstrained functions are called in procedure
arguments.&nbsp; Since Splint has no annotations to constrain what
these functions may modify, it cannot be guaranteed that the
evaluation order is defined if another argument calls an
unconstrained function or uses a global variable or storage
reachable from a parameter to the unconstrained function.&nbsp; Its
best to add modifies and globals clauses to constrain the
unconstrained functions in ways that eliminate the possibility of
undefined behavior.&nbsp; For large legacy systems, this may
require too much effort.&nbsp; Instead, the <span class=
"Flag"><span style=
'font-size:10.0pt'>&#8209;eval-order-uncon</span></span> flag may
be used to prevent reporting of undefined behavior due to the order
of evaluation of unconstrained functions.&nbsp; Figure 16
illustrates detection of undefined behavior.</p>
<center>
<table class="MsoNormalTable" border="0" cellspacing="0"
cellpadding="0" style=
'margin-left:18.9pt;border-collapse:collapse;margin-left:-2.25pt; margin-right:-2.25pt'>
<tr>
<td valign="top" style=
'border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX" align="center" style='text-align:center'>
<span class="Keyword"><b><span style=
'font-size:10.0pt; color:white'>loop.c</span></b></span></p></td>
<td valign="top" style=
'border-top:solid black 1.5pt; border-left:none;border-bottom:none;border-right:solid black 1.5pt; background:black;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX" align="center" style='text-align:center'>
<b><span style='color:white'>Running
Splint</span></b></p></td></tr>
<tr style='height:143.1pt'>
<td valign="top" style=
'border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt;height:143.1pt'>
<p class="Verbatim">extern int glob1, glob2;</p>
<p class="Verbatim">extern int f (void)</p>
<p class="Verbatim">&nbsp; /*@globals glob1@*/</p>
<p class="Verbatim">&nbsp; /*@modifies nothing@*/;</p>
<p class="Verbatim">extern void g (void)</p>
<p class="Verbatim">&nbsp; /*@modifies glob2@*/ ;</p>
<p class="Verbatim">extern void h (void) ;</p>
<p class="Verbatim">&nbsp;</p>
<p class="Verbatim">void upto (int x)</p>
<p class="Verbatim">{</p>
<p class="Verbatim"><span class="Line"><span style=
'font-size:8.0pt'>14</span></span>&nbsp; while (x &gt; f ())
g();</p>
<p class="Verbatim"><span class="Line"><span style=
'font-size:8.0pt'>15</span></span>&nbsp; while (f () &lt; 3)
h();</p>
<p class="Verbatim">}</p></td>
<td valign="top" style=
'border-top:none;border-left: none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt;height:143.1pt'>
<p class="lclintrun">&gt; splint loop.c +infloopsuncon</p>
<p class="lclintrun">loop.c:14: Suspected infinite loop.&nbsp; No
value used in</p>
<p class="lclintrun">&nbsp;&nbsp;&nbsp; loop test (x, glob1) is
modified by test or loop</p>
<p class="lclintrun">&nbsp;&nbsp;&nbsp; body.</p>
<p class="lclintrun">loop.c:15: Suspected infinite loop.&nbsp; No
condition</p>
<p class="lclintrun">&nbsp;&nbsp;&nbsp; values modified.&nbsp;
Modification possible through</p>
<p class="lclintrun">&nbsp;&nbsp;&nbsp; unconstrained calls: h</p>
<p class="TextFontCX" style='page-break-after: avoid'><i>An error
is reported for line 14 since the only value modified by<br>
 the loop test or body if</i> <span class=
      "CodeText"><span style='font-size: 10.0pt'>glob2</span></span>
      <i>and the value of the loop test<br>
 does not depend on</i> <span class="CodeText"><span style=
'font-size:10.0pt'>glob2</span></span><i>.&nbsp; The error for line
15 would not be<br>
 reported without</i> <span class="Flag"><span style=
'font-size:10.0pt'>+infloopsuncon</span></span><i>.</i></p></td></tr></table>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
<tr>
<td valign="top" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="MsoCaption"><a name="_Toc534824621"></a><a name=
"_Ref534823256">Figure 17</a>.&nbsp; Infinite
Loops</p></td></tr></table></center>
<h2 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974989"></a><a name="_Ref344892701"></a><a name=
"_Toc344355430">8.3<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Problematic Control Structures</a></h2>
<p class="TextFontCX">A number of control structures that are
syntactically legal may indicate likely bugs in programs.&nbsp;
Splint can detect errors involving likely infinite
loops&nbsp;(Section 8.3.1), fall through cases and missing cases in
<span class="CodeText"><span style=
'font-size:10.0pt'>switch</span></span> statements&nbsp;(Section
8.3.2), <span class="CodeText"><span style=
'font-size:10.0pt'>break</span></span> statements within deeply
nested loops or switches (Section 8.3.3), clauses of
      <span class="CodeText"><span style=
      'font-size:10.0pt'>if</span></span>, <span class=
      "CodeText"><span style='font-size:10.0pt'>while</span></span>
      or <span class="CodeText"><span style=
      'font-size:10.0pt'>for</span></span> statements that are
      empty statements or unblocked single statements (Section
      8.3.4) and incomplete if-else logic (Section 8.3.5).&nbsp;
      Although any of these may appear in a correct program,
      depending on the programming style used they may indicate
      likely bugs or style violations that should be detected and
      eliminated.</p>
<h3 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974990"></a><a name="_Ref344810086">8.3.1<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Likely Infinite Loops</a></h3>
<p class="TextFontCX">Splint reports an error if it detects a loop
that appears to be infinite.&nbsp; An error is reported for a loop
that does not modify any value used in its condition test inside
the body of the loop or in the condition test itself.&nbsp; This
checking is enhanced by modifies clauses and globals lists (see
Section 7) since they <a name="_Ref344818734">provide more
information about what global variable may be used in the condition
test and what values may be modified by function calls in the loop
body.</a></p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Figure 17 shows examples of infinite
loops&nbsp;detected by Splint. An error is reported for the loop in
line 14, since neither of the values used in the loop condition
(<span class="CodeText"><span style=
'font-size:10.0pt'>x</span></span> directly and <span class=
"CodeText"><span style='font-size:10.0pt'>glob1</span></span>
through the call to <span class="CodeText"><span style=
'font-size:10.0pt'>f</span></span>) is modified by the body of the
loop.&nbsp; If the declaration of <span class=
"CodeText"><span style='font-size:10.0pt'>g</span></span> is
changed to include <span class="CodeText"><span style=
'font-size:10.0pt'>glob1</span></span> in the modifies clause no
error is reported.&nbsp; (In this example, if we assume the
annotations are correct, then the programmer has probably called
the wrong function in the loop body.&nbsp; This isn&#8217;t
surprising, given the horrible choices of function and variable
names!)</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">If an unconstrained function is called within
the loop body, Splint will assume that it modifies a value used in
the condition test and not report an infinite loop error, unless
<span class="Flag"><span style=
'font-size:10.0pt'>infloopsuncon</span></span> is on.&nbsp; If
<span class="Flag"><span style=
'font-size:10.0pt'>infloopsuncon</span></span> is on, Splint will
report infinite loop errors for loops where there is no explicit
modification of a value used in the condition test, but where they
may be an undetected modification through a call to an
unconstrained function (e.g., line 12 in Figure 17).</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX" align="center" style='text-align:center'>
<span style='font-size:10.0pt'>&nbsp;</span></p>
<h3 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974991"></a><a name="_Ref349899747"></a><a name=
"_Ref345591205">8.3.2<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Switches</a></h3>
<p class="TextFontCX">The automatic fall through of C switch
statements is almost never the intended behavior.<a href="#_ftn10"
name="_ftnref10" title=""><span class=
"MsoFootnoteReference"><span class=
"MsoFootnoteReference"><span style=
'font-size:11.0pt;font-family:"Times New Roman"'>[10]</span></span></span></a>&nbsp;
Splint detects <span class="CodeText"><span style=
'font-size:10.0pt'>case</span></span> statements with code that may
fall through to the next <span class="CodeText"><span style=
'font-size:10.0pt'>case</span></span>.&nbsp; The <span class=
"Flag"><span style='font-size:10.0pt'>casebreak</span></span> flag
controls reporting of fall through cases.&nbsp; A single fall
through case may be marked by preceding the <span class=
"CodeText"><span style='font-size:10.0pt'>case</span></span>
keyword with <span class="Annot"><span style=
'font-size:10.0pt'>/*@fallthrough@*/</span></span> to indicate
explicitly that execution falls through to this case.&nbsp; See
Figure 18 for an example.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">For switches on <span class=
"CodeText"><span style='font-size:10.0pt'>enum</span></span> types,
Splint reports an error if a member of the enumerator does not
appear as a case in the switch body (and there is no
      <span class="CodeText"><span style=
      'font-size:10.0pt'>default</span></span> case).&nbsp;
      (Controlled by <span class="Flag"><span style=
      'font-size:10.0pt'>misscase</span></span>.)</p>
<center>
<table class="MsoNormalTable" border="0" cellspacing="0"
cellpadding="0" style=
'margin-left:.2in;border-collapse:collapse;margin-left:-2.25pt; margin-right:-2.25pt'>
<tr>
<td valign="top" style=
'width:3.0in;border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX" align="center" style='text-align:center'>
<span class="Keyword"><b><span style=
'font-size:10.0pt; color:white'>switch.c</span></b></span></p></td>
<td valign="top" style=
'border-top:solid black 1.5pt; border-left:none;border-bottom:none;border-right:solid black 1.5pt; background:black;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX" align="center" style='text-align:center'>
<b><span style='color:white'>Running
Splint</span></b></p></td></tr>
<tr>
<td valign="top" style=
'border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt'>
<p class="Verbatim">typedef enum {</p>
<p class="Verbatim">&nbsp; YES, NO, DEFINITELY,</p>
<p class="Verbatim">&nbsp; PROBABLY, MAYBE } ynm;</p>
<p class="Verbatim">void decide (ynm y)</p>
<p class="Verbatim">{</p>
<p class="Verbatim">&nbsp; switch (y)</p>
<p class="Verbatim">&nbsp;&nbsp;&nbsp; {</p>
<p class="Verbatim">&nbsp;&nbsp;&nbsp; case PROBABLY:</p>
<p class="Verbatim">&nbsp;&nbsp;&nbsp; case NO: printf ("No!");</p>
<p class="Verbatim"><span class="Line"><span style=
'font-size:8.0pt'>10</span></span> &nbsp;&nbsp;case MAYBE: printf
("Maybe");</p>
<p class="Verbatim">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
/*@fallthrough@*/</p>
<p class="Verbatim">&nbsp;&nbsp;&nbsp; case YES: printf
("Yes!");</p>
<p class="Verbatim"><span class="Line"><span style=
'font-size:8.0pt'>13</span></span> &nbsp;&nbsp;}</p>
<p class="Verbatim">}</p></td>
<td valign="top" style=
'border-top:none;border-left: none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
<p class="lclintrun">&gt; splint switch.c</p>
<p class="lclintrun">switch.c:10: Fall through case (no preceding
break)</p>
<p class="lclintrun">switch.c:13: Missing case in switch:
DEFINITELY</p>
<p class="TextFontCX">&nbsp;</p>
<p class="MsoCaption" align="left" style='text-align:left'>
<i><span style='font-weight:normal'>No fall through error is
reported for the</span></i> <span class=
      "CodeText"><span style='font-weight:normal'>NO</span></span><i><span style='font-weight:normal'>
case,<br>
 since there are no statements associated with the<br>
 previous case.&nbsp;</span></i></p>
<p class="TextFontCX" style='page-break-after: avoid'><i>The</i>
<span class="Annot"><span style=
'font-size:10.0pt'>/*@fallthrough@*/</span></span> <i>comment
prevents<br>
 a message from being produced for the<br></i> <span class=
"Annot"><span style='font-size:10.0pt'>YES</span></span>
<i>case.</i></p></td></tr></table>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
<tr>
<td valign="top" style=
'padding-top:0in;padding-right: 9.0pt;padding-bottom:0in;padding-left:9.0pt'>
<p class="MsoCaption"><a name="_Toc344355431"></a><a name=
"_Ref344881581"></a><a name="_Toc534824622"></a><a name=
"_Ref534823308">Figure 18</a>. &nbsp;Switch
Cases</p></td></tr></table></center>
<h3 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974992"></a><a name="_Ref534971227">8.3.3<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Deep Breaks</a></h3>
<p class="TextFontCX">There is no syntax provided by C (other than
<span class="CodeText"><span style=
'font-size:10.0pt'>goto</span></span>) for breaking out of a nested
loop.&nbsp; All <span class="CodeText"><span style=
'font-size:10.0pt'>break</span></span> and <span class=
"CodeText"><span style='font-size:10.0pt'>continue</span></span>
statements act only on the innermost surrounding loop or
switch.&nbsp; This can lead to serious problems<a href="#_ftn11"
name="_ftnref11" title=""><span class=
"MsoFootnoteReference"><span class=
"MsoFootnoteReference"><span style=
'font-size:11.0pt;font-family:"Times New Roman"'>[11]</span></span></span></a>
when a programmer intends to break the outer loop or switch
instead.&nbsp; Splint optionally reports warnings for
      <span class="CodeText"><span style=
      'font-size: 10.0pt'>break</span></span> and <span class=
      "CodeText"><span style=
      'font-size: 10.0pt'>continue</span></span> statements in
      nested contexts.</p>
<p class="beforelist">&nbsp;</p>
<p class="beforelist">Four types of <span class=
"CodeText"><span style='font-size: 10.0pt'>break</span></span>
warnings are reported:</p>
<p class="MsoListBullet"><span style=
'font-family:Symbol'>&#183;<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
<span class="CodeText"><span style=
'font-size:10.0pt'>break</span></span> inside a loop
      (<span class="CodeText"><span style=
      'font-size:10.0pt'>while</span></span> or <span class=
      "CodeText"><span style='font-size:10.0pt'>for</span></span>)
      that is inside a loop.&nbsp; Controlled by <span class=
      "Flag"><span style=
      'font-size:10.0pt'>looploopbreak</span></span>.&nbsp; To
      indicate that a <span class="CodeText"><span style=
      'font-size:10.0pt'>break</span></span> is inside an inner
      loop, precede the <span class="CodeText"><span style=
      'font-size:10.0pt'>break</span></span> by <a href=
      "mailto:/*@innerbreak@*/"><span class="Annot"><span style=
      'font-size: 10.0pt'>/*@innerbreak@*/</span></span></a>.</p>
<p class="MsoListBullet"><span style=
'font-family:Symbol'>&#183;<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
<span class="CodeText"><span style=
'font-size:10.0pt'>break</span></span> inside a loop that is inside
a <span class="CodeText"><span style=
'font-size:10.0pt'>switch</span></span> statement.&nbsp; Controlled
by <span class="Flag"><span style=
'font-size:10.0pt'>switchloopbreak</span></span>.&nbsp; To mark the
<span class="CodeText"><span style=
'font-size:10.0pt'>break</span></span> as a loop break, precede the
<span class="CodeText"><span style=
'font-size:10.0pt'>break</span></span> by <span class=
"Annot"><span style=
'font-size:10.0pt'>/*@loopbreak@*/</span></span>.</p>
<p class="MsoListBullet"><span style=
'font-family:Symbol'>&#183;<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
<span class="CodeText"><span style=
'font-size:10.0pt'>break</span></span> inside a <span class=
"CodeText"><span style='font-size:10.0pt'>switch</span></span>
statement that is inside a loop.&nbsp; Controlled by
      <span class="Flag"><span style=
      'font-size:10.0pt'>loopswitchbreak</span></span>.&nbsp; To
      mark the <span class="CodeText"><span style=
      'font-size:10.0pt'>break</span></span> as a switch break,
      precede the <span class="CodeText"><span style=
      'font-size:10.0pt'>break</span></span> by <span class=
      "Annot"><span style=
      'font-size:10.0pt'>/*@switchbreak@*/</span></span>.</p>
<p class="MsoListBullet"><span style=
'font-family:Symbol'>&#183;<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
<span class="CodeText"><span style=
'font-size:10.0pt'>break</span></span> inside a <span class=
"CodeText"><span style='font-size:10.0pt'>switch</span></span>
inside another <span class="CodeText"><span style=
'font-size:10.0pt'>switch</span></span>.&nbsp; Controlled by
<span class="Flag"><span style=
'font-size:10.0pt'>switchswitchbreak</span></span>.&nbsp; To
indicate that the <span class="CodeText"><span style=
'font-size:10.0pt'>break</span></span> is for the inner switch, use
<span class="Annot"><span style=
'font-size:10.0pt'>/*@innerbreak@*/</span></span>.</p>
<p class="afterlist">Since <span class=
      "CodeText"><span style='font-size:10.0pt'>continue</span></span>
      only makes sense within loops, a warning (Controlled by <span class=
      "Flag"><span style=
      'font-size: 10.0pt'>looploopcontinue</span></span>.)
      is reported only for 
      <span class="CodeText"><span style=
      'font-size:10.0pt'>continue</span></span> statements within
      nested loops.&nbsp; A
      safe inner <span class="CodeText"><span style=
      'font-size:10.0pt'>continue</span></span> may be preceded by
      <span class="Annot"><span style=
      'font-size:10.0pt'>/*@innercontinue@*/</span></span>&nbsp;to
      suppress error messages locally. The <span class=
      "Flag"><span style='font-size:10.0pt'>deepbreak</span></span>
      flag sets all nested break and continue checking flags.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Splint warns if the marker preceding a
<span class="CodeText"><span style=
'font-size:10.0pt'>break</span></span> is not consistent with its
placement.&nbsp; A warning results if <span class=
"Annot"><span style='font-size:10.0pt'>innerbreak</span></span>
precedes a <span class="CodeText"><span style=
'font-size:10.0pt'>break</span></span> that is not breaking an
inner loop, <span class="Annot"><span style=
'font-size:10.0pt'>switchbreak</span></span> precedes a
      <span class="CodeText"><span style=
      'font-size:10.0pt'>break</span></span> that is not breaking a
      switch, or <span class="Annot"><span style=
      'font-size: 10.0pt'>loopbreak</span></span>&nbsp;precedes a
      <span class="CodeText"><span style=
      'font-size:10.0pt'>break</span></span> that is not breaking a
      loop.</p>
<h3 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974993"></a><a name="_Ref347246280">8.3.4<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></a>
Loop and If Bodies</h3>
<p class="beforelist">An empty statement after an
      <span class="CodeText"><span style=
      'font-size:10.0pt'>if</span></span>, <span class=
      "CodeText"><span style='font-size:10.0pt'>while</span></span>
      or <span class="CodeText"><span style=
      'font-size:10.0pt'>for</span></span> often indicates a
      potential bug.&nbsp; A single statement (i.e., not a compound
      block) after an <span class="CodeText"><span style=
      'font-size:10.0pt'>if</span></span>, <span class=
      "CodeText"><span style='font-size:10.0pt'>while</span></span>
      or <span class="CodeText"><span style=
      'font-size:10.0pt'>for</span></span> is not likely to
      indicate a bug, but make the code harder to read and
      edit.&nbsp; Splint can report errors for if or loop
      statements with empty bodies or bodies that are not compound
      statements.&nbsp; Separate flags control checking for
      statements following an <span class="CodeText"><span style=
      'font-size:10.0pt'>if</span></span>, <span class=
      "CodeText"><span style='font-size:10.0pt'>while</span></span>
      or <span class="CodeText"><span style=
      'font-size:10.0pt'>for</span></span>:</p>
<p class="MsoListBullet"><span style=
'font-family:Symbol'>&#183;<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
<span class="Flag"><span style=
'font-size:10.0pt'>[if</span></span>,<span class=
      "Flag"><span style='font-size:10.0pt'>while</span></span>,<span class="Flag">
<span style='font-size:10.0pt'>for]empty</span></span> &#8212;
report errors for empty bodies (e.g., <span class=
"CodeText"><span style='font-size:10.0pt'>if (x &gt; 3)
;</span></span> )</p>
<p class="MsoListBullet"><span style=
'font-family:Symbol'>&#183;<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
<span class="Flag"><span style=
'font-size:10.0pt'>[if</span></span>,<span class=
      "Flag"><span style='font-size:10.0pt'>while</span></span>,<span class="Flag">
<span style='font-size:10.0pt'>for]block</span></span> &#8212;
report errors for non-block bodies (e.g., <span class=
"CodeText"><span style='font-size:10.0pt'>if (x &gt; 3)
x++;</span></span>)</p>
<p class="MsoListBullet" style='margin-left:0in;text-indent:0in'>
<span class="Keyword"><span style=
'font-size:10.0pt'>&nbsp;</span></span></p>
<p class="afterlist">The <span class="CodeText"><span style=
'font-size:10.0pt'>if</span></span> statement checks also apply to
the body of the <span class="CodeText"><span style=
'font-size:10.0pt'>else</span></span> clause.&nbsp; No
      <span class="Flag"><span style=
      'font-size:10.0pt'>ifblock</span></span> warning is reported
      if the body of the <span class="CodeText"><span style=
      'font-size:10.0pt'>else</span></span> clause is an
      <span class="CodeText"><span style=
      'font-size:10.0pt'>if</span></span> statement, to allow
      conventional <span class="CodeText"><span style=
      'font-size: 10.0pt'>else if</span></span> chains.&nbsp;</p>
<h3 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974994"></a><a name="_Ref347246283">8.3.5<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Complete Logic</a></h3>
<p class="beforelist">Although it may be perfectly reasonable in
many contexts, an <span class="CodeText"><span style=
'font-size:10.0pt'>if</span></span>-<span class=
"CodeText"><span style='font-size:10.0pt'>else</span></span> chain
with no final <span class="CodeText"><span style=
'font-size:10.0pt'>else</span></span> may indicate missing logic or
forgetting to check error cases.&nbsp; If <span class=
"Flag"><span style='font-size:10.0pt'>elseif-complete</span></span>
is on, Splint warns when an <span class=
      "CodeText"><span style='font-size:10.0pt'>if</span></span>
      statement that is the body of an <span class=
      "CodeText"><span style='font-size: 10.0pt'>else</span></span>
      clause does not have a matching <span class=
      "CodeText"><span style='font-size:10.0pt'>else</span></span>
      clause.&nbsp; For example, the code,</p>
<p class="Verbatim">&nbsp;&nbsp; if (x == 0) { return "nil"; }</p>
<p class="Verbatim">&nbsp;&nbsp; else if (x == 1) { return "many";
}</p>
<p class="afterlist">results in a warning since the second
<span class="CodeText"><span style=
'font-size:10.0pt'>if</span></span> has no matching
      <span class="CodeText"><span style=
      'font-size:10.0pt'>else</span></span> branch.</p>
<h2 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974995"></a><a name="_Ref344892802">8.4<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Suspicious Statements</a></h2>
<p class="TextFontCX">Splint detects errors involving statements
with no apparent effects (Section 8.4.1) and statements that ignore
the result of a called function (Section 8.4.2).</p>
<h3 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974996"></a><a name="_Ref347247824">8.4.1<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Statements with No Effects</a></h3>
<p class="TextFontCX">Splint can report errors for statements that
have no effect.&nbsp; (Controlled by <span class=
      "Flag"><span style='font-size:10.0pt'>no-effect</span></span>.)&nbsp;&nbsp;
      Because of modifies clauses, Splint can detect more errors
      than traditional checkers.&nbsp; Unless the <span class=
      "Flag"><span style=
      'font-size:10.0pt'>no-effect-uncon</span></span>&nbsp;flag is
      on, errors are not reported for statements that involve calls
      to unconstrained functions since the unconstrained function
      may cause a modification.&nbsp; Figure 19 shows examples of
      Splint&#8217;s no effect checking.</p>
<center>
<table class="MsoNormalTable" border="0" cellspacing="0"
cellpadding="0" style=
'margin-left:5.4pt;border-collapse:collapse; margin-left:-2.25pt;margin-right:-2.25pt'>
<tr>
<td valign="top" style=
'border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX" align="center" style='text-align:center'>
<a name="_Ref344893305"></a><a name=
      "_Ref344874935"><span class="StyleKeywordBold"><span style=
      'font-size:10.0pt'>noeffect.c</span></span></a></p></td>
<td valign="top" style=
'border-top:solid black 1.5pt; border-left:none;border-bottom:none;border-right:solid black 1.5pt; background:black;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX" align="center" style='text-align:center'>
<b><span style='color:white'>Running
Splint</span></b></p></td></tr>
<tr>
<td valign="top" style=
'border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt'>
<p class="Verbatim">extern void</p>
<p class="Verbatim">&nbsp; nomodcall (int *x) /*@*/;</p>
<p class="IndentText"><i>Recall /*@*/ is shorthand for<br>
 modifies nothing and use<br>
 no globals.</i></p>
<p class="Verbatim">extern void mysterycall (int *x);</p>
<p class="Verbatim">&nbsp;</p>
<p class="Verbatim">int noeffect (int *x, int y)</p>
<p class="Verbatim">{</p>
<p class="Verbatim">&nbsp; y == *x;</p>
<p class="Verbatim">&nbsp; nomodcall (x);</p>
<p class="Verbatim">&nbsp; mysterycall (x);</p>
<p class="Verbatim">&nbsp; return *x;</p>
<p class="Verbatim">}</p></td>
<td valign="top" style=
'border-top:none;border-left: none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
<p class="lclintrun">&gt; splint noeffect.c +noeffectuncon</p>
<p class="lclintrun">noeffect.c:6: Statement has no effect: y ==
*x</p>
<p class="lclintrun">noeffect.c:7: Statement has no effect:
nomodcall(x)</p>
<p class="lclintrun">noeffect.c:8: Statement has no effect
(possible</p>
<p class="lclintrun">&nbsp;&nbsp;&nbsp; undetected modification
through call to</p>
<p class="lclintrun">&nbsp;&nbsp;&nbsp; unconstrained function
mysterycall):</p>
<p class="lclintrun">&nbsp;&nbsp;&nbsp; mysterycall(x)</p>
<p class="IndentText"><i>&nbsp;</i></p>
<p class="IndentText" style='page-break-after:avoid'><i>The warning
for line 8 would not be<br>
reported without</i> <span class="Flag"><span style=
'font-size: 10.0pt'>+noeffectuncon</span></span>.</p></td></tr></table>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
<tr>
<td valign="top" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="MsoCaption"><a name="_Ref534813977"></a><a name=
"_Toc534824623"></a><a name="_Ref534823396">Figure 19</a>.&nbsp;
Statements with No Effect</p></td></tr></table></center>
<h3 style='margin-left:0in;text-indent:0in'><a name=
"_Ref534978820"></a><a name="_Toc534974997">8.4.2<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Ignored Return Values</a></h3>
<p class="TextFontCX">Splint reports an error when a return value
is ignored.&nbsp; Checking may be controlled based on the type of
the return value: <span class="Flag"><span style=
'font-size:10.0pt'>ret-val-int</span></span> controls reporting of
ignored return values of type <span class=
      "Keyword"><span style='font-size:10.0pt'>int</span></span>,
      and <span class="Flag"><span style=
      'font-size:10.0pt'>ret-val-bool</span></span> for return
      values of type <span class="Keyword"><span style=
      'font-size:10.0pt'>bool</span></span>, and <span class=
      "Flag"><span style=
      'font-size:10.0pt'>ret-val-others</span></span>&nbsp;for all
      other types.&nbsp; A function statement may be cast to
      <span class="Keyword"><span style=
      'font-size:10.0pt'>void</span></span> to prevent this error
      from being reported.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Alternate types&nbsp;(Section 4.4) can be
used to declare functions that return values that may safely be
ignored by declaring the result type to alternately be
      <span class="Keyword"><span style=
      'font-size:10.0pt'>void</span></span>.&nbsp; Several
      functions in the standard library are specified to
      alternately return <span class="Keyword"><span style=
      'font-size:10.0pt'>void</span></span> to prevent ignored
      return value errors for standard library functions (e.g.,
      <span class="Keyword"><span style=
      'font-size:10.0pt'>strcpy</span></span>) where the result may
      be safely ignored (see Section 14.1).&nbsp; Figure 20 shows
      examples of ignored return value errors reported by
      Splint.</p>
<p class="MsoNormal" align="left" style=
'text-align:left;background:white'><span style=
'font-size:10.0pt'>&nbsp;</span></p>
<center>
<table class="MsoNormalTable" border="0" cellspacing="0"
cellpadding="0" style='margin-left:9.9pt;border-collapse:collapse'>
<tr>
<td valign="top" style=
'border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX" align="center" style='text-align:center'>
<span class="Keyword"><b><span style=
'font-size:10.0pt; color:white'>ignore.c</span></b></span></p></td>
<td valign="top" style=
'border-top:solid black 1.5pt; border-left:none;border-bottom:none;border-right:solid black 1.5pt; background:black;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX" align="center" style='text-align:center'>
<b><span style='color:white'>Running
Splint</span></b></p></td></tr>
<tr>
<td valign="top" style=
'border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt'>
<p class="Verbatim"># include &#8220;bool.h&#8221;</p>
<p class="Verbatim">extern int fi (void);</p>
<p class="Verbatim">extern bool fb (void);</p>
<p class="Verbatim">extern int /*@alt void@*/</p>
<p class="Verbatim">&nbsp; fv (void);</p>
<p class="Verbatim">&nbsp;</p>
<p class="Verbatim">int ignore (void)</p>
<p class="Verbatim">{</p>
<p class="Verbatim"><span class="Line"><span style=
'font-size:8.0pt'>&nbsp; 8</span></span>&nbsp; fi ();</p>
<p class="Verbatim"><span class="Line"><span style=
'font-size:8.0pt'>&nbsp; 9</span></span>&nbsp; (void) fi ();</p>
<p class="Verbatim"><span class="Line"><span style=
'font-size:8.0pt'>10</span></span>&nbsp; fb ();</p>
<p class="Verbatim"><span class="Line"><span style=
'font-size:8.0pt'>11</span></span>&nbsp; fv ();</p>
<p class="Verbatim"><span class="Line"><span style=
'font-size:8.0pt'>12</span></span>&nbsp; return fv ();</p>
<p class="Verbatim">}</p></td>
<td valign="top" style=
'border-top:none;border-left: none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
<p class="lclintrun">&gt; splint ignore.c</p>
<p class="lclintrun">&nbsp;</p>
<p class="lclintrun">ignore.c:8: Return value (type int) ignored:
fi()</p>
<p class="lclintrun">ignore.c:10: Return value (type bool) ignored:
fb()</p>
<p class="lclintrun">&nbsp;</p>
<p class="MsoNormal" style='background:white'><i><span style=
'font-size:10.0pt'>The message for line 8 would not be reported
if</span></i> <span class="Flag"><span style=
'font-size:10.0pt'>&#8209;retvalint</span></span><i><span style='font-size:10.0pt'>
is set;<br>
 for line 10, if</span></i> <span class="Flag"><span style=
'font-size:10.0pt'>&#8209;retvalbool</span></span><i><span style='font-size:10.0pt'>
is set.</span></i></p>
<p class="MsoNormal" style='background:white'><i><span style=
'font-size:10.0pt'>&nbsp;</span></i></p>
<p class="MsoNormal" style='background:white'><i><span style=
'font-size:10.0pt'>&nbsp;No message is reported for line 9 because
the result is cast to</span></i> <span class=
      "CodeText"><span style='font-size:10.0pt'>void</span></span><i><span style='font-size:10.0pt'>
,<br>
 and no message is reported for line 11 because</span></i>
<span class="CodeText"><span style=
'font-size:10.0pt'>fv</span></span><i><span style=
'font-size:10.0pt'>is declared<br>
 to alternately return</span></i> <span class=
"CodeText"><span style=
'font-size:10.0pt'>void</span></span><i><span style=
'font-size:10.0pt'>.</span></i></p>
<p class="TextFontCX" style='page-break-after: avoid'>
&nbsp;</p></td></tr></table>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
<tr>
<td valign="top" style=
'padding-top:0in;padding-right: 9.0pt;padding-bottom:0in;padding-left:9.0pt'>
<p class="MsoCaption"><a name="_Toc534824624"></a><a name=
"_Ref534823436">Figure 20</a>.&nbsp; Ignored Return
Values</p></td></tr></table></div></center>
<p class="MsoNormal" align="left" style=
'text-align:left;background:white'><span style=
'font-size:10.0pt'>&nbsp;</span></p>
<b><span style=
'font-size:16.0pt;font-family:"Times New Roman"'><br clear="all"
style='page-break-before:always'></span></b> 
<h1 style='margin-left:0in;text-indent:0in;page-break-before:auto'>
<a name="_Toc534974998"></a><a name="_Ref534963019"></a><a name=
"_Ref534962975">9<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
<a id="buffer" name="buffer">
Buffer Sizes</a></a></h1>
<p class="TextFontCX">Buffer overflow errors are a particularly
dangerous type of bug in C programs.&nbsp; They are directly
responsible for about half of all security attacks
[Larochelle01].&nbsp; For performance reasons, C does not perform
run time bounds checking.&nbsp; Referencing storage outside
allocated regions can cause memory corruption and lead to strange
behavior.&nbsp; Moreover, buffer overflow bugs are particularly
insidious because they can go undetected in testing or normal use,
but usually result in security critical bugs.&nbsp; Reads beyond
the end of a buffer can cause the program to leak
information.&nbsp; Writes beyond the end a buffer (buffer
overflows) can usually be exploited make the program run arbitrary
code.&nbsp; Attackers can exploit these programming bugs to replace
the return address on the stack and place arbitrary code in memory
thereby gaining full access to the machine.&nbsp; Splint is able to
detect many memory bounds errors. <a href="#_ftn12" name=
"_ftnref12" title=""><span style=
'font-size:11.0pt; font-family:"Times New Roman"'>[12]</span></a>&nbsp;</p>
<h2 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534974999">9.1<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Checking Accesses</a></h2>
<p class="TextFontCX">Splint models blocks of contiguous memory
using two properties: <span class="Annot"><span style=
'font-size:10.0pt'>maxSet</span></span> and <span class=
"Annot"><span style='font-size:10.0pt'>maxRead</span></span>.&nbsp;
Given a buffer <span class="CodeText"><i><span style=
'font-size:10.0pt'>b</span></i></span>, <span class=
"Annot"><span style=
'font-size:10.0pt'>maxSet(<i>b</i>)</span></span> denotes the
highest address beyond <span class="CodeText"><i><span style=
'font-size:10.0pt'>b</span></i></span> that can be safely used as
an lvalue. &nbsp;For the declaration <span class=
"CodeText"><span style='font-size:10.0pt'>char
buf[MAXSIZE]</span></span> we have <span class=
      "Annot"><span style='font-size: 10.0pt'>maxSet(buf)</span></span>
      <span class="CodeText"><span style='font-size: 10.0pt'>=
      MAXSIZE - 1</span></span>. &nbsp;Similarly, <span class=
      "Annot"><span style='font-size:10.0pt'>maxRead</span></span>
      denotes the highest index of a buffer that can be safely used
      an rvalue.&nbsp; It is inappropriate to read an uninitialized
      element or beyond the <span class="CodeText"><span style=
      'font-size:10.0pt'>NUL</span></span> terminator of a null
      terminated buffer.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">When a buffer is accessed as an lvalue,
Splint generates a precondition constraint involving the
<span class="Annot"><span style=
'font-size:10.0pt'>maxSet</span></span> property.&nbsp; When a
buffer is accessed as an rvalue, Splint generates a precondition
constraint involving the <span class="Annot"><span style=
'font-size:10.0pt'>maxRead</span></span> property.&nbsp; For the
expression <span class="CodeText"><span style=
'font-size:10.0pt'>*<i>ptr</i></span></span>, Splint generates the
constraints <span class="Annot"><span style=
'font-size:10.0pt'>maxSet(<i>ptr</i>)</span></span>
      <span class="CodeText"><span style='font-size:10.0pt'>&gt;=
      0</span></span> or <span class="Annot"><span style=
      'font-size:10.0pt'>maxRead(<i>ptr</i>)</span></span>
      <span class="CodeText"><span style='font-size:10.0pt'>&gt;=
      0</span></span> depending on whether <span class=
      "CodeText"><i><span style=
      'font-size:10.0pt'>ptr</span></i></span> is used as an lvalue
      or rvalue.&nbsp; Similarly, for accesses of the form
      <span class="CodeText"><span style=
      'font-size:10.0pt'>ptr[i]</span></span>, splint generates the
      constraints <span class="Annot"><span style=
      'font-size:10.0pt'>maxSet(<i>ptr</i>)</span></span>
      <span class="CodeText"><span style='font-size:10.0pt'>&gt;=
      i</span></span> or <span class="Annot"><span style=
      'font-size:10.0pt'>maxRead(<i>ptr</i>)</span></span>
      <span class="CodeText"><span style='font-size:10.0pt'>&gt;=
      i</span></span>.&nbsp; If <span class="Flag"><span style=
      'font-size:10.0pt'>+boundswrite</span></span> is set, Splint
      warns if it is unable to resolve a constraint involving
      <span class="Annot"><span style=
      'font-size:10.0pt'>maxSet</span></span>. If <span class=
      "Flag"><span style=
      'font-size:10.0pt'>+boundsread</span></span> is set, Splint
      warns about unresolved <span class="Annot"><span style=
      'font-size:10.0pt'>maxRead</span></span> constraints
      also.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Splint generates postconditions for
statements to help resolve precondition constraints.&nbsp; When a
buffer is written to we know that an element of a buffer is
initialized and is safe to read.&nbsp; We generate the
postcondition <span class="Annot"><span style=
'font-size:10.0pt'>maxRead(<i>ptr</i>)</span></span>
      <span class="CodeText"><span style='font-size:10.0pt'>&gt;=
      0</span></span> if the buffer is accessed using <span class=
      "CodeText"><span style='font-size:10.0pt'>*ptr</span></span>
      or <span class="Annot"><span style=
      'font-size:10.0pt'>maxRead(ptr)</span></span> <span class=
      "CodeText"><span style='font-size:10.0pt'>&gt;=
      i</span></span> if the buffer is accessed using <span class=
      "CodeText"><i><span style=
      'font-size:10.0pt'>ptr</span></i></span><span class=
      "CodeText"><span style=
      'font-size:10.0pt'>[<i>i</i>]</span></span>.&nbsp; Splint
      generates additional postconditions for a variety of C
      constructs.&nbsp; For assignment statements, Splint generates
      a postcondition equating the two operands.&nbsp; Splint also
      generates post condition constraints for the <span class=
      "Annot"><span style='font-size:10.0pt'>maxSet</span></span>
      value of fixed sized arrays.</p>
<h2 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534975000">9.2<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Annotating Buffer Sizes</a></h2>
<p class="TextFontCX">Function declarations may include
      <span class="Annot"><span style=
      'font-size:10.0pt'>requires</span></span> and <span class=
      "Annot"><span style='font-size:10.0pt'>ensures</span></span>
      clauses that specify assumptions about buffer sizes for
      function preconditions.&nbsp; They are interpreted like
      <span class="Annot"><span style=
      'font-size:10.0pt'>requires</span></span> and <span class=
      "Annot"><span style='font-size:10.0pt'>ensures</span></span>
      clauses for simple memory states (see Section 7.5) but can be
      more expressive.&nbsp; When a function with a <span class=
      "Annot"><span style='font-size:10.0pt'>requires</span></span>
      clause is called, the call site must be checked to satisfy
      the constraints implied by the <span class=
      "Annot"><span style='font-size:10.0pt'>requires</span></span>
      clause.&nbsp; Similarly, an <span class="Annot"><span style=
      'font-size:10.0pt'>ensures</span></span> clause can be used
      to specify function post conditions.&nbsp; If the
      <span class="Flag"><span style=
      'font-size:10.0pt'>+checkpost</span></span> flag is set,
      Splint warns if it cannot verify that a function
      implementation satisfies its declared postconditions.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Constraints can contain function parameters
as well as global variables and integer constants. The unary
operators, <span class="Annot"><span style=
'font-size:10.0pt'>maxSet</span></span> and <span class=
"Annot"><span style='font-size:10.0pt'>maxRead</span></span> which
correspond to the properties described above are also supported.
&nbsp;Multiple predicates may be conjoined using <span class=
"CodeText"><span style=
'font-size: 10.0pt'>/\</span></span>.&nbsp;</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">For example, the standard library annotates
<span class="CodeText"><span style=
'font-size:10.0pt'>strcpy</span></span>:</p>
<p class="MsoPlainText" style='line-height:normal'>&nbsp;</p>
<p class="Verbatim" style='margin-left:22.5pt'>void /*@alt char *
@*/strcpy</p>
<p class="Verbatim" style='margin-left:22.5pt;text-indent:13.5pt'>
(/*@unique@*/ /*@out@*/ /*@returned@*/ char *s1, char *s2)</p>
<p class="Verbatim" style='margin-left:.5in'>/*@modifies *s1@*/</p>
<p class="Verbatim" style='margin-left:.5in'>/*@requires maxSet(s1)
&gt;= maxRead(s2) @*/</p>
<p class="Verbatim">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; /*@ensures
maxRead(s1) == maxRead (s2) @*/;&nbsp;&nbsp;&nbsp;&nbsp;</p>
<p class="MsoPlainText" style=
'margin-left:.5in;line-height:normal'><b>&nbsp;</b></p>
<p class="MsoPlainText" style=
'text-align:justify;line-height:normal'>The <span class=
"Annot"><span style='font-size:10.0pt'>requires</span></span>
clause indicates that the buffer passed as <span class=
"CodeText"><span style='font-size:10.0pt'>s1</span></span> must be
large enough to hold the string passed as <span class=
"CodeText"><span style='font-size:10.0pt'>s2</span></span>.&nbsp;
The <span class="Annot"><span style=
'font-size:10.0pt'>ensures</span></span> clause specifies that
<span class="Annot"><span style=
'font-size:10.0pt'>maxRead</span></span> of <span class=
"CodeText"><span style='font-size:10.0pt'>s1</span></span> after
the call is equal to <span class="Annot"><span style=
'font-size:10.0pt'>maxRead</span></span> of <span class=
"CodeText"><span style='font-size:10.0pt'>s2</span></span>.&nbsp;
In cases where the size of <span class=
      "CodeText"><span style='font-size:10.0pt'>s2</span></span> is
      unknown, programs should use <span class=
      "CodeText"><span style=
      'font-size: 10.0pt'>strncpy</span></span>, annotated as:</p>
<p class="Verbatim">&nbsp;</p>
<p class="Verbatim" style='margin-left:22.5pt'>void /*@alt char *
@*/ strncpy</p>
<p class="Verbatim" style='margin-left:22.5pt'>&nbsp;&nbsp;
(/*@unique@*/ /*@out@*/ /*@returned@*/ char *s1, char *s2,</p>
<p class="Verbatim" style='margin-left:22.5pt;text-indent:13.5pt'>
&nbsp; size_t n)</p>
<p class="Verbatim" style='margin-left:22.5pt'>
&nbsp;&nbsp;/*@modifies *s1@*/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</p>
<p class="Verbatim" style='margin-left:22.5pt'>&nbsp; /*@requires
maxSet(s1) &gt;= ( n - 1 ); @*/</p>
<p class="Verbatim" style='margin-left:22.5pt'>&nbsp; /*@ensures
maxRead (s2) &gt;= maxRead(s1) /\ maxRead (s1) &lt;= n;@*/;</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">The syntax for buffer size constraint clauses
is:</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX" align="left" style=
'margin-left: 22.5pt;text-align:left'><i><span lang=
"FR">constraint</span></i> <span lang="FR">&nbsp;</span>
<span style='font-family:Symbol'>&#222;</span> <span lang=
"FR">(</span><span class="Annot"><span style=
'font-size:10.0pt'>requires</span></span> <span lang="FR">|</span>
<span class="Annot"><span style=
'font-size:10.0pt'>ensures</span></span><span lang="FR">)
<i>consExpr relOp consExpr</i></span></p>
<p class="TextFontCX" align="left" style=
'margin-left: 22.5pt;text-align:left'><i><span lang=
"FR">relOp</span></i> <span lang=
"FR">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span> <span style=
'font-family:Symbol'>&#222;</span> <span class=
      "Annot"><span style='font-size: 10.0pt'>==</span></span>
      <span lang="FR">|</span> <span class="Annot"><span style=
      'font-size:10.0pt'>&gt;</span></span> <span lang=
      "FR">|</span> <span class="Annot"><span style=
      'font-size:10.0pt'>&gt;=</span></span> <span lang=
      "FR">|</span> <span class="Annot"><span style=
      'font-size:10.0pt'>&lt;</span></span> <span lang=
      "FR">|</span> <span class="Annot"><span style=
      'font-size:10.0pt'>&lt;=</span></span></p>
<p class="TextFontCX" align="left" style=
'margin-left: 22.5pt;text-align:left'><i><span lang=
"FR">consExpr&nbsp;</span></i> <span style=
'font-family:Symbol'>&#222;</span> <i><span lang=
"FR">consExpression binOp consExpr</span></i> | <i>unaryOp</i>
<span class="Annot"><span style=
'font-size:10.0pt'>(</span></span><i>consExpr</i>
      <span class="Annot"><span style=
      'font-size:10.0pt'>)</span></span> | <i>term</i></p>
<p class="TextFontCX" align="left" style=
'margin-left: 22.5pt;text-align:left'><i>binOp</i>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <span style=
'font-family:Symbol'>&#222;</span> <span class=
      "Annot"><span style='font-size:10.0pt'>+</span></span> |
      <span class="Annot"><span style=
      'font-size:10.0pt'>-</span></span></p>
<p class="TextFontCX" align="left" style=
'margin-left: 22.5pt;text-align:left'><i>unaryOp</i> &nbsp;
<span style='font-family:Symbol'>&#222;</span> <span class=
"Annot"><span style='font-size:10.0pt'>maxSet</span></span> |
<span class="Annot"><span style=
'font-size:10.0pt'>maxRead</span></span></p>
<p class="TextFontCX" align="left" style=
'margin-left: 22.5pt;text-align:left'><i>term</i>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <span style=
'font-family:Symbol'>&#222;</span> <i>identifier</i> |
<i>literal</i> | <span class="Annot"><span style=
'font-size: 10.0pt'>result</span></span></p>
<h2 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534975001">9.3<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Less Stringent Checking</a></h2>
<p class="TextFontCX">
For some programs, Splint's standard bounds checking produces an
unacceptably high number of warnings. Because of this, Splint now
prioritizes warnings using a simple heuristic. The flags
<span class="Flag"><span style=
'font-size:10.0pt'>likely-bounds</span></span>, <span class=
"Flag"><span style=
'font-size:10.0pt'>likely-bounds-writes</span></span>, and
<span class="Flag"><span style=
'font-size:10.0pt'>likely-bounds-read</span></span> are similar to
<span class="Flag"><span style=
'font-size:10.0pt'>bounds</span></span>,<span class=
"Flag"><span style='font-size:10.0pt'>bounds-write</span></span>,
and <span class="Flag"><span style=
'font-size:10.0pt'>bounds-read</span></span>, but they only cause
Splint to produce warnings for what it determines are likely bounds
errors. Splint classifies an unresolved constraint as a likely
bounds error if it can reduce the constraint to a numerical
inconsistency such as <span class="Verbatim">5 &gt;= 10</span>.
Warnings for these constraints are more likely to be legitimate --
indicating real bugs or the lack of annotations. Additionally, when
these warnings are false positives, it is easier for humans to
recognize them as spurious. These flags generate significantly
fewer errors (an order of magnitude in some cases), and the errors
generated are easier to understand. However, this does not come
without cost. The checking is significantly less precise and is
likely to miss real errors.</p>
<h2 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534975001">9.4<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Warnings</a></h2>
<p class="TextFontCX">Since bounds checking is more complex than
other checks done by Splint, memory bounds warnings contain
extensive information about the unresolved constraint.&nbsp;
Warning messages for unresolved constraints contain both the
original constraints and the simplified form of the constraint
which cannot be resolved.&nbsp; If the constraint was derived from
a function precondition, the original precondition is included in
the error message.&nbsp; If the <span class=
      "Flag"><span style='font-size:10.0pt'>+showconstraintlocation</span></span>
      flag is set, the message includes the expression that the
      constraint is derived from.&nbsp; The <span class=
      "Flag"><span style=
      'font-size:10.0pt'>+showconstraintparens</span></span> flag
      directs Splint to display fully parenthesized constraints in
      warnings to remove ambiguity.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Consider the code excerpt below containing a
trivial out-of-bounds write:</p>
<p class="Verbatim">&nbsp;</p>
<p class="Verbatim" style='text-indent:.5in'>int buf[10];</p>
<p class="Verbatim" style='text-indent:.5in'>buf[10] = 3;</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX" style='margin-bottom:6.0pt'>Splint warns:</p>
<p align="left" class="lclintrun" style='margin-left:.5in'>
setChar.c:5:4: Likely out-of-bounds store:<br>
&nbsp;&nbsp;&nbsp; buf[10] = 3</p>
<p class="lclintrun" align="left" style='margin-left:.5in'>
&nbsp;&nbsp;&nbsp; Unable to resolve constraint: requires 9 &gt;=
10</p>
<p class="lclintrun" align="left" style=
'margin-top:0in;margin-right:0in;margin-bottom:6.0pt; margin-left:.5in'>
&nbsp;&nbsp;&nbsp; needed to satisfy precondition: requires
maxSet(buf @ setChar.c:5:4) &gt;= 10</p>
<p class="TextFontCX">Splint has simplified the constraint from the
<span class="Annot"><span style=
'font-size:10.0pt'>requires</span></span> clause to
      <span class="CodeText"><span style='font-size:10.0pt'>9 &gt;=
      10</span></span> by substituting for the known value of
      <span class="Annot"><span style=
      'font-size:10.0pt'>maxSet(buf)</span></span> and generated a
      warning because 9(the highest index of <span class=
      "CodeText"><span style='font-size:10.0pt'>buf</span></span>
      that may be safely written to) is not greater than or equal
      to 10.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">A more realistic example is shown Figure
21.&nbsp; The function <span class="CodeText"><span style=
'font-size:10.0pt'>updateEnv</span></span> is a na&#239;ve
implementation of a function to copy an environmental
variable.&nbsp; There is no standard restriction on the length of
the return value of <span class="CodeText"><span style=
'font-size:10.0pt'>getenv</span></span> so this can cause a buffer
overflow.&nbsp; A safe version of <span class=
"CodeText"><span style='font-size:10.0pt'>updateEnv</span></span>
(such as <span class="CodeText"><span style=
'font-size:10.0pt'>updateEnvSafe</span></span> in Figure 21) would
ensure that the buffer is large enough to hold the environment
variable string before copying.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">The <span class="Annot"><span style=
'font-size:10.0pt'>requires</span></span> clause means Splint will
report a warning if a call to <span class=
      "CodeText"><span style='font-size:10.0pt'>updateEnvSafe</span></span>
      passed in a buffer as <span class="CodeText"><span style=
      'font-size:10.0pt'>str</span></span> that is not big enough
      to hold the value passed as <span class=
      "CodeText"><span style=
      'font-size:10.0pt'>strSize</span></span> characters.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">In many cases, functions will have multiple
unresolved constraints which are similar.&nbsp; For example, if a
subsequence statement writes to the next element of a buffer.&nbsp;
Usually all these constraints represent all real problems or are
all spurious.&nbsp; If the <span class="Flag"><span style=
'font-size:10.0pt'>+redundantconstraints</span></span> flag is set,
Splint reports even apparently redundant warning messages.&nbsp;
Otherwise, if satisfying one unresolved constraint would imply
satisfying another, Splint only prints a warning message for the
stronger constraint.</p>
<p class="TextFontCX">&nbsp;</p>
<center>
<table class="MsoNormalTable" border="0" cellspacing="0"
cellpadding="0" style='margin-left:9.9pt;border-collapse:collapse'>
<tr>
<td valign="top" style=
'width:202.5pt;border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt;height:12.15pt'>
<p class="TextFontCX" align="center" style='text-align:center'>
<span class="Keyword"><b><span style=
'font-size:10.0pt; color:white'>bounds.c</span></b></span></p></td>
<td valign="top" style=
'width:3.0in;border-top:solid black 1.5pt; border-left:none;border-bottom:none;border-right:solid black 1.5pt; background:black;padding:0in 5.4pt 0in 5.4pt;height:12.15pt'>
<p class="TextFontCX" align="center" style='text-align:center'>
<b><span style='color:white'>Running
Splint</span></b></p></td></tr>
<tr>
<td valign="top" style=
'width:202.5pt;border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt'>
<p class="Verbatim"><span style=
'font-family:Courier'>&nbsp;</span></p>
<p class="Verbatim"><span style='font-family:Courier'>void
updateEnv(char * str)</span></p>
<p class="Verbatim"><span style='font-family:Courier'>{</span></p>
<p class="Verbatim"><span style='font-family:Courier'>&nbsp;&nbsp;
char * tmp;</span></p>
<p class="Verbatim"><i><span style=
'font-size:9.0pt;font-family:Courier'>7</span></i><span style='font-family:Courier'>
&nbsp; tmp = getenv(&#8220;MYENV&#8221;);</span></p>
<p class="Verbatim"><span style='font-family:Courier'>&nbsp;&nbsp;
if (tmp != NULL)</span></p>
<p class="Verbatim"><i><span style=
'font-size:9.0pt;font-family:Courier'>9</span></i><span style='font-family:Courier'>
&nbsp;&nbsp;&nbsp;&nbsp; strcpy (str, tmp);</span></p>
<p class="Verbatim"><span style='font-family:Courier'>}</span></p>
<p class="Verbatim"><span style=
'font-family:Courier'>&nbsp;</span></p>
<p class="Verbatim"><span style='font-family:Courier'>void
updateEnvSafe (char * str,</span></p>
<p class="Verbatim"><span style=
'font-family:Courier'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
size_t strSize)</span></p>
<p class="Verbatim"><span style='font-family:Courier'>&nbsp;</span>
<a href="mailto:/*@requires"><span style=
'font-family:Courier'>/*@requires</span></a> <span style=
'font-family:Courier'>maxSet(str)</span></p>
<p class="Verbatim"><span style=
'font-family:Courier'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
&gt;= strSize &#8211;1@*/</span></p>
<p class="Verbatim"><span style='font-family:Courier'>{</span></p>
<p class="Verbatim"><span style='font-family:Courier'>&nbsp;&nbsp;
char * tmp;</span></p>
<p class="Verbatim"><span style='font-family:Courier'>&nbsp;&nbsp;
tmp = getenv(&#8220;MYENV&#8221;);</span></p>
<p class="Verbatim"><span style='font-family:Courier'>&nbsp;&nbsp;
if (tmp != NULL)</span></p>
<p class="Verbatim"><span style='font-family:Courier'>&nbsp;&nbsp;
{</span></p>
<p class="Verbatim"><span style=
'font-family:Courier'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; strncpy (str,
tmp,</span></p>
<p class="Verbatim"><span style=
'font-family:Courier'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
strSize -1);</span></p>
<p class="Verbatim"><span style=
'font-family:Courier'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; str[strSize
-1] = &#8216;/0&#8217;;</span></p>
<p class="Verbatim"><span style='font-family:Courier'>&nbsp;&nbsp;
}</span></p>
<p class="Verbatim"><span style=
'font-family:Courier'>}</span></p></td>
<td valign="top" style=
'width:3.0in;border-top:none;border-left:none; border-bottom:solid black 1.5pt;border-right:solid black 1.5pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="lclintrun">&gt; splint bounds.c +bounds
+showconstraintlocation</p>
<p class="lclintrun">&nbsp;</p>
<p class="lclintrun">bounds.c:9: Possible out-of-bounds store:</p>
<p class="lclintrun">&nbsp;&nbsp;&nbsp; strcpy(str, tmp)</p>
<p class="lclintrun">&nbsp;&nbsp;&nbsp; Unable to resolve
constraint:</p>
<p class="lclintrun">&nbsp;&nbsp;&nbsp; requires maxSet(str @
bounds.c:9) &gt;=</p>
<p class="lclintrun">&nbsp;&nbsp;&nbsp; maxRead(getenv("MYENV") @
bounds.c:7)</p>
<p class="lclintrun">&nbsp;&nbsp;&nbsp;&nbsp; needed to satisfy
precondition:</p>
<p class="lclintrun">&nbsp;&nbsp;&nbsp; requires maxSet(str @
bounds.c:9) &gt;=</p>
<p class="lclintrun">&nbsp;&nbsp;&nbsp; maxRead(tmp @
bounds.c:9)</p>
<p class="lclintrun">&nbsp;&nbsp;&nbsp;&nbsp; derived from strcpy
precondition: requires</p>
<p class="lclintrun">&nbsp;&nbsp;&nbsp; maxSet(&lt;parameter 1&gt;)
&gt;=</p>
<p class="lclintrun">&nbsp;&nbsp;&nbsp; maxRead(&lt;parameter
2&gt;)</p></td></tr></table>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
<tr>
<td valign="top" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="MsoCaption"><a name="_Ref534909813"></a><a name=
"_Ref534909817">Figure 21</a>.&nbsp; Memory
Bounds</p></td></tr></table></center>
<br clear="all">
 
<p class="TextFontCX">The <span class="Flag"><span style=
'font-size:10.0pt'>+functionpost</span></span> flag is useful for
determining if array bounds warnings are spurious.&nbsp; If this
flag is set, Splint will print the constraints that it established
at the end of the function.&nbsp; If the warnings are spurious,
localized control comments can be used to suppress them.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">&nbsp;</p>
<h1 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534975002"></a><a name="_Ref534642928"></a><a name=
"_Ref534642285">10<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
<a id="extensible" name="extensible">
Extensible Checking</a></a></h1>
<p class="TextFontCX">Splint provides mechanisms for defining new
checks and annotations using metastate definitions.&nbsp;
User-defined checks can be used to check and document properties
not supported by the provided checks.<a href="#_ftn13" name=
"_ftnref13" title=""><span class=
      "MsoFootnoteReference"><span class="MsoFootnoteReference"><span style='font-size:11.0pt;font-family:"Times New Roman"'>
[13]</span></span></span></a></p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">A large class of useful checks can be
described as constraints on attributes associated with program
objects or the global execution state. Unlike types, however, the
values of these attributes can change along an execution
path.&nbsp; Splint provides a general language that lets users
define attributes associated with different kinds of program
objects as well as rules that both constrain attributes&#8217;
values at interface points and specify how attributes
change.&nbsp;</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Because user-defined attribute checking is
integrated with normal checking, Splint&#8217;s analysis of
user-defined attributes can take advantage of other analyses, such
as alias and nullness analysis.</p>
<h2 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534975003">10.1<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Defining Attributes</a></h2>
<p class="TextFontCX">To define an attribute, create a metastate
file (<span class="ProgramNameChar"><span style=
'font-size: 10.0pt'>.mts</span></span>) that defined the possible
values and transfer rules of the attribute.&nbsp; Attributes can
either be associated with a particular kind of program object (for
example, all <span class="CodeText"><span style=
'font-size:10.0pt'>char *</span></span>&#8217;s) or with the global
state (whether or not the network has been initialized).&nbsp; The
<span class="Flag"><span style='font-size:10.0pt'>&#8211;mts
<i>&lt;file&gt;</i></span></span> flag is used to direct Splint to
read a metastate file (which will be found on the
      <span class="CodeText"><span style=
      'font-size:10.0pt'>LARCH_PATH</span></span> with default
      extension <span class="ProgramNameChar"><span style=
      'font-size:10.0pt'>.mts</span></span>).</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">An example attribute definition is shown in
Figure 22.&nbsp; It defines the <span class=
      "Annot"><span style='font-size:10.0pt'>taintedness</span></span>
      attribute for recording whether or not a <span class=
      "CodeText"><span style='font-size: 10.0pt'>char
      *</span></span> came from a possibly untrustworthy
      source.&nbsp; Knowing whether a value is possibly hostile is
      useful for preventing several security vulnerabilities
      including format string bugs.<a href="#_ftn14" name=
      "_ftnref14" title=""><span class=
      "MsoFootnoteReference"><span class=
      "MsoFootnoteReference"><span style=
      'font-size:11.0pt;font-family:"Times New Roman"'>[14]</span></span></span></a>&nbsp;
      (A simpler way to detect format vulnerabilities is to warn
      for any format string that is unknown at compile time. Splint
      provides this checking, issuing a warning if the <span class=
      "Flag"><span style=
      'font-size:10.0pt'>+formatconst</span></span> flag is set and
      finds any unknown format strings at compile time. This can
      produce spurious messages, however, because there might be
      unknown format strings that are not vulnerable to hostile
      input.)</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">The first three lines of the attribute
definition define the <span class="Annot"><span style=
'font-size:10.0pt'>taintedness</span></span> attribute associated
with <span class="CodeText"><span style='font-size:10.0pt'>char
*</span></span> objects, which can be in one of two states:
<span class="Annot"><span style=
'font-size:10.0pt'>untainted</span></span> or <span class=
"Annot"><span style='font-size:10.0pt'>tainted</span></span>.&nbsp;
The <span class="Annot"><span style=
'font-size:10.0pt'>context</span></span> clause gives a context
selector for which objects have the attribute. &nbsp;&nbsp;In this
case, <span class="Annot"><span style='font-size:10.0pt'>reference
char *</span></span> means that every reference that is a
<span class="CodeText"><span style='font-size:10.0pt'>char
*</span></span> has an associated <span class=
      "Annot"><span style='font-size:10.0pt'>taintedness</span></span>
      attribute.&nbsp; Other contexts include <span class=
      "Annot"><span style=
      'font-size: 10.0pt'>parameter</span></span> (only parameter
      declarations), <span class="Annot"><span style=
      'font-size:10.0pt'>literal</span></span> (only string or
      number literals), and <span class="Annot"><span style=
      'font-size:10.0pt'>null</span></span> (only known
      <span class="CodeText"><span style=
      'font-size:10.0pt'>NULL</span></span> values).&nbsp;
      Attribute can also be defined that are not associated with
      any particular object, but instead are associated with the
      global state of a program execution.&nbsp; The <span class=
      "Annot"><span style='font-size:10.0pt'>global</span></span>
      keyword is used before <span class="Annot"><span style=
      'font-size:10.0pt'>attribute</span></span> to define a global
      attribute.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">The <span class="Annot"><span style=
'font-size:10.0pt'>oneof</span></span> clause introduces two
identifiers for representing the <span class=
      "Annot"><span style='font-size:10.0pt'>taintedness</span></span>
      value: <span class="Annot"><span style=
      'font-size:10.0pt'>untainted</span></span> for references
      that are not derived from untrustworthy input, and
      <span class="Annot"><span style=
      'font-size:10.0pt'>tainted</span></span> for references that
      may contain hostile data.&nbsp;</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">The <span class="Annot"><span style=
'font-size:10.0pt'>annotations</span></span> clause defines two new
annotations that may be used to describe <span class=
"Annot"><span style='font-size:10.0pt'>taintedness</span></span>
assumptions.&nbsp; In this case, the annotations match the names of
the value choices, but they may be any identifier.&nbsp; The clause
<span class="Annot"><span style='font-size:10.0pt'>tainted
<b>reference ==&gt;</b> tainted</span></span> defines the
<span class="Annot"><span style=
'font-size:10.0pt'>tainted</span></span> annotation that may be
used on a reference to indicate that it has <span class=
"Annot"><span style='font-size: 10.0pt'>tainted</span></span>
state.&nbsp;</p>
<center>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
<tr>
<td valign="top" align="left" height="264" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="Verbatim"><span class="Annot"><b>attribute</b></span>
<span class="Annot">taintedness</span></p>
<p class="Verbatim"><span class="Annot">&nbsp;&nbsp; <b>context</b>
<b>reference</b> char *</span></p>
<p class="Verbatim"><span class="Annot">&nbsp;&nbsp; <b>oneof</b>
untainted, tainted</span></p>
<p class="Verbatim"><span class="Annot">&nbsp;&nbsp;
<b>annotations</b></span></p>
<p class="Verbatim"><span class="Annot">&nbsp;&nbsp;&nbsp;&nbsp;
tainted <b>reference ==&gt;</b> tainted</span></p>
<p class="Verbatim"><span class="Annot">&nbsp;&nbsp;&nbsp;&nbsp;
untainted <b>reference ==&gt;</b> untainted</span></p>
<p class="Verbatim"><span class="Annot">&nbsp;&nbsp;
<b>transfers</b></span></p>
<p class="Verbatim"><span class="Annot">&nbsp;&nbsp;&nbsp;&nbsp;
tainted <b>as</b> untainted <b>==&gt; error</b> "Possibly tainted
storage used where untainted required."</span></p>
<p class="Verbatim"><span class="Annot">&nbsp;&nbsp;
<b>merge</b></span></p>
<p class="Verbatim"><span class=
"Annot">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; tainted <b>+</b> untainted
<b>==&gt;</b> tainted</span></p>
<p class="Verbatim"><span class="Annot">&nbsp;&nbsp;
<b>defaults</b></span></p>
<p class="Verbatim"><span class=
"Annot">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; reference <b>==&gt;</b>
tainted</span></p>
<p class="Verbatim"><span class="Annot">&nbsp;
&nbsp;&nbsp;&nbsp;&nbsp;literal <b>==&gt;</b> untainted</span></p>
<p class="Verbatim"><span class=
"Annot">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; null <b>==&gt;</b>
untainted</span></p>
<p class="Verbatim"><span class="Annot"><b>end</b></span></p>
<p class="MsoCaption"><a name="_Ref534921559">Figure 22</a>.&nbsp;
Taintedness Attribute</p></td></tr></table></center>
<br clear="all">
 
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">The <span class="Annot"><span style=
'font-size:10.0pt'>transfers</span></span> clause defines rules for
state changes and warning when objects are passed as parameters,
returned, or assigned to externally visible references.&nbsp; The
rule, <span class="Annot"><span style='font-size:10.0pt'>tainted
<b>as</b> untainted <b>==&gt; error</b> "Possibly tainted storage
used where untainted required."</span></span>, means it is an error
to pass a <span class="Annot"><span style=
'font-size:10.0pt'>tainted</span></span> value as a parameter that
has <span class="Annot"><span style=
'font-size:10.0pt'>untainted</span></span> taintedness.&nbsp; All
other transfers are implicitly permitted, and leave the passed
storage in the same state as before the transfer.&nbsp; We may also
use a <span class="Annot"><span style=
'font-size:10.0pt'>transfers</span></span> clause to indicate that
the reference changes state after a transfer.&nbsp; A
      <span class="Annot"><span style=
      'font-size:10.0pt'>losereference</span></span> clause (not
      used in taintedness) is similar to a <span class=
      "Annot"><span style=
      'font-size:10.0pt'>transfers</span></span> clause, except it
      is used to provide rules for when a reference to storage is
      lost, either by leaving the scope in which it was declared,
      returning from a function, or assigning it to a new
      value.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">The <span class="Annot"><span style=
'font-size:10.0pt'>merge</span></span> clause defined rules for
combining state along paths.&nbsp; The clause<span class=
"Annot"><span style='font-size:10.0pt'>merge tainted + untainted
==&gt; tainted</span></span> indicates that combining
      <span class="Annot"><span style=
      'font-size:10.0pt'>tainted</span></span> and <span class=
      "Annot"><span style=
      'font-size:10.0pt'>untainted</span></span> objects produces a
      <span class="Annot"><span style=
      'font-size:10.0pt'>tainted</span></span> object. Thus, if a
      reference is <span class="Annot"><span style=
      'font-size:10.0pt'>tainted</span></span> along one control
      path and <span class="Annot"><span style=
      'font-size:10.0pt'>untainted</span></span> along another
      control path, checking assumes that it is <span class=
      "Annot"><span style=
      'font-size:10.0pt'>tainted</span></span>after the two
      branches merge. It is also used to merge taintedness states
      in function specifications (see the <span class=
      "CodeText"><span style=
      'font-size:10.0pt'>strcat</span></span> example in the next
      section).&nbsp; We can also define error combinations so that
      a warning is reported if the states on different paths are
      incompatible.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">The <span class="Annot"><span style=
'font-size:10.0pt'>defaults</span></span> clause specifies default
values used for declarators without explicit attribute annotations.
We choose default values to make it easy to start checking an
unannotated program. Here we assume unannotated references are
<span class="Annot"><span style=
'font-size:10.0pt'>tainted</span></span> and Splint will report a
warning where unannotated references are passed to functions that
require untainted parameters. The warnings indicate either a format
bug in the code or a place where an <span class=
      "Annot"><span style='font-size:10.0pt'>untainted</span></span>
      annotation should be added. Running Splint again after adding
      the annotation will propagate the newly documented assumption
      through the program.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX" style='margin-bottom:6.0pt'>The full grammar
for metastate definitions is given in Appendix C.</p>
<h2 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534975004">10.2<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Annotations</a></h2>
<p class="TextFontCX">The annotations defined by metastate
definitions can be used like normal annotations.&nbsp; The context
specifier for an annotation indicates where it may be used.&nbsp;
For the taintedness example, we can use <span class=
"Annot"><span style='font-size:10.0pt'>tainted</span></span> and
<span class="Annot"><span style=
'font-size:10.0pt'>untainted</span></span> as annotations wherever
<span class="Annot"><span style=
'font-size:10.0pt'>only</span></span> could be used.&nbsp; This
includes <span class="Annot"><span style=
'font-size:10.0pt'>ensures</span></span> and <span class=
"Annot"><span style='font-size:10.0pt'>requires</span></span>
clauses, which allows us to specify functions that modify state
associated with metastate definitions.&nbsp; The syntax
      <span class="Annot"><i><span style=
      'font-size: 10.0pt'>&lt;expr&gt;</span></i></span><span class="Annot">
<span style=
'font-size: 10.0pt'>:<i>&lt;attribute&gt;</i></span></span> is used
to refer to the value of the user-defined attribute for expression
<span class="Annot"><i><span style=
'font-size:10.0pt'>&lt;expr&gt;</span></i></span>.&nbsp;</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">It is often necessary to extend the library
specifications with metastate annotations.&nbsp; We don&#8217;t
want to have different versions of the library for different
metastate annotations, so instead Splint provides a mechanism for
adding annotations separately using an <span class=
"ProgramNameChar"><span style='font-size:10.0pt'>.xh</span></span>
file.&nbsp; For the taintedness example, we do this by providing
annotated declarations in the <span class=
"ProgramNameChar"><span style=
'font-size:10.0pt'>tainted.xh</span></span> file. Example
specifications in this file include:</p>
<p class="TextFontCX">&nbsp;</p>
<p class="Verbatim">int printf&nbsp; (/*@untainted@*/ char *fmt,
...);</p>
<p class="Verbatim">&nbsp;</p>
<p class="Verbatim">char *fgets (char *s, int n, FILE *stream)
/*@ensures tainted s@*/ ;</p>
<p class="Verbatim">&nbsp;</p>
<p class="Verbatim">char *strcat (/*@returned@*/ char *s1,&nbsp;
char *s2)&nbsp;</p>
<p class="Verbatim">&nbsp;&nbsp; /*@ensures s1:taintedness =
s1:taintedness | s2:taintedness @*/</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">The <span class="CodeText"><span style=
'font-size:10.0pt'>strcat</span></span> specification uses
<span class="Annot"><span style='font-size:10.0pt'>/*@ensures
s1:taintedness = s1:taintedness | s2:taintedness @*/</span></span>
to indicate that the taintedness of <span class=
"CodeText"><span style='font-size:10.0pt'>s1</span></span> after
<span class="CodeText"><span style=
'font-size:10.0pt'>strcat</span></span> returns is the result of
merging the taintedness of <span class=
      "CodeText"><span style='font-size:10.0pt'>s1</span></span>
      and <span class="CodeText"><span style=
      'font-size:10.0pt'>s2</span></span> before the call.&nbsp;
      Because the parameters lack annotations, they are implicitly
      tainted according to the default rules and either untainted
      or tainted references can be passed as parameters to
      <span class="CodeText"><span style=
      'font-size:10.0pt'>strcat</span></span>. The <span class=
      "Annot"><span style='font-size:10.0pt'>ensures</span></span>
      clause means that after <span class="CodeText"><span style=
      'font-size:10.0pt'>strcat</span></span> returns the first
      parameter (and the result, because of the returned annotation
      on <span class="CodeText"><span style=
      'font-size:10.0pt'>s1</span></span>) will be tainted if
      either passed object was tainted.&nbsp; Splint merges the two
      taintedness states using the attribute definition
      rules&#8212;hence, if the <span class="CodeText"><span style=
      'font-size:10.0pt'>s1</span></span> parameter is untainted
      and the <span class="CodeText"><span style=
      'font-size:10.0pt'>s2</span></span> parameter is tainted, the
      result and first parameter will be tainted after <span class=
      "CodeText"><span style=
      'font-size:10.0pt'>strcat</span></span> returns.</p>
<p class="TextFontCX">&nbsp;</p>
<h1 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534975006"></a><a name="_Ref534642895"></a><a name=
"_Ref534642215">11<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
<a id="macros" name="macros">
Macros</a></a></h1>
<p class="TextFontCX">Macros are commonly used in C programs to
implement constants or to mimic functions without the overhead of a
function call.&nbsp; Macros that are used to implement functions
are a persistent source of bugs in C programs, since they may not
behave like the intended function when they are invoked with
certain parameters or used in certain syntactic contexts.&nbsp;</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Splint eliminates most of the potential
problems by detecting macros with dangerous implementations and
dangerous macro invocations.&nbsp; Whether or not a macro
definition is checked or expanded normally depends on flag settings
and control comments (see Section 11.3).&nbsp; Stylized macros can
also be used to define control structures for iterating through
many values (see Section 11.4).</p>
<h2 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534975007"></a><a name="_Ref361651263"></a><a name=
"_Ref344916524"></a><a name="_Ref344908437"></a><a name=
"_Toc344355419">11.1<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Constant Macros</a></h2>
<p class="TextFontCX">Macros may be used to implement
constants.&nbsp; To get type-checking for constant macros, use the
<span class="Annot"><span style=
'font-size:10.0pt'>constant</span></span> annotation.&nbsp; For
example,</p>
<p class="example">/*@constant null char *mstring_undefined@*/</p>
<p class="TextFontCX">Declared constants are not expanded and are
checked according to the declaration.&nbsp; A constant with a
<span class="Annot"><span style=
'font-size:10.0pt'>null</span></span> annotation may be used as
<span class="Annot"><span style=
'font-size:10.0pt'>only</span></span> storage.</p>
<h2 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534975008"></a><a name="_Toc344355420"></a><a name=
"_Ref343363760">11.2<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Function-like Macros</a></h2>
<p class="TextFontCX">Using macros to imitate functions is
notoriously dangerous.&nbsp; Consider this broken macro for
squaring a number:</p>
<p class="example"># define square(x) x * x</p>
<p class="TextFontCX">This works fine for a simple invocation like
<span class="CodeText"><span style=
'font-size:10.0pt'>square(i)</span></span>.&nbsp; It behaves
unexpectedly, though, if it is instantiated with a parameter that
has a side effect.&nbsp; For example, <span class=
"CodeText"><span style=
'font-size: 10.0pt'>square(i++)</span></span> expands to
<span class="CodeText"><span style='font-size:10.0pt'>i++ *
i++</span></span>.&nbsp; Not only does this give the incorrect
result, it has undefined behavior since the order in which the
operands are evaluated is not defined.&nbsp; (See Section 8.2 for
more information on how expressions exhibiting undefined evaluation
order behavior are detected by Splint.)&nbsp; To correct the
problem we either need to rewrite the macro so that its parameter
is evaluated exactly once, or prevent clients from invoking the
macro with a parameter that has a side effect.&nbsp;</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Another possible problem with macros is that
they may produce unexpected results because of operator precedence
rules.&nbsp; The instantiation, <span class=
      "CodeText"><span style='font-size:10.0pt'>square(i+1)</span></span>
      expands to <span class="CodeText"><span style=
      'font-size:10.0pt'>i+1*i+1</span></span>, which evaluates to
      <span class="CodeText"><span style=
      'font-size:10.0pt'>i+i+1</span></span> instead of the square
      of <span class="CodeText"><span style=
      'font-size:10.0pt'>i+1</span></span>.&nbsp; To ensure the
      expected behavior, the macro parameter should be enclosed in
      parentheses where it is used in the macro body.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Macros may also behave unexpectedly if they
are not syntactically equivalent to an expression.&nbsp; Consider
the macro definition,</p>
<p class="example"># define incCounts()&nbsp; ntotal++;
ncurrent++;</p>
<p class="TextFontCX">This works fine, unless it is used as a
statement.&nbsp; For example,</p>
<p class="example">if (x &lt; 3) incCounts();</p>
<p class="TextFontCX">increments <span class=
      "CodeText"><span style='font-size:10.0pt'>ntotal</span></span>
      if <span class="CodeText"><span style='font-size:10.0pt'>x
      &lt; 3</span></span> but always increments <span class=
      "CodeText"><span style=
      'font-size:10.0pt'>ncurrent</span></span>.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">One solution is to use the comma operator to
define the macro:</p>
<p class="example"># define incCounts()&nbsp; (ntotal++,
ncurrent++)</p>
<p class="beforelist">More complicated macros can be written using
a <span class="CodeText"><span style='font-size:10.0pt'>do &#8230;
while</span></span> construction:</p>
<p class="Verbatim">&nbsp; # define incCounts() \</p>
<p class="Verbatim">&nbsp;&nbsp;&nbsp;&nbsp; do { ntotal++;
ncurrent++; } while (FALSE)</p>
<p class="afterlist">Splint detects these pitfalls in macro
definitions, and checks that a macro behaves as much like a
function as possible.&nbsp; A client should only be able to tell
that a function was implemented by a macro if it attempts to use
the macro as a pointer to a function.</p>
<p class="MsoListBullet">&nbsp;</p>
<p class="beforelist">Splint does these checks on a macro
definition corresponding to a function:</p>
<p class="MsoListBullet"><span style=
'font-family:Symbol'>&#183;<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
Each parameter to a macro (except those declared to be side effect
free, see Section 11.2.1) must be used exactly once in all possible
executions of the macro, so side effecting arguments behave as
expected.<a href="#_ftn15" name="_ftnref15" title=
      ""><span class="MsoFootnoteReference"><span class=
      "MsoFootnoteReference"><span style=
      'font-size:11.0pt;font-family:"Times New Roman"'>[15]</span></span></span></a>&nbsp;
      (Controlled by <span class="Flag"><span style=
      'font-size:10.0pt'>macroparams</span></span>.)</p>
<p class="MsoListBullet"><span style=
'font-family:Symbol'>&#183;<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
A parameter to a macro may not be used as the left-hand side of an
assignment expression or as the operand of an increment or
decrement operator in the macro text, since this produces
non-functional behavior.&nbsp; (Controlled by <span class=
"Flag"><span style=
'font-size:10.0pt'>macroassign</span></span>.)</p>
<p class="MsoListBullet"><span style=
'font-family:Symbol'>&#183;<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
Macro parameters must be enclosed in parentheses when they are used
in potentially dangerous contexts.&nbsp; (Controlled by
      <span class="Flag"><span style=
      'font-size: 10.0pt'>macroparens</span></span>.)</p>
<p class="MsoListBullet"><span style=
'font-family:Symbol'>&#183;<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
A macro definition must be syntactically equivalent to a statement
when it is invoked followed by a semicolon. (Controlled by
<span class="Flag"><span style=
'font-size:10.0pt'>macrostmt</span></span>.)</p>
<p class="MsoListBullet"><span style=
'font-family:Symbol'>&#183;<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
The type of the macro body must match the return type of the
corresponding function.&nbsp; If the macro is declared with type
<span class="CodeText"><span style=
'font-size:10.0pt'>void</span></span>, its body may have any type
but the macro value may not be used.</p>
<p class="MsoListBullet"><span style=
'font-family:Symbol'>&#183;<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
All variables declared in the body of a macro definition must be in
the macro variable namespace, so they do not conflict with
variables in the scope where the macro is invoked (which may be
used in the macro parameters).&nbsp; By default, the macro
namespace is all names prefixed by <span class=
"CodeText"><span style='font-size:10.0pt'>m_</span></span>.&nbsp;
(See Section 12.2 for information on controlling namespaces.)</p>
<p class="afterlist">At the call site, a macro is checked like any
other function call.</p>
<h3 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534975009"></a><a name="_Toc344355421"></a><a name=
"_Ref343109609">11.2.1<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;</span> Side
Effect Free Parameters</a></h3>
<p class="beforelist">Suppose we really do want to implement
<span class="CodeText"><span style=
'font-size:10.0pt'>square</span></span> as a macro, but want do so
in a safe way.&nbsp; One way to do this is to require that it is
never invoked with a parameter that has a side effect.&nbsp; Splint
will check that this constraint holds, if the parameter is
annotated to be side effect free.&nbsp; That is, the expression
corresponding to this parameter must not modify any state, so it
does not matter how many times it is evaluated.&nbsp; The
<span class="Annot"><span style=
'font-size:10.0pt'>sef</span></span> annotation is used to denote a
parameter that may not have any side effects:</p>
<p class="Verbatim"><span style='font-size:9.5pt'>&nbsp;&nbsp;
extern int square (/*@sef@*/ int x);</span></p>
<p class="Verbatim"><span style='font-size:9.5pt'>&nbsp;&nbsp; #
define square(x) ((x) *(x))</span></p>
<p class="afterlist">Now, Splint will not report an error checking
the definition of <span class="CodeText"><span style=
'font-size:10.0pt'>square</span></span> even though
      <span class="CodeText"><span style=
      'font-size:10.0pt'>x</span></span> is used more than
      once.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">A message will be reported, however, if
<span class="CodeText"><span style=
'font-size:10.0pt'>square</span></span> is invoked with a parameter
that has a side effect.&nbsp; For the code fragment,</p>
<p class="example">square (i++)</p>
<p class="beforelist">Splint produces the message:</p>
<p class="Verbatim">&nbsp;&nbsp; <span style=
'font-family:Arial'>Parameter 1 to square is declared sef,</span>
<span style='font-family:Arial'>but the argument may modify:
i++</span></p>
<p class="betweenlists">It is also an error to pass a macro
parameter that is not annotated with <span class=
"Annot"><span style='font-size:10.0pt'>sef</span></span> as a
<span class="Annot"><span style=
'font-size:10.0pt'>sef</span></span> macro parameter in the body of
a macro definition.&nbsp; For example,</p>
<p class="Verbatim"><span style='font-size:9.5pt'>&nbsp;&nbsp;
extern int sumsquares (int x, int y);</span></p>
<p class="Verbatim"><span style='font-size:9.5pt'>&nbsp;&nbsp; #
define sumsquares(x,y) (square(x) + square(y))</span></p>
<p class="afterlist">Although <span class=
      "CodeText"><span style='font-size:10.0pt'>x</span></span>
      only appears once in the definition of <span class=
      "CodeText"><span style=
      'font-size:10.0pt'>sumsquares</span></span> it will be
      evaluated twice since <span class="CodeText"><span style=
      'font-size:10.0pt'>square</span></span> is expanded.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">A parameter may be passed as a
      <span class="Annot"><span style=
      'font-size:10.0pt'>sef</span></span> parameter without an
      error being reported, if Splint can determine that evaluating
      the parameter has no side effects.&nbsp; For function calls,
      the modifies clause is used to determine if a side effect is
      possible.<a href="#_ftn16" name="_ftnref16" title=
      ""><span class="MsoFootnoteReference"><span class=
      "MsoFootnoteReference"><span style=
      'font-size:11.0pt;font-family:"Times New Roman"'>[16]</span></span></span></a>&nbsp;&nbsp;
      To prevent many spurious errors, if the called function has
      no modifies clause, Splint will report an error only if
      <span class="Flag"><span style=
      'font-size: 10.0pt'>sef-uncon</span></span> is on.&nbsp;
      Justifiably paranoid programmers will insist on setting
      <span class="Flag"><span style=
      'font-size:10.0pt'>sef-uncon</span></span> on, and will add
      modifies clauses to unconstrained functions that are used in
      <span class="Annot"><span style=
      'font-size:10.0pt'>sef</span></span> macro arguments.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="beforelist">One common application of macros is to get
around the lack of polymorphism in C.&nbsp; We can use the
<span class="Annot"><span style='font-size: 10.0pt'>/*@alt
&lt;type&gt;,<sup>+</sup>@&gt;</span></span> syntax &nbsp;(see
Section 4.4) to indicate that an alternate type may be used.&nbsp;
For example,</p>
<p class="Verbatim"><span style='font-size:9.5pt'>&nbsp; extern int
/*@alt float@*/ square (/*@sef@*/ int /*@alt float@*/
x);</span></p>
<p class="Verbatim"><span style='font-size:9.5pt'>&nbsp; # define
square(x) ((x) *(x))</span></p>
<p class="afterlist">declares <span class=
      "CodeText"><span style='font-size:10.0pt'>square</span></span>
      for both <span class="CodeText"><span style=
      'font-size:10.0pt'>int</span></span>s and <span class=
      "CodeText"><span style=
      'font-size:10.0pt'>float</span></span>s.&nbsp; Note however,
      that the return type is either <span class=
      "CodeText"><span style='font-size:10.0pt'>int</span></span>
      or <span class="CodeText"><span style=
      'font-size:10.0pt'>float</span></span>, regardless of the
      actual parameter type.&nbsp; This is weaker than what is
      actually known about the return type.</p>
<h2 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534975010"></a><a name="_Ref347227227">11.3<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Controlling Macro Checking</a></h2>
<p class="TextFontCX">By default, Splint expands macros normally
and checks the resulting code after macros have been
expanded.&nbsp; Flags and control comments may be used to control
which macros are expanded and which are checked as functions or
constants.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">If the <span class="Flag"><span style=
'font-size:10.0pt'>fcn-macros</span></span> flag is on, Splint
assumes all macros defined with parameter lists implement functions
and checks them accordingly.&nbsp; Parameterized macros are not
expanded and are checked as functions with unknown result and
parameter types (or using the types in the prototype, if one is
given).&nbsp; The analogous flag for macros that define constants
is <span class="Flag"><span style=
'font-size:10.0pt'>const-macros</span></span>.&nbsp; If it is on,
macros with no parameter lists are assumed to be constants, and
checked accordingly.&nbsp; The <span class=
      "Flag"><span style='font-size:10.0pt'>all-macros</span></span>
      flag sets both <span class="Flag"><span style=
      'font-size:10.0pt'>fcn-macros</span></span> and <span class=
      "Flag"><span style=
      'font-size:10.0pt'>const-macros</span></span>.&nbsp; If the
      <span class="Flag"><span style=
      'font-size:10.0pt'>macro-fcn-decl</span></span>&nbsp;flag is
      set, a message reports parameterized macros with no
      corresponding function prototype.&nbsp; If the <span class=
      "Flag"><span style=
      'font-size:10.0pt'>macro-const-decl</span></span>&nbsp;flag
      is set, a similar message reports macros with no parameters
      that have no corresponding constant declaration.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="beforelist">The macro checks described in the previous
sections make sense only for macros that are intended to replace
functions or constants.&nbsp; When <span class=
      "Flag"><span style='font-size:10.0pt'>fcnmacros</span></span>
      or <span class="Flag"><span style=
      'font-size:10.0pt'>constmacros</span></span> is on, more
      general macros need to be marked so they will not be checked
      as functions or constants, and will be expanded
      normally.&nbsp; Macros that are not meant to behave like
      functions should be preceded by the /<span class=
      "Annot"><span style=
      'font-size:10.0pt'>*@notfunction@*/</span></span>comment.&nbsp;
      For example,</p>
<p class="Verbatim"><span style='font-size:9.5pt'>&nbsp;&nbsp;
/*@notfunction@*/</span></p>
<p class="Verbatim"><span style='font-size:9.5pt'>&nbsp;&nbsp; #
define forever for(;;)</span></p>
<p class="afterlist">Macros preceded by <span class=
"Annot"><span style='font-size: 10.0pt'>notfunction</span></span>
are expanded normally before regular checking is done.&nbsp; If a
macro that is not syntactically equivalent to a statement without a
semi-colon (e.g., a macro which enters a new scope) is not preceded
by <span class="Annot"><span style=
'font-size:10.0pt'>notfunction</span></span>, parse errors may
result when <span class="Flag"><span style=
'font-size:10.0pt'>fcn-macros</span></span>&nbsp;or
      <span class="Flag"><span style=
      'font-size:10.0pt'>const-macros</span></span>&nbsp;is on.</p>
<h2 style='margin-left:0in;text-indent:0in'><a name=
"_Ref345771875"></a><a name="_Ref345489124"></a><a name=
"_Toc344355423"></a><a name="_Toc534975011"></a><a name=
"_Ref361651257"></a><a name="_Ref349897909"></a><a name=
"_Ref344916532"></a><a name="_Ref344908410"></a><a name=
"_Toc344355424">11.4<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Iterators</a></h2>
<p class="TextFontCX">It is often useful to be able to execute the
same code for many different values.&nbsp; For example, we may want
to sum all elements in an <span class="CodeText"><span style=
'font-size:10.0pt'>intSet</span></span> that represents a set of
integers.&nbsp; If <span class="CodeText"><span style=
'font-size:10.0pt'>intSet</span></span> is an abstract type, there
is no easy way of doing this in a client module without depending
on the concrete representation of the type.&nbsp; Instead, we could
provide such a mechanism as part of the type&#8217;s
implementation.&nbsp; We call a mechanism for looping through many
values an <i>iterator</i>.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">The C language provides no mechanism for
creating user-defined iterators.&nbsp; Splint supports a stylized
form of iterators declared using syntactic comments and defined
using macros.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Iterator declarations are similar to function
declarations except instead of returning a value, they assign
values to their <span class="Annot"><span style=
'font-size:10.0pt'>yield</span></span> parameters in each
iteration.&nbsp; For example, we could add this iterator
declaration to <span class="Keyword"><span style=
'font-size:10.0pt;font-family: Arial;color:windowtext'>intSet.h</span></span>:</p>
<p class="example">/*@iter intSet_elements (intSet s, yield int
el);@*/</p>
<p class="TextFontCX">The <span class="Annot"><span style=
'font-size:10.0pt'>yield</span></span> annotation means that the
variable passed as the second actual argument is declared as a
local variable of type <span class="CodeText"><span style=
'font-size:10.0pt'>int</span></span> and assigned a value in each
loop iteration.</p>
<h3 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534975012">11.4.1<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;</span> Defining
Iterators</a></h3>
<p class="beforelist">An iterator is defined using a macro.&nbsp;
Here&#8217;s one (not particularly efficient) way of defining
<span class="CodeText"><span style=
'font-size:10.0pt'>intSet_elements</span></span>:</p>
<p class="Verbatim">&nbsp;&nbsp; typedef /*@abstract@*/ struct
{</p>
<p class="Verbatim">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; int
nelements;</p>
<p class="Verbatim">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; int
*elements;</p>
<p class="Verbatim">&nbsp;&nbsp; } intSet;</p>
<p class="Verbatim">&nbsp;&nbsp; &#8230;</p>
<p class="Verbatim">&nbsp;&nbsp; # define intSet_elements(s,m_el)
\</p>
<p class="Verbatim">&nbsp;&nbsp;&nbsp;&nbsp; { int m_i; \</p>
<p class="Verbatim">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; for (m_i =
(0); m_i &lt;= ((s)-&gt;nelements); m_i++) { \</p>
<p class="Verbatim">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; int
m_el = (s)-&gt;elements[(m_i)];</p>
<p class="Verbatim">&nbsp;</p>
<p class="Verbatim">&nbsp;&nbsp; # define end_intSet_elements
}}</p>
<p class="afterlist">Each time through the loop, the yield
parameter <span class="CodeText"><span style=
'font-size:10.0pt'>m_el</span></span> is assigned to the next
value.&nbsp; After each value has been assigned to
      <span class="CodeText"><span style=
      'font-size:10.0pt'>m_el</span></span> for one iteration, the
      loop terminates.&nbsp; Variables declared by the iterator
      macro (including the <span class="Annot"><span style=
      'font-size:10.0pt'>yield</span></span> parameter) are
      preceded by the macro variable namespace prefix <span class=
      "CodeText"><span style='font-size:10.0pt'>m_</span></span>
      (see Section 11.2) to avoid conflicts with variables defined
      in the scope where the iterator is used.</p>
<h3 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534975013">11.4.2<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;</span> Using
Iterators</a></h3>
<p class="TextFontCX">The general structure for using an iterator
is,</p>
<p class="example"><i>iter</i> (<i>&lt;params&gt;</i>) stmt;
end_<i>iter</i></p>
<p class="beforelist">For example, a client could use
      <span class="CodeText"><span style=
      'font-size:10.0pt'>intSet_elements</span></span> to sum the
      elements of an <span class="CodeText"><span style=
      'font-size:10.0pt'>intSet</span></span>:</p>
<p class="Verbatim">&nbsp;&nbsp; intSet s;</p>
<p class="Verbatim">&nbsp;&nbsp; int sum = 0;</p>
<p class="Verbatim">&nbsp;&nbsp; ...</p>
<p class="Verbatim">&nbsp;&nbsp; intSet_elements (s, el) {</p>
<p class="Verbatim" style='text-indent:.5in'>sum += el;</p>
<p class="Verbatim">&nbsp;&nbsp; } end_intSet_elements;</p>
<p class="afterlist">The actual parameter corresponding to a yield
parameter, <span class="CodeText"><span style=
'font-size:10.0pt'>el</span></span>, is not declared in the
function scope.&nbsp; Instead, it is declared by the iterator and
assigned to an appropriate value for each iteration.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="beforelist">Splint will do the following checks for uses
of stylized iterators:</p>
<p class="MsoListBullet"><span style=
'font-family:Symbol'>&#183;<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
An invocation of the iterator <span class=
      "CodeText"><i><span style='font-size:10.0pt'>iter</span></i></span>
      must be balanced by a corresponding end, named <span class=
      "CodeText"><span style=
      'font-size:10.0pt'>end_<i>iter</i></span></span>.</p>
<p class="MsoListBullet"><span style=
'font-family:Symbol'>&#183;<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
All actual parameters must be defined, except those corresponding
to yield parameters.</p>
<p class="MsoListBullet"><span style=
'font-family:Symbol'>&#183;<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
Yield parameters must be new identifiers, not declared in the
current scope or any enclosing scope.</p>
<p class="afterlist">Iterators are a bit awkward to implement, but
they enable compact, easily understood client code.&nbsp; For
abstract collection types, an iterator can be used to enable
clients to operate on elements of the collection without breaking
data abstraction.<a name="_Ref348845281"></a><a name=
"_Toc344355425"></a><a name="_Ref343247905"></a></p>
<h1 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534975014"></a><a name="_Ref483663681"></a><a name=
"_Ref350065611">12<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
<a id="naming" name="naming">
Naming Conventions</a></a></h1>
<p class="TextFontCX">Naming conventions tend to be a religious
issue. Generally, it doesn't matter too much what naming convention
is followed as long as one is chosen and followed
religiously.&nbsp; There are two kinds of naming conventions
supported by Splint.&nbsp; Type-based naming conventions (Section
12.1) constrain identifier names according to the abstract
types&nbsp;that are accessible where the identifier is
defined.&nbsp; Prefix naming conventions (Section 12.2) constrain
the initial characters of identifier names according to what is
being declared and its scope.&nbsp; Naming conventions may be
combined or different conventions may be selected for different
kinds of identifiers.&nbsp; In addition, Splint supports checking
that names do not conflict with names reserved for the standard
library or implementation (Section 12.3) and are sufficiently
distinguishable from other names.</p>
<h2 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534975015"></a><a name="_Ref348079373"></a><a name=
"_Ref347240654"></a><a name="_Toc344355426">12.1<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Type-Based Naming Conventions</a></h2>
<p class="TextFontCX">Generic naming conventions constrain valid
names of identifiers.&nbsp; By limiting valid names, namespaces may
be preserved and programs may be more easily understood since the
name gives clues as to how and where the name is defined and how it
should be used.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Names may be constrained by the scope of the
name (external, file static, internal), the file in which the
identifier is defined, the type of the identifier, and global
constraints.</p>
<h3 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534975016"></a><a name=
      "_Ref347994687">12.1.1<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;</span>
      Czech Names</a></h3>
<p class="TextFontCX">Czech<a href="#_ftn17" name="_ftnref17"
   title=""><span class="MsoFootnoteReference"><span class=
   "MsoFootnoteReference"><span style=
   'font-size:11.0pt;font-family:"Times New Roman"'>[17]</span></span></span></a>
   names denote operations and variables of abstract types by
   preceding the names by <span class="CodeText"><i><span style=
   'font-size:10.0pt'>&lt;type&gt;</span></i></span><span class=
   "CodeText"><span style='font-size:10.0pt'>_</span></span>.&nbsp;
   The remainder of the name should begin with a lowercase
   character, but may use any other character besides the
   underscore.&nbsp; Types may be named using any non-underscore
   characters.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX" style='margin-bottom:6.0pt'>The Czech naming
convention is selected by the <span class="Flag"><span style=
'font-size:10.0pt'>czech</span></span>&nbsp;flag.&nbsp; If
<span class="Flag"><span style=
'font-size:10.0pt'>access-czech</span></span> is on, a function,
variable, constant or iterator named <span class=
"CodeText"><i><span style=
'font-size:10.0pt'>&lt;type&gt;</span></i></span><span class=
"CodeText"><span style=
'font-size:10.0pt'>_<i>&lt;name&gt;</i></span></span> has access to
the abstract type <span class="CodeText"><i><span style=
'font-size:10.0pt'>&lt;type&gt;</span></i></span>.&nbsp; Reporting
of violations of the Czech naming convention is controlled by
different flags depending on what is being declared:</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>czech-fcns</span></span></p>
<p class="TextFontCX" style='margin-left:13.5pt'>Functions and
iterators.&nbsp; An error is reported for a function name of the
form <span class="CodeText"><i><span style=
'font-size:10.0pt'>&lt;prefix&gt;</span></i></span><span class="CodeText">
<span style='font-size:10.0pt'>_<i>&lt;name&gt;</i></span></span>
where <span class="CodeText"><i><span style=
'font-size:10.0pt'>&lt;prefix&gt;</span></i></span> is not the name
of an accessible type.&nbsp; Note that if <span class=
"Flag"><span style='font-size:10.0pt'>accessczech</span></span> is
on, a type named <span class="CodeText"><i><span style=
'font-size:10.0pt'>&lt;prefix&gt;</span></i></span> would be
accessible in a function beginning with <span class=
"CodeText"><i><span style=
'font-size:10.0pt'>&lt;prefix&gt;</span></i></span><span class="CodeText">
<span style='font-size:10.0pt'>_</span></span>.&nbsp; If
<span class="Flag"><span style=
'font-size:10.0pt'>access-czech</span></span> is off, an error is
reported instead.&nbsp; An error is reported for a function name
that does not have an underscore if any abstract types&nbsp;are
accessible where the function is defined.</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>czech-vars</span></span></p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>czech-constants</span></span></p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>czech-macros</span></span></p>
<p class="IndentText">Variables, constants and expanded macros.
&nbsp;An error is reported if the identifier name starts with
<span class="CodeText"><i><span style=
'font-size:10.0pt'>&lt;prefix&gt;</span></i></span><span class="CodeText">
<span style='font-size:10.0pt'>_</span></span>and
      <span class="CodeText"><i><span style=
      'font-size:10.0pt'>prefix</span></i></span> is not the name
      of an accessible abstract type, or if an abstract type is
      accessible and the identifier name does not begin with
      <span class="CodeText"><i><span style=
      'font-size:10.0pt'>&lt;type&gt;</span></i></span><span class=
      "CodeText"><span style='font-size:10.0pt'>_</span></span>
      where <span class="CodeText"><i><span style=
      'font-size:10.0pt'>type</span></i></span> is the name of an
      accessible abstract type.&nbsp; If <span class=
      "Flag"><span style=
      'font-size:10.0pt'>access-czech</span></span>&nbsp;is on, the
      representation of the type is visible in the constant or
      variable definition.</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>czech-types</span></span></p>
<p class="TextFontCX" style='margin-left:13.5pt'>User-defined
types.&nbsp; An error is reported if a type name includes an
underscore character.</p>
<p class="Sidebar" align="right">Of course, this is a complete
jumble to the uninitiated, and that&#8217;s the joke.</p>
<p class="Sidebar" align="right" style='text-align:right'>
<i>Charles Simonyi, on the Hungarian naming convention</i></p>
<h3 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534975017"></a><a name=
      "_Ref344878566">12.1.2<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;</span>
      Slovak Names</a></h3>
<p class="TextFontCX">Slovak names are similar to Czech names,
except they are spelled differently.&nbsp; A Slovak name is of the
form <span class="CodeText"><i><span style=
'font-size:10.0pt'>&lt;type&gt;&lt;Name&gt;</span></i></span>.&nbsp;
The type prefix may not use uppercase characters.&nbsp; The
remainder of the name starts with the first uppercase
character.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">The <span class="Flag"><span style=
'font-size:10.0pt'>slovak</span></span>&nbsp;flag selects the
Slovak naming convention.&nbsp; Like Czech names, it may be used
with <span class="Flag"><span style=
'font-size:10.0pt'>access-slovak</span></span>&nbsp;to control
access to abstract representations. The <span class=
"Flag"><span style='font-size:10.0pt'>slovak-fcns</span></span>,
<span class="Flag"><span style=
'font-size:10.0pt'>slovak-vars</span></span>, <span class=
"Flag"><span style=
'font-size:10.0pt'>slovak-constants</span></span>, and
      <span class="Flag"><span style=
      'font-size:10.0pt'>slovak-macros</span></span>&nbsp;flags are
      analogous to the similar Czech flags.&nbsp; If <span class=
      "Flag"><span style=
      'font-size:10.0pt'>slovak-type</span></span> is on, an error
      is reported if a type name includes an uppercase letter.</p>
<h3 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534975018"></a><a name=
      "_Ref347994743">12.1.3<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;</span>
      Czechoslovak Names</a></h3>
<p class="TextFontCX">Czechoslovak names are a combination of Czech
names and Slovak names.&nbsp; Operations may be named either
<span class="CodeText"><i><span style=
'font-size:10.0pt'>&lt;type&gt;</span></i></span><span class=
"CodeText"><span style='font-size:10.0pt'>_</span></span> followed
by any sequence of non-underscore characters, or <span class=
"CodeText"><i><span style=
'font-size:10.0pt'>&lt;type&gt;</span></i></span> followed by an
uppercase letter and any sequence of characters.&nbsp; Czechoslovak
names have been out of favor since 1993, but may be necessary for
checking legacy code. The <span class="Flag"><span style=
'font-size:10.0pt'>czechoslovak-fcns</span></span>,
      <span class="Flag"><span style=
      'font-size:10.0pt'>czechoslovak-vars</span></span>,
      <span class="Flag"><span style=
      'font-size:10.0pt'>czechoslovak-macros</span></span>, and
      <span class="Flag"><span style=
      'font-size:10.0pt'>czechoslovak-constants</span></span>
      flags&nbsp;are analogous to the similar Czech flags.&nbsp; If
      <span class="Flag"><span style=
      'font-size:10.0pt'>czechoslovak-type</span></span>&nbsp;is
      on, an error is reported if a type name contains either an
      uppercase letter or an underscore character.</p>
<h2 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534975019"></a><a name="_Ref347240687"></a><a name=
"_Ref347222192">12.2<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Namespace Prefixes</a></h2>
<p class="TextFontCX">Another way to restrict names is to constrain
the leading character sequences of various kinds of
identifiers.&nbsp; For example, the names of all user-defined types
might begin with <span class="CodeText"><span style=
'font-size:10.0pt'>T</span></span> followed by an uppercase letter
and all file static names begin with an uppercase letter.&nbsp;
This may be useful for enforcing a namespace (e.g., all names
exported by the X-windows library should begin with
      <span class="CodeText"><span style=
      'font-size:10.0pt'>X</span></span>) or just making programs
      easier to understand by establishing an enforced
      convention.&nbsp; Splint can be used to constrain identifiers
      in this way to detect identifiers inconsistent with
      prefixes.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">All namespace flags are of the form,
<span class="Flag"><span style=
'font-size:10.0pt'>-<i>&lt;context&gt;</i>prefix
<i>&lt;string&gt;</i></span></span>.&nbsp; For example, the macro
variable namespace restricting identifiers declared in macro bodies
to be preceded by <span class="CodeText"><span style=
'font-size:10.0pt'>m_</span></span> would be selected by
<span class="Flag"><span style=
'font-size:10.0pt'>-macrovarprefix</span></span> <span class=
"Flag"><span style='font-size:10.0pt'>"m_"</span></span>.&nbsp; The
string may contain regular characters that may appear in a C
identifier.&nbsp; These must match the initial characters of the
identifier name.&nbsp; In addition, special characters (shown in
Figure 23) can be used to denote a class of characters.<a href=
"#_ftn18" name="_ftnref18" title=""><span class=
"MsoFootnoteReference"><span class=
"MsoFootnoteReference"><span style=
'font-size:11.0pt;font-family:"Times New Roman"'>[18]</span></span></span></a>&nbsp;
The <span class="CodeText"><span style=
'font-size:10.0pt'>*</span></span> character may be used at the end
of a prefix string to specify the rest of the identifier is zero or
more characters matching the character immediately before the
<span class="CodeText"><span style=
'font-size:10.0pt'>*</span></span>.&nbsp; For example, the prefix
string <span class="CodeText"><span style=
'font-size:10.0pt'>T&amp;*</span></span> matches <span class=
"CodeText"><span style='font-size:10.0pt'>T</span></span> or
<span class="CodeText"><span style=
'font-size:10.0pt'>TWINDOW</span></span> but not <span class=
"CodeText"><span style='font-size:10.0pt'>Twin</span></span>.</p>
<p class="beforelist">&nbsp;</p>
<p class="beforelist">Different prefixes can be selected for the
following identifier contexts:</p>
<table class="MsoNormalTable" border="0" cellspacing="0"
cellpadding="0" style='margin-left:.45in;border-collapse:collapse'>
<tr>
<td valign="top" style='width:2.0in;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>macro-var-prefix</span></span></p></td>
<td valign="top" style='width:247.5pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX">Any variable declared inside a macro
body</p></td></tr>
<tr>
<td valign="top" style='width:2.0in;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>unchecked-macro-prefix</span></span></p></td>
<td valign="top" style='width:247.5pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX">Any macro that is not checked as a function
or constant (see Section 11.4)</p></td></tr>
<tr>
<td valign="top" style='width:2.0in;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>tag-prefix</span></span></p></td>
<td valign="top" style='width:247.5pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX">Tags for <span class=
      "CodeText"><span style='font-size:10.0pt'>struct</span></span>,
      <span class="CodeText"><span style=
      'font-size:10.0pt'>union</span></span> and <span class=
      "CodeText"><span style='font-size:10.0pt'>enum</span></span>
      declarations</p></td></tr>
<tr>
<td valign="top" style='width:2.0in;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>enum-prefix</span></span></p></td>
<td valign="top" style='width:247.5pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX">Members of <span class=
      "CodeText"><span style='font-size:10.0pt'>enum</span></span>
      types</p></td></tr>
<tr>
<td valign="top" style='width:2.0in;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>type-prefix</span></span></p></td>
<td valign="top" style='width:247.5pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX">Name of a user-defined type</p></td></tr>
<tr>
<td valign="top" style='width:2.0in;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>file-static-prefix</span></span></p></td>
<td valign="top" style='width:247.5pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX">Any identifier with file static
scope</p></td></tr>
<tr>
<td valign="top" style='width:2.0in;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>glob-var-prefix</span></span></p></td>
<td valign="top" style='width:247.5pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX">Any variable (not of function type) with
global scope</p></td></tr>
<tr>
<td valign="top" style='width:2.0in;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>const-prefix</span></span></p></td>
<td valign="top" style='width:247.5pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX">Any constant (see Section 11.1)</p></td></tr>
<tr>
<td valign="top" style='width:2.0in;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>iter-prefix</span></span></p></td>
<td valign="top" style='width:247.5pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX">An iterator (see Section 11.4)</p></td></tr>
<tr>
<td valign="top" style='width:2.0in;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>proto-param-prefix</span></span></p></td>
<td valign="top" style='width:247.5pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX">A parameter in a function declaration
prototype</p></td></tr>
<tr>
<td valign="top" style='width:2.0in;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>external-prefix</span></span></p></td>
<td valign="top" style='width:247.5pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX">Any exported identifier</p></td></tr></table>
<p class="afterlist">If an identifier is in more than one of the
namespace contexts, the most specific defined namespace prefix is
used (e.g., a global&nbsp;variable is also an exported identifier,
so if <span class="Flag"><span style=
'font-size:10.0pt'>global-var-prefix</span></span> is set, it is
checked against the variable name; if not, the identifier is
checked against the <span class="Flag"><span style=
'font-size:10.0pt'>external-prefix</span></span>.)</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">For each prefix flag, a corresponding flag
named <span class="Flag"><i><span style=
'font-size:10.0pt'>&lt;prefixname&gt;</span></i></span><span class="Flag">
<span style='font-size:10.0pt'>exclude</span></span> controls
whether errors are reported if identifiers in a different namespace
match the namespace prefix.&nbsp; For example, if
      <span class="Flag"><span style=
      'font-size: 10.0pt'>macro-var-prefix-exclude</span></span> is
      on, Splint checks that no identifier that is not a variable
      declared inside a macro body uses the macro variable
      prefix.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="beforelist">Here is a (somewhat draconian) sample naming
convention:</p>
<table class="MsoNormalTable" border="0" cellspacing="0"
cellpadding="0" style='margin-left:5.4pt;border-collapse:collapse'>
<tr>
<td valign="top" style=
'width:189.35pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>-unchecked-macro-prefix</span></span>
<span class="Flag"><span style=
'font-size:10.0pt'>"~*"</span></span></p></td>
<td valign="top" style=
'width:238.15pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX">Unchecked macros have no lowercase
letters.</p></td></tr>
<tr>
<td valign="top" style=
'width:189.35pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>-type-prefix</span></span> <span class=
"Flag"><span style=
'font-size:10.0pt'>"T^&amp;*"</span></span></p></td>
<td valign="top" style=
'width:238.15pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX">All type names begin with <span class=
"CodeText"><span style='font-size:10.0pt'>T</span></span> followed
by an uppercase letter.&nbsp; The rest of the name is all lowercase
letters.</p></td></tr>
<tr>
<td valign="top" style=
'width:189.35pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>+type-prefix-exclude</span></span></p></td>
<td valign="top" style=
'width:238.15pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX">No identifier that does not name a
user-defined type name begins with the type name
prefix.</p></td></tr>
<tr>
<td valign="top" style=
'width:189.35pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>-file-static-prefix</span></span>
      <span class="Flag"><span style=
      'font-size:10.0pt'>"^&amp;&amp;&amp;"</span></span></p></td>
<td valign="top" style=
'width:238.15pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX">File static scope variables begin with an
uppercase letter and three lowercase letters.</p></td></tr>
<tr>
<td valign="top" style=
'width:189.35pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>-proto-param-prefix "p_"</span></span></p></td>
<td valign="top" style=
'width:238.15pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX">All parameters in prototypes must begin with
<span class="CodeText"><span style=
'font-size:10.0pt'>p_</span></span>.</p></td></tr>
<tr>
<td valign="top" style=
'width:189.35pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>-glob-var-prefix "G"</span></span></p></td>
<td valign="top" style=
'width:238.15pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX">All global variables start with
      <span class="CodeText"><span style=
      'font-size:10.0pt'>G</span></span>.</p></td></tr>
<tr>
<td valign="top" style=
'width:189.35pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>+glob-var-prefix-exclude</span></span></p></td>
<td valign="top" style=
'width:238.15pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX">No identifier that is not a
global&nbsp;variable starts with <span class=
      "CodeText"><span style='font-size:10.0pt'>G</span></span>.</p></td></tr></table>
<p class="beforelist">&nbsp;</p>
<p class="beforelist">The prefix for parameters in function
prototypes is useful for making sure parameter names are not in
conflict with macros defined before the function prototype.&nbsp;
In most cases, it may be preferable to not name prototype
parameters.&nbsp; If the <span class="Flag"><span style=
'font-size:10.0pt'>proto-param-name</span></span>&nbsp;flag is set,
an error is reported for any named parameter in a prototype
declaration.&nbsp; If a <span class="Flag"><span style=
'font-size:10.0pt'>proto-param-prefix</span></span>&nbsp;is set, no
error is reported for unnamed parameters.</p>
<p class="TextFontCX">It may also be useful to check the names of
prototype parameters correspond to the names in definitions.&nbsp;
While using header files as documentation is not generally
recommended, it is common enough practice that it makes sense to
check that parameter names are consistent.&nbsp; A discrepancy may
indicate an error in the parameter order in the function
prototype.&nbsp; If <span class="Flag"><span style=
'font-size:10.0pt'>proto-param-match</span></span>&nbsp;is set,
Splint will report an error if the name of a definition parameter
does not match the corresponding prototype parameter (after
removing the <span class="Flag"><span style=
'font-size:10.0pt'>protoparamprefix</span></span>).</p>
<center>
<table class="MsoNormalTable" border="0" cellspacing="0"
cellpadding="0" style=
'margin-left:9.9pt;border-collapse:collapse;margin-left:-2.25pt; margin-right:-2.25pt'>
<tr>
<td valign="top" style=
'width:22.0pt;border-top:solid black 1.5pt; border-left:solid black 1.5pt;border-bottom:none;border-right:none; padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="CodeText"><span style=
'font-size:10.0pt'>^</span></span></p></td>
<td valign="top" style=
'width:401.55pt;border-top:solid black 1.5pt; border-left:none;border-bottom:none;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX">Any uppercase letter, <span class=
"CodeText"><span style=
'font-size:10.0pt'>A</span></span>-<span class=
"CodeText"><span style=
'font-size:10.0pt'>Z</span></span></p></td></tr>
<tr>
<td valign="top" style=
'width:22.0pt;border:none;border-left:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="CodeText"><span style=
'font-size:10.0pt'>&amp;</span></span></p></td>
<td valign="top" style=
'width:401.55pt;border:none;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX">Any lowercase letter, <span class=
"CodeText"><span style=
'font-size:10.0pt'>a</span></span>-<span class=
"CodeText"><span style=
'font-size:10.0pt'>z</span></span></p></td></tr>
<tr>
<td valign="top" style=
'width:22.0pt;border:none;border-left:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="CodeText"><span style=
'font-size:10.0pt'>%</span></span></p></td>
<td valign="top" style=
'width:401.55pt;border:none;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX">Any character that is not an uppercase letter
(allows lowercase letters, digits and underscore)</p></td></tr>
<tr>
<td valign="top" style=
'width:22.0pt;border:none;border-left:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="CodeText"><span style=
'font-size:10.0pt'>~</span></span></p></td>
<td valign="top" style=
'width:401.55pt;border:none;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX">Any character that is not a lowercase letter
(allows uppercase letters, digits and underscore)</p></td></tr>
<tr>
<td valign="top" style=
'width:22.0pt;border:none;border-left:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="CodeText"><span style=
'font-size:10.0pt'>$</span></span></p></td>
<td valign="top" style=
'width:401.55pt;border:none;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX">Any letter (<span class=
"CodeText"><span style=
'font-size:10.0pt'>a</span></span>-<span class=
"CodeText"><span style='font-size:10.0pt'>z</span></span>,
<span class="CodeText"><span style=
'font-size:10.0pt'>A</span></span>-<span class=
"CodeText"><span style=
'font-size:10.0pt'>Z</span></span>)</p></td></tr>
<tr>
<td valign="top" style=
'width:22.0pt;border:none;border-left:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="CodeText"><span style=
'font-size:10.0pt'>/</span></span></p></td>
<td valign="top" style=
'width:401.55pt;border:none;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX">Any letter or digit (<span class=
"CodeText"><span style=
'font-size:10.0pt'>A</span></span>-<span class=
"CodeText"><span style='font-size:10.0pt'>Z</span></span>,
<span class="CodeText"><span style=
'font-size:10.0pt'>a</span></span>-<span class=
"CodeText"><span style='font-size:10.0pt'>z</span></span>,
<span class="CodeText"><span style=
'font-size:10.0pt'>0</span></span>-<span class=
"CodeText"><span style=
'font-size:10.0pt'>9</span></span>)</p></td></tr>
<tr>
<td valign="top" style=
'width:22.0pt;border:none;border-left:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="CodeText"><span style=
'font-size:10.0pt'>?</span></span></p></td>
<td valign="top" style=
'width:401.55pt;border:none;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX">Any character valid in a C
identifier</p></td></tr>
<tr>
<td valign="top" style=
'width:22.0pt;border-top:none;border-left:solid black 1.5pt; border-bottom:solid black 1.5pt;border-right:none;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="CodeText"><span style=
'font-size:10.0pt'>#</span></span></p></td>
<td valign="top" style=
'width:401.55pt;border-top:none;border-left: none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX" style='page-break-after: avoid'>Any digit,
<span class="CodeText"><span style=
'font-size:10.0pt'>0</span></span>-<span class=
"CodeText"><span style=
'font-size:10.0pt'>9</span></span></p></td></tr></table>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
<tr>
<td valign="top" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="MsoCaption"><a name="_Toc534824625"></a><a name=
"_Ref347220245"></a><a name="_Ref347220226"></a><a name=
"_Toc347255399"></a><a name="_Ref347222037"></a><a name=
"_Ref347222045"></a><a name="_Ref534824531">Figure 23</a>.&nbsp;
Prefix Character Codes</p></td></tr></table></center>
<h2 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534975020"></a><a name="_Ref348079479"></a><a name=
"_Ref347240790"></a><a name="_Toc344355427">12.3<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Naming Restrictions</a></h2>
<p class="TextFontCX">Additional naming restrictions can be used to
check that names do no conflict with names reserved for the
standard library, and that identifier are sufficiently distinct
(either for the compiler and linker, or for the programmer.)&nbsp;
Restrictions may be different for names that are needed by the
linker (<i>external</i> names) and names that are only needed
during compilations (<i>internal</i> names).&nbsp; Names of
non-<span class="CodeText"><span style=
'font-size:10.0pt'>static</span></span> functions and global
variables are external; all other names are internal.</p>
<p class="Sidebar" align="right"><a name=
"_Ref350062822"></a><a name="_Ref348845288"></a><a name=
"_Toc344355429"></a><a name="_Ref343248602">&nbsp;</a></p>
<p class="Sidebar" align="right">The decision to retain the old
six-character case-insensitive restriction on significance was most
painful.</p>
<p class="Sidebar" align="right" style='text-align:right'><i>ANSI C
Rationale</i></p>
<h3 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534975021">12.3.1<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;</span> Reserved
Names</a></h3>
<p class="TextFontCX">Many names are reserved for the
implementation and standard library.&nbsp; A complete list of
reserved names can be found in [vdL, p. 126-128].&nbsp; Some name
prefixes such as <span class="CodeText"><span style=
'font-size:10.0pt'>str</span></span> followed by a lowercase
character are reserved for future library extensions.&nbsp; Most C
compilers do not detect naming conflicts, and they can lead to
unpredictable program behavior.&nbsp; If <span class=
"Flag"><span style='font-size:10.0pt'>ansi-reserved</span></span>
is on, Splint warns about external names that conflict with
reserved names.&nbsp; If <span class="Flag"><span style=
'font-size:10.0pt'>ansi-reserved-internal</span></span>&nbsp;is on,
warnings are also produced for internal names.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">If <span class="Flag"><span style=
'font-size:10.0pt'>+cpp-names</span></span> is set, Splint warns
about identifier names that are keywords or reserved words in
C++.&nbsp; This is useful if the code may later be compiled with a
C++ compiler (of course, this is not enough to ensure the meaning
of the code is not changed when it is compiled as C++.)</p>
<h3 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534975022">12.3.2<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;</span> Distinct
Names</a></h3>
<p class="TextFontCX">Splint can check that names differ within a
given number of characters, optionally ignoring alphabetic case and
differences between characters that look similar.&nbsp; The number
of significant characters may be different for external and
internal names.&nbsp;</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Using <span class="Flag"><span style=
'font-size:10.0pt'>+distinct-external-names</span></span>&nbsp;sets
the number of significant characters for external names to six and
makes alphabetical case insignificant for external names.&nbsp;
This is the minimum significance acceptable in an ANSI-conforming
compiler.&nbsp; Most modern compilers exceed these minimums (which
are particularly hard to follow if one uses the Czech or Slovak
naming convention).&nbsp; The number of significant characters can
be changed using the <span class="Flag"><span style=
'font-size:10.0pt'>external-name-length
<i>&lt;number&gt;</i></span></span> flag.&nbsp; If
      <span class="Flag"><span style=
      'font-size:10.0pt'>external-name-case-insensitive</span></span>
      is on, alphabetical case is ignored in comparing external
      names. Splint reports identifiers that differ only in
      alphabetic case.</p>
<p class="TextFontCX">For internal identifiers, a conforming
compiler must recognize at least 31 characters and treat
alphabetical cases distinctly.&nbsp; Nevertheless, it may still be
useful to check that internal names are more distinct then required
by the compiler to minimize the likelihood that identifiers are
confused in the program.&nbsp; Analogously to external names, the
<span class="Flag"><span style=
'font-size:10.0pt'>internal-name-length</span></span><span class="Flag">
<span style=
'font-size:10.0pt'>&nbsp;<i>&lt;number&gt;</i></span></span> flag
sets the number of significant characters in an internal name and
<span class="Flag"><span style=
'font-size:10.0pt'>internal-name-case-insensitive</span></span>
sets the case sensitivity.&nbsp; The <span class=
      "Flag"><span style='font-size:10.0pt'>internal-name-look-alike</span></span>
      flag further restricts distinctions between
      identifiers.&nbsp; When set, similar-looking characters match
      &#8212; the lowercase letter <span class=
      "CodeText"><span style='font-size:10.0pt'>l</span></span>
      matches the uppercase letter <span class=
      "CodeText"><span style='font-size:10.0pt'>I</span></span> and
      the number <span class="CodeText"><span style=
      'font-size:10.0pt'>1</span></span>; the letter <span class=
      "CodeText"><span style='font-size:10.0pt'>O</span></span> or
      <span class="CodeText"><span style=
      'font-size:10.0pt'>o</span></span> matches the number
      <span class="CodeText"><span style=
      'font-size:10.0pt'>0</span></span>; <span class=
      "CodeText"><span style='font-size:10.0pt'>5</span></span>
      matches <span class="CodeText"><span style=
      'font-size:10.0pt'>S</span></span>; and <span class=
      "CodeText"><span style='font-size:10.0pt'>2</span></span>
      matches <span class="CodeText"><span style=
      'font-size:10.0pt'>Z</span></span>.&nbsp; Identifiers that
      are not distinct except for look-alike characters will
      produce an error message.&nbsp; External names are also
      internal names, so they must satisfy both the external and
      internal distinct identifier checks.&nbsp; Figure 24 provides
      some examples of distinct name checking.</p>
<center>
<table class="MsoNormalTable" border="0" cellspacing="0"
cellpadding="0" style=
'margin-left:9.9pt;border-collapse:collapse;margin-left:-2.25pt; margin-right:-2.25pt'>
<tr>
<td valign="top" style=
'width:166.5pt;border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX" align="center" style='text-align:center'>
<span class="Keyword"><b><span style=
'font-size:10.0pt; color:white'>names.c</span></b></span></p></td>
<td valign="top" style=
'width:256.5pt;border-top:solid black 1.5pt; border-left:none;border-bottom:none;border-right:solid black 1.5pt; background:black;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX" align="center" style='text-align:center'>
<b><span style='color:white'>Running
Splint</span></b></p></td></tr>
<tr>
<td valign="top" style=
'width:166.5pt;border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt'>
<p class="Verbatim"><span class="Line"><span style=
'font-size:8.0pt'>&nbsp;</span></span>char *stringrev (char
*s);</p>
<p class="Verbatim">&nbsp;</p>
<p class="Verbatim"><span class="Line"><span style=
'font-size:8.0pt'>3</span></span> int f (int x)</p>
<p class="Verbatim"><span class="Line"><span style=
'font-size:8.0pt'>&nbsp;</span></span>&nbsp;{</p>
<p class="Verbatim"><span class="Line"><span style=
'font-size:8.0pt'>5</span></span> int lookalike = 1;</p>
<p class="Verbatim"><span class="Line"><span style=
'font-size:8.0pt'>6</span></span> int looka1ike = 2;</p>
<p class="Verbatim">&nbsp;</p>
<p class="Verbatim">&nbsp; if (x &gt; 3)</p>
<p class="Verbatim">&nbsp;&nbsp;&nbsp; {</p>
<p class="Verbatim"><span class="Line"><span style=
'font-size:8.0pt'>10</span></span>&nbsp;&nbsp;&nbsp; int x =
lookalike;</p>
<p class="Verbatim">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; x +=
looka1ike;</p>
<p class="Verbatim">&nbsp;&nbsp;&nbsp; }</p>
<p class="Verbatim">&nbsp;</p>
<p class="Verbatim">&nbsp; return x;</p>
<p class="Verbatim">}&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</p></td>
<td valign="top" style=
'width:256.5pt;border-top:none;border-left: none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
<p class="lclintrun">&gt; splint names.c
+distinctinternalnames&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</p>
<p class="lclintrun">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+internalnamelookalike&nbsp; +isoreserved</p>
<p class="lclintrun">&nbsp;</p>
<p class="lclintrun">names.c:1: Name stringreverse is reserved for
future</p>
<p class="lclintrun">&nbsp;&nbsp;&nbsp; library extensions.&nbsp;
Functions that begin with</p>
<p class="lclintrun">&nbsp;&nbsp;&nbsp; "str" and a lowercase
letter may be added to</p>
<p class="lclintrun">&nbsp;&nbsp;&nbsp; &lt;stdlib.h&gt; or
&lt;string.h&gt;. (ISO99:7.26.9)</p>
<p class="lclintrun">names.c:6: Internal identifier looka1ike is
not</p>
<p class="lclintrun">&nbsp;&nbsp;&nbsp; distinguishable from
lookalike except by lookalike</p>
<p class="lclintrun">&nbsp;&nbsp;&nbsp; characters</p>
<p class="lclintrun">&nbsp;&nbsp; names.c:5: Declaration of
lookalike</p>
<p class="lclintrun">names.c:10: Variable x shadows outer
declaration</p>
<p class="lclintrun" style='page-break-after:avoid'>&nbsp;&nbsp;
names.c:3: Previous declaration of x: int</p></td></tr></table>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
<tr>
<td valign="top" style=
'padding-top:5.05pt;padding-right: 9.35pt;padding-bottom:5.05pt;padding-left:9.35pt'>
<p class="MsoCaption"><a name="_Ref343085825"></a><a name=
"_Ref343085797"></a><a name="_Ref343065542"></a><a name=
"_Ref349992283"></a><a name="_Ref534642902"></a><a name=
"_Ref534642319"></a><a name="_Toc534824626"></a><a name=
"_Ref534823650">Figure 24</a>.&nbsp; Distinct
Names</p></td></tr></table></center>
<h1 style='margin-left:0in;text-indent:0in'><a name=
"_Ref534981356"></a><a name="_Ref534978939"></a><a name=
"_Toc534975023">13<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
<a id="completeness" name="completeness">
Completeness</a></a></h1>
<p class="TextFontCX">Splint can report warnings for unused
declarations&nbsp;and exported declarations&nbsp;that are not used
externally.</p>
<h2 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534975024"></a><a name="_Ref534744216">13.1<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Unused Declarations</a></h2>
<p class="TextFontCX">Splint detects constants, functions,
parameters, variables, types, enumerator members, and structure or
union fields that are declared but never used.&nbsp; The flags
<span class="Flag"><span style=
'font-size:10.0pt'>constuse</span></span>, <span class=
"Flag"><span style='font-size:10.0pt'>fcnuse</span></span>,
<span class="Flag"><span style=
'font-size:10.0pt'>paramuse</span></span>, <span class=
"Flag"><span style='font-size:10.0pt'>varuse</span></span>,
<span class="Flag"><span style=
'font-size:10.0pt'>typeuse</span></span>, <span class=
"Flag"><span style='font-size:10.0pt'>enummemuse</span></span> and
<span class="Flag"><span style=
'font-size:10.0pt'>fielduse</span></span> control whether unused
declaration errors are reported for each kind of declaration.&nbsp;
Errors for exported declarations are reported only if
      <span class="Flag"><span style=
      'font-size:10.0pt'>topuse</span></span> is on (see Section
      13.2).</p>
<p class="TextFontCX"><a name="_Ref349900444"></a><a name=
"_Ref349850608"></a><a name="_Ref349850429">&nbsp;</a></p>
<p class="TextFontCX">The <span class="Annot"><span style=
'font-size:10.0pt'>/*@unused@*/</span></span>&nbsp;annotation can
be used before a declaration to indicate that the item declared
need not be used.&nbsp; Unused declaration errors are not reported
for identifiers declared with <span class=
      "Annot"><span style='font-size:10.0pt'>unused</span></span><a name="_Toc344355432">
</a><a name="_Ref343110935">.</a></p>
<h2 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534975025"></a><a name="_Toc344355433"></a><a name=
"_Ref343110504">13.2<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Complete</a> Programs</h2>
<p class="TextFontCX">Splint can be used on both complete and
partial&nbsp;programs.&nbsp; When checking complete programs,
additional checks can be done to ensure that every identifier
declared by the program is defined and used, and that functions
that do not need to be exported are declared <span class=
"CodeText"><span style='font-size:10.0pt'>static</span></span>.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Splint checks that all declared variables and
functions are defined (controlled by <span class=
      "Flag"><span style='font-size:10.0pt'>compdef</span></span><span class="Flag">
<span style='font-size:10.0pt'>)</span></span>.&nbsp; Declarations
of functions and variables that are defined in an external library,
may be preceded by <span class="Annot"><span style=
'font-size:10.0pt'>/*@external@*/</span></span>&nbsp;to suppress
undefined declaration errors.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Splint reports external declarations that are
unused (controlled by <span class="Flag"><span style=
'font-size:10.0pt'>topuse</span></span>).&nbsp; Which declarations
are reported also depends on the declaration use flags (Section
13.1).&nbsp; The <span class="Flag"><span style=
'font-size:10.0pt'>+partial</span></span>&nbsp;flag sets flags for
checking a partial system.&nbsp; Top-level unused declarations,
undefined declarations, and unnecessary external names are not
reported if <span class="Flag"><span style=
'font-size:10.0pt'>+partial</span></span> is set.</p>
<h3 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534975026">13.2.1<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;</span>
Unnecessarily External Names</a></h3>
<p class="TextFontCX">Splint can report variables and functions
that are declared with global scope (i.e., without using
<span class="CodeText"><span style=
'font-size:10.0pt'>static</span></span>), that are not used outside
the file in which they are defined.&nbsp; In a stand-alone system,
these identifiers should usually be declared using
      <span class="CodeText"><span style=
      'font-size:10.0pt'>static</span></span> to limit their
      scope.&nbsp; If the <span class="Flag"><span style=
      'font-size:10.0pt'>export-static</span></span> flag is on,
      Splint will report declarations that could have file
      scope.&nbsp; It should only be used when all relevant source
      files are listed on the Splint command line; otherwise,
      variables and functions may be incorrectly identified as only
      used in the file scope since Splint did not process the other
      file in which they are used.</p>
<h3 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534975027">13.2.2<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;</span>
Declarations Missing from Headers</a></h3>
<p class="TextFontCX">A common practice in C programming styles, is
that every function or variable exported by <span class=
"Keyword"><i><span style=
'font-size:10.0pt;font-family:Arial;color:windowtext'>M</span></i></span><span class="Keyword">
<span style=
'font-size:10.0pt;font-family:Arial;color:windowtext'>.c</span></span>
is declared in <span class="Keyword"><i><span style=
'font-size:10.0pt;font-family: Arial;color:windowtext'>M</span></i></span><span class="Keyword">
<span style=
'font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>.&nbsp;
If the <span class="Flag"><span style=
'font-size:10.0pt'>export-header</span></span> flag is on, Splint
will report exported declarations in <span class=
"Keyword"><i><span style=
'font-size:10.0pt;font-family:Arial;color:windowtext'>M</span></i></span><span class="Keyword">
<span style=
'font-size:10.0pt;font-family:Arial;color:windowtext'>.c</span></span>
that are not declared in <span class=
      "Keyword"><i><span style='font-size:10.0pt; font-family:Arial;color:windowtext'>
M</span></i></span><span class="Keyword"><span style=
'font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>.</p>
<h1 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534975028"></a><a name="_Ref534642392"></a><a name=
"_Ref349900301">14<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
<a id="libraries" name="libraries">
Libraries</a> and Header File Inclusion</a></h1>
<p class="TextFontCX">Libraries can be used to record interface
information.&nbsp; A library containing information about the
standard C Library is used to enable checking of library
calls.&nbsp; Program libraries can be created to enable fast
checking of single modules in a large program.</p>
<h2 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534975029"></a><a name="_Ref534035506"></a><a name=
"_Ref348801560"></a><a name="_Ref347465531"></a><a name=
"_Ref344887939"></a><a name="_Toc344355445">14.1<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Standard Librar</a>ies</h2>
<p class="TextFontCX">In order to check calls to library functions,
Splint uses an annotated standard library.&nbsp; This contains more
information about function interfaces then is available in the
system header files since it uses annotations.&nbsp; Further, it
contains only those functions documented in the ISO C99
standard.&nbsp; Many systems include extra functions in their
system libraries; programs that use these functions cannot be
compiled on other systems that do not provide them.&nbsp; Certain
types defined by the library are treated as abstract&nbsp;types
(e.g., a program should not rely on how the <span class=
"CodeText"><span style='font-size:10.0pt'>FILE</span></span> type
is implemented).&nbsp; When checking source code, Splint does
include system headers corresponding to files in the library, but
instead uses the library description of the standard library.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">The Splint distribution includes several
different standard libraries: the ANSI standard library, the POSIX
standard library<a href="#_ftn19" name="_ftnref19" title=
""><span class="MsoFootnoteReference"><span class=
"MsoFootnoteReference"><span style=
'font-size:11.0pt;font-family:"Times New Roman"'>[19]</span></span></span></a>,
and a UNIX library based on the Open Group&#8217;s Single Unix
Specification.&nbsp; Each library comes in two versions: the
standard version and the strict version.</p>
<h3 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534975030">14.1.1<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;</span> ISO
Standard Library</a></h3>
<p class="TextFontCX">The default behavior of Splint is to use the
ISO standard library (loaded from <span class=
"CodeText"><span style=
'font-size:10.0pt'>standard.lcd</span></span>).&nbsp; This library
is based on the standard library described in the ISO C99
standard.</p>
<h3 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534975031">14.1.2<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;</span> POSIX
Library</a></h3>
<p class="TextFontCX">The POSIX library is selected by the
<span class="Flag"><span style=
'font-size:10.0pt'>+posixlib</span></span> flag.&nbsp;&nbsp; The
POSIX library is based on the IEEE Std 1003.1-1990. &nbsp;</p>
<h3 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534975032">14.1.3<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;</span> UNIX
Library</a></h3>
<p class="afterlist">The UNIX library is selected by the
<span class="Flag"><span style=
'font-size:10.0pt'>+unixlib</span></span> flag.&nbsp; This library
is based on the Open Group&#8217;s Single Unix Specification,
Version 2.&nbsp; In the UNIX library, <span class=
"CodeText"><span style='font-size:10.0pt'>free</span></span> is
declared with a non-null&nbsp;parameter.&nbsp; ISO specifies that
<span class="CodeText"><span style=
'font-size:10.0pt'>free</span></span> should handle the argument
<span class="CodeText"><span style=
'font-size:10.0pt'>NULL</span></span>, but several UNIX platforms
crash if <span class="CodeText"><span style=
'font-size:10.0pt'>NULL</span></span> is passed to
      <span class="CodeText"><span style=
      'font-size:10.0pt'>free</span></span>.</p>
<h3 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534975033">14.1.4<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;</span> Strict
Libraries</a></h3>
<p class="TextFontCX">Stricter versions of the libraries are used
is the <span class="Flag"><span style=
'font-size:10.0pt'>-ansi-strict</span></span>, <span class=
"Flag"><span style=
'font-size:10.0pt'>posix-strict-lib</span></span>&nbsp;or
<span class="Flag"><span style=
'font-size:10.0pt'>unix-strict-lib</span></span>&nbsp;flag is used.
These libraries use a stricter interpretation of the library.&nbsp;
They will detect more errors in some programs, but may to produce
many spurious errors for typical code.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="beforelist">The differences between the standard
libraries and the strict libraries are:</p>
<p class="MsoListBullet"><span style=
'font-family:Symbol'>&#183;<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
The standard libraries declare the printing functions
      (<span class="CodeText"><span style=
      'font-size:10.0pt'>fprintf</span></span>, <span class=
      "CodeText"><span style=
      'font-size:10.0pt'>printf</span></span>, and <span class=
      "CodeText"><span style=
      'font-size:10.0pt'>sprintf</span></span>) that may return
      error codes to return <span class="CodeText"><span style=
      'font-size:10.0pt'>int</span></span> or <span class=
      "CodeText"><span style=
      'font-size:10.0pt'>void</span></span>.&nbsp; This prevents
      typical programs from leading to deluge of ignored return
      value errors, but may mean some relevant errors are not
      detected.&nbsp; In the strict library, they are declared to
      return <span class="CodeText"><span style=
      'font-size:10.0pt'>int</span></span>, so ignored return value
      errors will be reported (depending on other flag
      settings).&nbsp; Programs should check that this return value
      is non-negative.</p>
<p class="MsoListBullet"><span style=
'font-family:Symbol'>&#183;<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
The standard libraries declare some parameters and return values to
be alternate types (<span class="CodeText"><span style=
'font-size:10.0pt'>int</span></span> or <span class=
"CodeText"><span style='font-size:10.0pt'>bool</span></span>, or
<span class="CodeText"><span style=
'font-size:10.0pt'>int</span></span> or <span class=
"CodeText"><span style=
'font-size:10.0pt'>char</span></span>).&nbsp; The ISO C99 standard
specifies these types as <span class="CodeText"><span style=
'font-size: 10.0pt'>int</span></span> to be compatible with older
versions of the library, but logically they make more sense as
<span class="CodeText"><span style=
'font-size:10.0pt'>bool</span></span> or <span class=
"CodeText"><span style='font-size:10.0pt'>char</span></span>.&nbsp;
In the strict library, the stronger type is used.&nbsp; The
parameter to <span class="CodeText"><span style=
'font-size:10.0pt'>assert</span></span>&nbsp;is <span class=
"CodeText"><span style='font-size:10.0pt'>int</span></span> or
<span class="CodeText"><span style=
'font-size:10.0pt'>bool</span></span> in the standard library, and
<span class="CodeText"><span style=
'font-size:10.0pt'>bool</span></span> in the strict library.&nbsp;
The parameter to the character functions <span class=
"CodeText"><span style='font-size:10.0pt'>isalnum</span></span>,
<span class="CodeText"><span style=
'font-size:10.0pt'>isalpha</span></span>, <span class=
"CodeText"><span style='font-size:10.0pt'>iscntrl</span></span>,
<span class="CodeText"><span style=
'font-size:10.0pt'>isdigit</span></span>, <span class=
"CodeText"><span style='font-size:10.0pt'>isgraph</span></span>,
<span class="CodeText"><span style=
'font-size:10.0pt'>islower</span></span>, <span class=
"CodeText"><span style='font-size:10.0pt'>isprint</span></span>,
<span class="CodeText"><span style=
'font-size:10.0pt'>ispunct</span></span>, <span class=
"CodeText"><span style='font-size:10.0pt'>isspace</span></span>,
<span class="CodeText"><span style=
'font-size:10.0pt'>isupper</span></span>, <span class=
"CodeText"><span style='font-size:10.0pt'>isxdigit</span></span>,
<span class="CodeText"><span style=
'font-size:10.0pt'>tolower</span></span>&nbsp;and
      <span class="CodeText"><span style=
      'font-size:10.0pt'>toupper</span></span>&nbsp;is <span class=
      "CodeText"><span style='font-size:10.0pt'>char</span></span>
      or <span class="CodeText"><span style=
      'font-size:10.0pt'>unsigned char</span></span> or
      <span class="CodeText"><span style=
      'font-size:10.0pt'>int</span></span> in the standard library
      and <span class="CodeText"><span style=
      'font-size:10.0pt'>char</span></span> in the strict
      library.&nbsp; The type of the return value of the character
      classification functions (all of the previous character
      functions except <span class="CodeText"><span style=
      'font-size:10.0pt'>tolower</span></span> and <span class=
      "CodeText"><span style=
      'font-size:10.0pt'>toupper</span></span>) is <span class=
      "CodeText"><span style='font-size:10.0pt'>bool</span></span>
      or <span class="CodeText"><span style=
      'font-size:10.0pt'>int</span></span> in the standard library
      and <span class="CodeText"><span style=
      'font-size:10.0pt'>bool</span></span> in the strict
      library.&nbsp; The type of the first parameter to
      <span class="CodeText"><span style=
      'font-size:10.0pt'>ungetc</span></span> is <span class=
      "CodeText"><span style='font-size:10.0pt'>char</span></span>
      or <span class="CodeText"><span style=
      'font-size:10.0pt'>int</span></span> in the standard library
      and <span class="CodeText"><span style=
      'font-size:10.0pt'>char</span></span> in the strict library
      (<span class="CodeText"><span style=
      'font-size:10.0pt'>EOF</span></span> should not be passed to
      <span class="CodeText"><span style=
      'font-size:10.0pt'>ungetc</span></span>).&nbsp; The second
      parameter to <span class="CodeText"><span style=
      'font-size:10.0pt'>strchr</span></span>&nbsp;and <span class=
      "CodeText"><span style=
      'font-size:10.0pt'>strrchr</span></span>&nbsp;is <span class=
      "CodeText"><span style='font-size:10.0pt'>char</span></span>
      or <span class="CodeText"><span style=
      'font-size:10.0pt'>int</span></span> in the standard library
      and <span class="CodeText"><span style=
      'font-size:10.0pt'>char</span></span> in the strict
      library.</p>
<p class="MsoListBullet"><span style=
'font-family:Symbol'>&#183;<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
The global variables <span class="CodeText"><span style=
'font-size:10.0pt'>stdin</span></span>, <span class=
"CodeText"><span style=
'font-size:10.0pt'>stdout</span></span>&nbsp;and <span class=
"CodeText"><span style=
'font-size:10.0pt'>stderr</span></span>&nbsp;are declared as
<span class="CodeText"><span style=
'font-size:10.0pt'>unchecked</span></span> variables (see Section
7.2) in the standard libraries.&nbsp; In the strict libraries, they
are<span class="CodeText"><span style=
'font-size:10.0pt'>checked</span></span>.</p>
<p class="MsoListBullet"><span style=
'font-family:Symbol'>&#183;<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
The global variable <span class="CodeText"><span style=
'font-size:10.0pt'>errno</span></span>&nbsp;is declared
      <span class="CodeText"><span style=
      'font-size:10.0pt'>unchecked</span></span>&nbsp;in the
      standard libraries, but declared <span class=
      "CodeText"><span style=
      'font-size:10.0pt'>checkedstrict</span></span>&nbsp;in the
      strict libraries.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">If no library flag is used, Splint will load
the standard library, <span class="Keyword"><span style=
'font-size:10.0pt;font-family:Arial;color:windowtext'>standard.lcd</span></span>.&nbsp;
If <span class="Flag"><span style=
'font-size:10.0pt'>+nolib</span></span> is set, no library is
loaded.&nbsp; The library source files can easily be modified, and
new libraries created to better suit a particular application.</p>
<h2 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534975034"></a><a name="_Toc344355447">14.2<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Generating Libraries</a></h2>
<p class="TextFontCX">To enable running Splint on large systems,
mechanisms are provided for creating libraries containing necessary
information.&nbsp; This means source files can be checked
independently, after a library has been created. The command line
option <span class="Flag"><span style=
'font-size:10.0pt'>-dump</span></span> <span class=
"Flag"><span style='font-size:10.0pt'><i>library</i></span></span>
stores information in the file <span class=
      "Keyword"><i><span style='font-size:10.0pt; font-family:Arial;color:windowtext'>
library</span></i></span> (the default extension <span class=
"Keyword"><span style=
'font-size:10.0pt;font-family:Arial; color:windowtext'>.lcd</span></span>
is added). Then, <span class="Flag"><span style=
'font-size:10.0pt'>-load</span></span> <span class=
"Flag"><span style='font-size:10.0pt'><i>library</i></span></span>
loads the library.&nbsp; The library contains interface information
from the files checked when the library was created.</p>
<h3 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534975035">14.2.1<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;</span> Generating
the Standard Libraries</a></h3>
<p class="TextFontCX">The standard libraries are generated from
header files included in the Splint distribution.&nbsp; Some
libraries are generated from more than one header file.&nbsp; Since
the POSIX library subsumes the standard library, the headers for
the standard and POSIX libraries are combined to produce the POSIX
library.&nbsp; Similarly, the UNIX library is composed of the
standard, POSIX and UNIX headers.&nbsp; The header files include
some sections that are conditionally selected by defining
<span class="CodeText"><span style=
'font-size:10.0pt'>STRICT</span></span>.&nbsp; The commands to
generate the standard libraries are:</p>
<p class="example" style=
'margin-top:0in;margin-right:.2in;margin-bottom:0in; margin-left:.2in;margin-bottom:.0001pt'>
splint -nolib ansi.h -dump ansi</p>
<p class="example" style=
'margin-top:0in;margin-right:.2in;margin-bottom:0in; margin-left:.2in;margin-bottom:.0001pt'>
splint -nolib -DSTRICT ansi.h -dump ansistrict</p>
<p class="example" style=
'margin-top:0in;margin-right:.2in;margin-bottom:0in; margin-left:.2in;margin-bottom:.0001pt'>
splint -nolib ansi.h posix.h -dump posix</p>
<p class="example" style=
'margin-top:0in;margin-right:.2in;margin-bottom:0in; margin-left:.2in;margin-bottom:.0001pt'>
splint -nolib -DSTRICT ansi.h posix.h -dump posixstrict</p>
<p class="example" style=
'margin-top:0in;margin-right:.2in;margin-bottom:0in; margin-left:.2in;margin-bottom:.0001pt'>
splint -nolib ansi.h posix.h unix.h -dump unix</p>
<p class="example" style=
'margin-top:0in;margin-right:.2in;margin-bottom:0in; margin-left:.2in;margin-bottom:.0001pt'>
splint -nolib -DSTRICT ansi.h posix.h unix.h -dump unixstrict</p>
<h2 style='margin-left:0in;text-indent:0in'><a name=
"_Ref534979539"></a><a name="_Toc534975036"></a><a name=
"_Ref348080056"></a><a name="_Toc344355448">14.3<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
Header File Inclusion</a></h2>
<p class="TextFontCX">The standard behavior of Splint on
encountering</p>
<p class="example"><span class="Keyword"><span style=
'font-size:10.0pt'>#include &lt;<i>X</i>.h&gt;</span></span></p>
<p class="TextFontCX">is to search for a file named
      <span class="Keyword"><i><span style=
      'font-size:10.0pt;font-family:Arial; color:windowtext'>X</span></i></span><span class="Keyword">
<span style=
'font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>
on the include search path (set using <span class=
"Flag"><span style='font-size: 10.0pt'>&#8211;I</span></span>) and
then the system base include path (read from the <span class=
"CodeText"><span style='font-size:10.0pt'>include</span></span>
environment variable if set or using a default value, usually
<span class="Keyword"><span style=
'font-size:10.0pt;font-family:Arial;color:windowtext'>/usr/include</span></span>).&nbsp;
If <span class="Keyword"><i><span style=
'font-size:10.0pt;font-family:Arial; color:windowtext'>X</span></i></span><span class="Keyword">
<span style=
'font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>
is the name of a header file in a loaded standard library and
<span class="Keyword"><i><span style=
'font-size:10.0pt;font-family:Arial;color:windowtext'>X</span></i></span><span class="Keyword">
<span style=
'font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>
is found in a directory that is a system directory (as set by the
<span class="Flag"><span style=
'font-size:10.0pt'>-sysdirs</span></span> flag; the default is
<span class="Keyword"><span style=
'font-size:10.0pt;font-family:Arial;color:windowtext'>/usr/include</span></span>),
<span class="Keyword"><i><span style=
'font-size:10.0pt;font-family:Arial; color:windowtext'>X</span></i></span><span class="Keyword">
<span style=
'font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>
will not be included if <span class="Flag"><span style=
'font-size:10.0pt'>+skip-iso-headers</span></span>&nbsp;or
<span class="Flag"><span style=
'font-size:10.0pt'>+skip-posix-headers</span></span>&nbsp;(depending
on whether <span class="Keyword"><i><span style=
'font-size:10.0pt;font-family:Arial;color:windowtext'>X</span></i></span><span class="Keyword">
<span style=
'font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>
is an ISO or POSIX header file) is on (both are on by
default).&nbsp; To force all headers to be included normally, use
<span class="Flag"><span style=
'font-size: 10.0pt'>&#8209;skip-iso-headers</span></span>.&nbsp;</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Sometimes headers in system directories
contain non-standard syntax that Splint is unable to parse.&nbsp;
The <span class="Flag"><span style=
'font-size:10.0pt'>+skip-sys-headers</span></span>&nbsp;flag may be
used to prevent any include file in a system directory from being
included.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Splint is fast enough that it can be run on
medium-size (10,000 line) programs without performance
concerns.&nbsp; Libraries can be used to enable efficient checking
of small modules in large programs.&nbsp; To further improve
performance, header file inclusion can be optimized.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">When processing a complete system in which
many files include the same headers, a large fraction of processing
time is wasted re-reading header files unnecessarily.&nbsp; If you
are checking a 100-file program, and every file includes
<span class="Flag"><span style=
'font-size:10.0pt;font-family:Arial;color:windowtext'>utils.h</span></span>,
Splint will have to process <span class=
      "Keyword"><span style='font-size:10.0pt; font-family:Arial;color:windowtext'>
utils.h</span></span> 100 times (as would most C compilers).&nbsp;
If the <span class="Flag"><span style=
'font-size:10.0pt'>+single-include</span></span> flag is used, each
header file is processed only once.&nbsp; Single header file
processing produces a significant efficiency improvement when
checking large programs split into many files, but is only safe if
the same header file included in different contexts always has the
same meaning (i.e., it does not depend on preprocessor variable
defined differently at different inclusion sites).</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">When processing a single file in a large
system, a large fraction of the time is spent processing included
header files.&nbsp; This can be avoided if the information in the
header files is stored in a library instead.&nbsp; If
      <span class="Flag"><span style=
      'font-size:10.0pt'>+never-include</span></span> is set,
      inclusion of files ending in <span class="Flag"><span style=
      'font-size: 10.0pt;font-family:Arial;color:windowtext'>.h</span></span>
      is prevented.&nbsp; Files with different suffixes are
      included normally.&nbsp; To do this the header files must not
      include any expanded macros. That is, the header file must be
      processed with <span class="Flag"><span style=
      'font-size:10.0pt'>+all-macros</span></span>, and there must
      be no <span class="Annot"><span style=
      'font-size:10.0pt'>/*@notfunction@*/</span></span>&nbsp;control
      comments in the header.&nbsp; Then, the <span class=
      "Flag"><span style=
      'font-size:10.0pt'>+never-include</span></span> flag may be
      used to prevent inclusion of header files.&nbsp; Alternately,
      non-function macros can be moved to a different file with a
      name that does not end in <span class="Keyword"><span style=
      'font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>.&nbsp;
      Remember, that this file must be included directly from the
      <span class="Keyword"><span style=
      'font-size:10.0pt;font-family:Arial;color:windowtext'>.c</span></span>
      file, since if it is included from an <span class=
      "Keyword"><span style=
      'font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>
      file indirectly, that <span class="Keyword"><span style=
      'font-size:10.0pt; font-family:Arial;color:windowtext'>.h</span></span>
      file is ignored so the other file is never included.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">These options can be used for significant
performance improvements on large systems.&nbsp; The performance
depends on how the code is structured, but checking a single module
in a large program is several times faster if libraries and
<span class="Flag"><span style=
'font-size:10.0pt'>+noinclude</span></span> are used.</p>
<h3 style='margin-left:0in;text-indent:0in'><a name=
"_Toc534975037">14.3.1<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;</span>
Preprocessing Constants</a></h3>
<p class="TextFontCX">Splint defines the preprocessor constant
<span class="CodeText"><span style=
'font-size:10.0pt'>S_SPLINT_S</span></span> when preprocessing
source files.&nbsp; If you want to include code that is processed
only when Splint is used, surround the code with</p>
<p class="TextFontCX" align="left" style='text-align: left'>
<span class="Keyword"><span style=
'font-size:10.0pt'>&nbsp;</span></span></p>
<p class="TextFontCX" align="left" style='text-align: left'>
<span class="Keyword"><span style='font-size:10.0pt'># ifdef
S_SPLINT_S</span></span></p>
<p class="TextFontCX" align="left" style='text-align: left'>
&nbsp;&nbsp;&nbsp;&nbsp; &#8230;</p>
<p class="TextFontCX"><span class="Keyword"><span style=
'font-size:10.0pt'># endif</span></span></p>
<p class="MsoHeading7" style='margin-left:0in;text-indent:0in'>
<a name="_Toc534975038"></a><a name="_Toc344355451"></a><a name=
"_Ref343065611">Appendix A<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
<a id="availability" name="availability">
Availability</a></a></p>
<p class="afterlist">The web home page for Splint is
      <span class="Keyword"><span style=
      'font-size:10.0pt;font-family:Arial;color:windowtext'><a href=
      "http://www.splint.org/">http://www.splint.org</a></span></span>.&nbsp;
      It includes this guide in HTML format, samples demonstrating
      Splint, and links to related web sites.&nbsp; Splint is
      available as source code and binary executables for several
      platforms.&nbsp; Splint may be freely distributed and
      modified under the GNU General Public License.&nbsp; The
      latest development code is available through SourceForge.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">Splint development is largely driven by
suggestions and comments from users.&nbsp; We are also very
interested in hearing about your experiences using Splint in
developing or maintaining programs, enforcing coding standards, or
teaching courses.&nbsp; For general information, suggestions, and
questions on Splint send mail to <span class=
      "Keyword"><span style='font-size:10.0pt;font-family:Arial;color:windowtext'>
splint@cs.virginia.edu</span></span>.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">To report a bug in Splint send a message to
<span class="Keyword"><span style=
'font-size:10.0pt;font-family: Arial;color:windowtext'>splint-bug@cs.virginia.edu</span></span>.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="beforelist">There are two mailing lists associated with
Splint:</p>
<p class="URL"><span class="Keyword"><span style=
'font-family:Arial;color:windowtext'>splint-announce@virginia.edu</span></span></p>
<p class="IndentText">Reserved for announcements of new releases
and bug fixes.&nbsp; All users should add themselves to this
list.&nbsp;</p>
<p class="URL"><span class="Keyword"><span style=
'font-family:Arial;color:windowtext'>splint-interest@virginia.edu</span></span></p>
<p class="IndentText">Informal discussions on the use and
development of Splint.&nbsp;</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX"><a name="_Ref344882161"></a><a name=
"_Ref344871249"></a><a name="_Ref344870532"></a><a name=
"_Ref344870294">To subscribe to a mailing list, send a message
to</a> <span class="PlainText"><span style=
'font-size:10.0pt;font-family:Arial'>majordomo@virginia.edu</span></span>
containing the body</p>
<p class="URL"><span class="Keyword"><span style=
'font-family:Arial;color:windowtext'>subscribe
splint-announce</span></span><span style=
'font-size:11.0pt;font-family:"Times New Roman"'>or</span>
<span class="Keyword"><span style=
'font-family:Arial;color:windowtext'>subscribe
splint-interest</span></span><a name=
   "_Ref348343340"></a><a name="_Ref348330382">.</a></p>
<p class="MsoHeading7" style='margin-left:0in;text-indent:0in'>
<a name="_Toc534975039"></a><a name="_Ref397875360">Appendix
B<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
<a id="flags" name="flags">
Flags</a>
</a><a name="_Toc344355437"></a></p>
<p class="beforelist">There are four different types of flags:</p>
<p class="MsoListBullet"><span style=
'font-family:Symbol'>&#183;<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
Global flags for controlling initializations and global
behavior</p>
<p class="MsoListBullet"><span style=
'font-family:Symbol'>&#183;<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
Message format flags for controlling how messages are displayed</p>
<p class="MsoListBullet"><span style=
'font-family:Symbol'>&#183;<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
Mode selectors for coarse control of Splint checking</p>
<p class="MsoListBullet"><span style=
'font-family:Symbol'>&#183;<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
Checking flags that control checking and what classes of messages
are reported.</p>
<p class="afterlist">Global flags can be used in initialization
files and at the command line; all other flags may also be used in
control comments.</p>
<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
<a name="_Toc534975050">Key</a></p>
<p class="beforelist">To the left of each flag name is a flag
descriptor encoding what kind of flag it is and its default
value.&nbsp; The descriptions are:</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class="Flag"><span style=
'font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX">A <i>plain</i> flag.&nbsp; The value after
the colon gives the default setting (e.g., this flag is
off.)&nbsp;</p>
<p class="TextFontCX">&nbsp;</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class="Flag"><span style=
'font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
<p class="TextFontCX">A <i>mode checking flag</i>.&nbsp; The value
of the flag is set by the mode selector.&nbsp; The four signs give
the setting in the weak, standard, checks and strict modes. (e.g.,
this flag is off in the weak and standard modes, and on in the
checks and strict modes.)</p>
<p class="TextFontCX">&nbsp;</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
<p class="TextFontCX">A <i>shortcut</i> flag.&nbsp; This flag sets
other flags, so it has no default value.</p>
<p class="MsoHeading8" style='margin-left:0in;text-indent:0in'>
<a name="_Toc534975061">Flag Name Abbreviations</a></p>
<p class="beforelist">Within a flag name, abbreviations may be
used. &nbsp;Figure 25 shows the flag name abbreviations.&nbsp; The
expanded and short forms are interchangeable in flag names.</p>
<center>
<table class="MsoNormalTable" border="0" cellspacing="0"
cellpadding="0" style=
'margin-left:99.9pt;border-collapse:collapse;margin-left:-2.25pt; margin-right:-2.25pt'>
<tr>
<td valign="top" style=
'width:171.0pt;border:none;border-bottom:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX" align="center" style='text-align:center'>
Expanded Form</p></td>
<td valign="top" style=
'width:67.5pt;border:none;border-bottom:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX" align="center" style='text-align:center'>
Short Form</p></td></tr>
<tr>
<td valign="top" style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>constant</span></span></p></td>
<td valign="top" style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>const</span></span></p></td></tr>
<tr>
<td valign="top" style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>declaration</span></span></p></td>
<td valign="top" style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>decl</span></span></p></td></tr>
<tr>
<td valign="top" style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>function</span></span></p></td>
<td valign="top" style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>fcn</span></span></p></td></tr>
<tr>
<td valign="top" style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>global</span></span></p></td>
<td valign="top" style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>glob</span></span></p></td></tr>
<tr>
<td valign="top" style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>implicit</span></span><span class=
"Flag"><span style=
'font-size:10.0pt;font-family:"Times New Roman"'>,</span></span>
<span class="Flag"><span style=
'font-size:10.0pt'>implied</span></span></p></td>
<td valign="top" style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>imp</span></span></p></td></tr>
<tr>
<td valign="top" style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>iterator</span></span></p></td>
<td valign="top" style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>iter</span></span></p></td></tr>
<tr>
<td valign="top" style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>length</span></span></p></td>
<td valign="top" style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>len</span></span></p></td></tr>
<tr>
<td valign="top" style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>modifies</span></span></p></td>
<td valign="top" style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>mods</span></span></p></td></tr>
<tr>
<td valign="top" style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>modify</span></span></p></td>
<td valign="top" style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>mod</span></span></p></td></tr>
<tr>
<td valign="top" style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>memory</span></span></p></td>
<td valign="top" style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>mem</span></span></p></td></tr>
<tr>
<td valign="top" style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>parameter</span></span></p></td>
<td valign="top" style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>param</span></span></p></td></tr>
<tr>
<td valign="top" style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>pointer</span></span></p></td>
<td valign="top" style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX" style='page-break-after: avoid'>
      <span class="Flag"><span style=
      'font-size:10.0pt'>ptr</span></span></p></td></tr>
<tr>
<td valign="top" style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>return</span></span></p></td>
<td valign="top" style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>ret</span></span></p></td></tr>
<tr>
<td valign="top" style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>variable</span></span></p></td>
<td valign="top" style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>var</span></span></p></td></tr>
<tr>
<td valign="top" style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>unconstrained, unconst</span></span></p></td>
<td valign="top" style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX" style='page-break-after: avoid'>
      <span class="Flag"><span style=
      'font-size:10.0pt'>uncon</span></span></p></td></tr></table>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
<tr>
<td valign="top" style=
'padding-top:.1in;padding-right: 9.35pt;padding-bottom:.1in;padding-left:9.35pt'>
<p class="MsoCaption"><a name="_Toc534824627"></a><a name=
"_Ref534824456">Figure 25</a>.&nbsp; Flag Name
Abbreviations</p></td></tr></table></center>
<p class="beforelist">The expanded and short forms are
interchangeable in flag names.</p>
<p class="beforelist">For example, <span class=
      "Flag"><span style='font-size:10.0pt'>globsimpmodsnothing</span></span>
      and <span class="Flag"><span style=
      'font-size:10.0pt'>globalsimpliesmodifiesnothing</span></span>
      denote the same flag.&nbsp; Abbreviations in flag names allow
      pronounceable, descriptive names to be used without making
      flag names excessively long (although one must admit even
      <span class="Flag"><span style=
      'font-size:10.0pt'>globsimpmodsnothing</span></span> is a bit
      of a mouthful.)</p>
<p class="TextFontCX">To make flag names more readable, the space,
dash (<span class="Flag"><span style=
'font-size:10.0pt'>-</span></span>), and underscore
      (<span class="Flag"><span style=
      'font-size:10.0pt'>_</span></span>) characters may be used
      inside a flag name.&nbsp; Hence, <span class=
      "Flag"><span style=
      'font-size:10.0pt'>globals-implies-modifies-nothing</span></span>,
      <span class="Flag"><span style=
      'font-size:10.0pt'>glob_imps_&#173;mods&#173;nothing</span></span>
      and <span class="Flag"><span style=
      'font-size:10.0pt'>globsimpmodsnothing</span></span> are
      equivalent.</p>
<p class="MsoHeading8" style='margin-left:0in;text-indent:0in'>
<a name="_Toc534975040">Global Flags</a></p>
<p class="TextFontCX">Global flags can be set at the command line
or in an options file, but cannot be set locally using stylized
comments.&nbsp; These flags control on-line help, initialization
files, pre-processor flags, libraries and output.</p>
<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
<a name="_Toc534975041">Help</a></p>
<p class="beforelist">On-line help provides documentation on Splint
operation and flags.&nbsp; When a help flag is used, no checking is
done by Splint.&nbsp; Help flags may be preceded by
      <span class="Flag"><span style=
      'font-size:10.0pt'>-</span></span> or <span class=
      "Flag"><span style='font-size:10.0pt'>+</span></span>.</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>help</span></span></p>
<p class="IndentText">Display general help overview, including list
of additional help topics.</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>help</span></span> <span class=
"Flag"><span style=
'font-size:10.0pt'>&lt;topic&gt;</span></span></p>
<p class="indentbefore">Display help on <i>&lt;topic&gt;</i>.
Available topics:</p>
<table class="MsoNormalTable" border="0" cellspacing="0"
cellpadding="0" style=
'width:400.5pt;margin-left:27.9pt;border-collapse:collapse'>
<tr>
<td valign="top" style=
'width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX" style='text-indent:5.4pt'><span class=
"Flag"><span style=
'font-size:10.0pt'>annotations</span></span></p></td>
<td valign="top" style=
'width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX" align="left" style='text-align:left'>describe
annotations</p></td></tr>
<tr>
<td valign="top" style=
'width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>comments</span></span></p></td>
<td valign="top" style=
'width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX" align="left" style='text-align:left'>describe
control comments</p></td></tr>
<tr>
<td valign="top" style=
'width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>flags</span></span></p></td>
<td valign="top" style=
'width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX" align="left" style='text-align:left'>describe
flag categories</p></td></tr>
<tr>
<td valign="top" style=
'width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>flags
<i>&lt;category&gt;</i></span></span></p></td>
<td valign="top" style=
'width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX" align="left" style='text-align:left'>all
flags pertaining to &lt;category&gt; (one of the categories listed
by <span class="Flag"><span style='font-size:10.0pt'>splint -help
flags</span></span>)</p></td></tr>
<tr>
<td valign="top" style=
'width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>flags alpha</span></span>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</p></td>
<td valign="top" style=
'width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX" align="left" style='text-align:left'>all
flags in alphabetical order</p></td></tr>
<tr>
<td valign="top" style=
'width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>flags full</span></span></p></td>
<td valign="top" style=
'width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX" align="left" style='text-align:left'>print a
full description of all flags</p></td></tr>
<tr>
<td valign="top" style=
'width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>mail</span></span></p></td>
<td valign="top" style=
'width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX" align="left" style='text-align:left'>print
information on mailing lists</p></td></tr>
<tr>
<td valign="top" style=
'width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>modes</span></span></p></td>
<td valign="top" style=
'width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX" align="left" style='text-align:left'>flags
settings in modes</p></td></tr>
<tr>
<td valign="top" style=
'width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>prefixcodes</span></span></p></td>
<td valign="top" style=
'width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX" align="left" style='text-align:left'>
character codes for setting namespace prefixes</p></td></tr>
<tr>
<td valign="top" style=
'width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>references</span></span></p></td>
<td valign="top" style=
'width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX" align="left" style='text-align:left'>print
references to relevant papers and web sites</p></td></tr>
<tr>
<td valign="top" style=
'width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>vars</span></span></p></td>
<td valign="top" style=
'width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX" align="left" style='text-align:left'>describe
environment variables</p></td></tr>
<tr>
<td valign="top" style=
'width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>version</span></span></p></td>
<td valign="top" style=
'width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>
<p class="TextFontCX" align="left" style='text-align:left'>print
maintainer and version information</p>
<p class="TextFontCX" align="left" style='text-align:left'>
&nbsp;</p></td></tr></table>
<p class="afterlist"><span class="Flag"><span style=
'font-size:10.0pt'>help</span></span> <span class=
"Flag"><span style=
'font-size:10.0pt'>&lt;flag&gt;</span></span></p>
<p class="IndentText">Describe flag <i>&lt;flag&gt;</i>.&nbsp; (May
list several flags.)</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>warn-flags</span></span></p>
<p class="IndentText">Display a warning when a flag is set in a
surprising way.&nbsp; An error is reported if an obsolete flag is
set, a flag is set to its current value (i.e., the
      <span class="Flag"><span style=
      'font-size:10.0pt'>+</span></span> or <span class=
      "Flag"><span style='font-size:10.0pt'>-</span></span> may be
      wrong), or a mode selector flag is set after mode checking
      flags that will be reset by the mode were set.&nbsp; By
      default, <span class="Flag"><span style=
      'font-size:10.0pt'>+warn-flags</span></span> is on. &nbsp;To
      suppress flag warnings, use <span class="Flag"><span style=
      'font-size:10.0pt'>&#8209;warn-flags</span></span>.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>warn-rc</span></span></p>
<p class="IndentText">There was a problem reading an initialization
file.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>bad-flag</span></span></p>
<p class="IndentText">A flag is not recognized or used in an
incorrect way.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>fileextensions</span></span></p>
<p class="IndentText">Warn when command line file does not have a
recognized extension.</p>
<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
<a name="_Toc534975042">Initialization</a></p>
<p class="beforelist">These flags control directories and files
used by Splint.&nbsp; They may be used from the command line or in
an options file, but may not be used as control comments in the
source code.&nbsp; Except where noted. they have the same meaning
preceded by <span class="Flag"><span style=
'font-size:10.0pt'>-</span></span> or <span class=
"Flag"><span style='font-size:10.0pt'>+</span></span>.&nbsp;</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>tmpdir</span></span> <span class=
"Flag"><span style=
'font-size:10.0pt'><i>&lt;directory&gt;</i></span></span></p>
<p class="IndentText">Set directory for writing temp files.&nbsp;
Default is <span class="ProgramNameChar"><span style=
'font-size:10.0pt'>/tmp/</span></span>.</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>I<i>&lt;directory&gt;</i></span></span></p>
<p class="IndentText">Add directory to path searched for C include
files.&nbsp; Note there is no space after the <span class=
"Flag"><span style='font-size:10.0pt'>I</span></span>, to be
consistent with C preprocessor flags.</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>S<i>&lt;directory&gt;</i></span></span></p>
<p class="IndentText">Add directory to path search for
      <span class="ProgramNameChar"><span style=
      'font-size:10.0pt'>.lcl</span></span> specification
      files.</p>
<p class="IndentText">&nbsp;</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>larchpath</span></span> <span class=
"Flag"><span style=
'font-size:10.0pt'><i>&lt;path&gt;</i></span></span></p>
<p class="IndentText">Set path to search for library files.&nbsp;
Overrides <span class="CodeText"><span style=
'font-size:10.0pt'>LARCH_PATH</span></span>&nbsp;environment
variable.</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>lclimportdir</span></span> <span class=
"Flag"><span style=
'font-size:10.0pt'><i>&lt;directory&gt;</i></span></span></p>
<p class="IndentText">Set directory to search for LCL import
files.&nbsp; Overrides<span class="CodeText"><span style=
'font-size:10.0pt'>LCLIMPORTDIR</span></span> environment
variable.</p>
<p class="IndentText">&nbsp;</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>f</span></span> <span class=
      "Flag"><span style='font-size:10.0pt'><i>&lt;file&gt;</i></span></span></p>
<p class="MsoNormal" style='margin-left:13.5pt'>Load options from
<span class="Flag"><i><span style=
'font-size:10.0pt'>&lt;file&gt;</span></i></span>.&nbsp; If this
flag is used from the command line, the default <span class=
"FileNameChar"><span style=
'font-size:10.0pt'>~/.splintrc</span></span> file is not
loaded.&nbsp; This flag may be used in an options file to include
another options file.</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>i</span></span> <span class=
      "Flag"><span style='font-size:10.0pt'><i>&lt;file&gt;</i></span></span></p>
<p class="MsoNormal" style='margin-left:13.5pt'>Set LCL
initialization file.</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>nof</span></span></p>
<p class="IndentText">Prevents the default options files
(<span class="FileNameChar"><span style=
'font-size:10.0pt'>./.splintrc</span></span>and <span class=
"FileNameChar"><span style=
'font-size:10.0pt'>~/.splintrc</span></span>) from being
loaded.&nbsp; (Setting <span class="Flag"><span style=
'font-size:10.0pt'>-nof</span></span> overrides <span class=
"Flag"><span style='font-size:10.0pt'>+nof</span></span>, causing
the options files to be loaded normally.)</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>sys-dirs</span></span></p>
<p class="IndentText">Set directories for system files (default is
<span class="FileNameChar"><span style=
'font-size:10.0pt'>/usr/</span></span>).&nbsp; Separate directories
with the path separator for your operating system (e.g.,
semi-colons for Windows or colons for Unix: <span class=
"FileNameChar"><span style=
'font-size:10.0pt'>/usr/include:/usr/local/lib</span></span>).&nbsp;
Flag settings propagate to files in a system directory.&nbsp; If
<span class="Flag"><span style=
'font-size:10.0pt'>-sys-dir-errors</span></span> is set, no errors
are reported for files in system directories.</p>
<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
<a name="_Toc534975043"></a><a name=
"_Ref345883190">Pre-processor</a></p>

<p class="beforelist">These flags are used to define or undefine
pre-processor constants.&nbsp; The <span class=
      "Flag"><span style='font-size:10.0pt'>-I<i>&lt;directory&gt;</i></span></span>
      flag is also passed to the C pre-processor.</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>D&lt;initializer&gt;</span></span></p>
<p class="IndentText">Passed to the C pre-processor.</p>

<p class="FileName0" style='margin-left:0in'><span class=
"Flag">U&lt;initializer&gt;</span></p>
<p class="IndentText">Passed to the C pre-processor.</p>

<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>unrecogdirective</span></span></p>
<p class="IndentText">Preprocessor directive is not recognized.
</p>

<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>preproc</span></span></p>
<p class="IndentText">Preprocessing error.
</p>


<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
<a name="_Toc534975044">Libraries</a></p>
<p class="beforelist">These flags control the creation and use of
libraries.</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>dump</span></span> <span class=
"Flag"><span style=
'font-size:10.0pt'><i>&lt;file&gt;</i></span></span></p>
<p class="IndentText">Save state in <span class=
"Flag"><i><span style=
'font-size: 10.0pt'>&lt;file&gt;</span></i></span> for
loading.&nbsp; The default extension <span class=
"ProgramNameChar"><span style='font-size:10.0pt'>.lcd</span></span>
is added if <span class="Flag"><i><span style=
'font-size:10.0pt'>&lt;file&gt;</span></i></span> has no
extension.</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>load</span></span><span class=
      "Flag"><span style='font-size:10.0pt'>&nbsp;<i>&lt;file&gt;</i></span></span></p>
<p class="IndentText">Load state from <span class=
"Flag"><i><span style=
'font-size: 10.0pt'>&lt;file&gt;</span></i></span> (created by
<span class="Flag"><span style=
'font-size:10.0pt'>-dump</span></span>).&nbsp; The default
extension <span class="FileNameChar"><span style=
'font-size:10.0pt'>.lcd</span></span> is added if
      <span class="Flag"><i><span style=
      'font-size:10.0pt'>&lt;file&gt;</span></i></span> has no
      extension.&nbsp; Only one library file may be loaded.</p>
<p class="betweenlists">By default, the standard library is loaded
if the <span class="Flag"><span style=
'font-size:10.0pt'>-load</span></span> flag is not used to load a
user library.&nbsp; If no user library is loaded, one of the
following flags may be used to select a different standard
library.&nbsp; Precede the flag by <span class=
      "Flag"><span style='font-size:10.0pt'>+</span></span> to load
      the described library (or to prevent a library from being
      loaded using <span class="Flag"><span style=
      'font-size:10.0pt'>no-lib</span></span>). See Section 14.1
      for information on the provided libraries.</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>no-lib</span></span></p>
<p class="IndentText">Do not load any library.&nbsp; This prevents
the standard library from being loaded.</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>ansi-lib</span></span></p>
<p class="IndentText">Use the ANSI standard library (selected by
default).</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>strict-lib</span></span></p>
<p class="IndentText">Use strict version of the ANSI standard
library.</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>posix-lib</span></span></p>
<p class="IndentText">Use the POSIX standard library.</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>posix-strict-lib</span></span></p>
<p class="IndentText">Use the strict version of the POSIX standard
library.</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>unix-lib</span></span></p>
<p class="IndentText">Use UNIX version of standard library.</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>unix-strict-lib</span></span></p>
<p class="IndentText">Use the strict version of the UNIX standard
library.</p>
<p class="IndentText">&nbsp;</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>which-lib</span></span></p>
<p class="IndentText">Print out the standard library filename and
creation information.</p>

<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>newdecl</span></span></p>
<p class="IndentText">There is a new declaration that is not declared in a loaded library or
   earlier file.  (Use this flag to check for consistency against a library.) 
</p>


<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>impconj</span></span></p>
<p class="IndentText">Make all alternate types implicit (useful for making system libraries). 
</p>

<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
<a name="_Toc534975045">Output</a></p>
<p class="beforelist">These flags control what additional
information Splint prints.&nbsp; Setting <span class=
"Flag"><span style=
'font-size:10.0pt'>+<i>&lt;flag&gt;</i></span></span> causes the
described information to be printed; setting <span class=
"Flag"><span style=
'font-size:10.0pt'>-<i>&lt;flag&gt;</i></span></span> prevents
it.&nbsp; By default, all these flags are off.</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>use-stderr</span></span></p>
<p class="IndentText">Send error messages to standard error
(instead of standard output).</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>show-summary</span></span></p>
<p class="IndentText">Show a summary of all errors reported and
suppressed.&nbsp; Counts of suppressed errors are not necessarily
correct since turning a flag off may prevent some checking from
being done to save computation, and errors that are not reported
may propagate differently from when they are reported.</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>show-scan</span></span></p>
<p class="IndentText">Show file names are they are processed.</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>show-all-uses</span></span></p>
<p class="IndentText">Show list of uses of all external identifiers
sorted by number of uses.</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>stats</span></span></p>
<p class="IndentText">Display number of lines processed and
checking time.</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>time-dist</span></span></p>
<p class="IndentText">Display distribution of where checking time
is spent.</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>quiet</span></span></p>
<p class="IndentText">Suppress herald and error count.&nbsp; (If
<span class="Flag"><span style=
'font-size:10.0pt'>quiet</span></span> is not set, Splint prints
out a herald with version information before checking begins, and a
line summarizing the total number of errors reported.)</p>

<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>iso-lib</span></span></p>
<p class="IndentText">Use library based on the ISO standard library specification.
</p>

<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>warn-unix-lib</span></span></p>
<p class="IndentText">
Warn when the unix library is used.  Unix library may not be compatible with all platforms.
</p>

<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>which-lib</span></span></p>
<p class="IndentText">Print out the standard library filename and
creation information.</p>




<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>limit</span></span> <span class=
"Flag"><span style=
'font-size:10.0pt'><i>&lt;number&gt;</i></span></span></p>
<p class="IndentText">At most <span class=
      "Flag"><i><span style='font-size:10.0pt'>&lt;number&gt;</span></i></span>
      similar errors are reported consecutively.&nbsp; Further
      errors are suppressed, and a message showing the number of
      suppressed messages is printed.</p>


<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>message-stream</span></span> <span class=
"Flag"><span style=
'font-size:10.0pt'><i>&lt;file&gt;</i></span></span></p>
<p class="IndentText">
Send status messages to <i><span style='font-size:10.0pt'>&lt;file&gt;</span></i>.
</p>


<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>message-stream-stdout</span></span> <span class=
"Flag"><span style=
'font-size:10.0pt'></span></span></p>
<p class="IndentText">
Send status messages to standard output stream.
</p>


<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>message-stream-stderr</span></span> <span class=
"Flag"><span style=
'font-size:10.0pt'></span></span></p>
<p class="IndentText">
Send status messages to standard error stream.
</p>


<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>warning-stream</span></span> <span class=
"Flag"><span style=
'font-size:10.0pt'><i>&lt;file&gt;</i></span></span></p>
<p class="IndentText">
Send  warnings to <i><span style='font-size:10.0pt'>&lt;file&gt;</span></i>.
</p>


<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>warning-stream-stdout</span></span> <span class=
"Flag"><span style=
'font-size:10.0pt'></span></span></p>
<p class="IndentText">
Send  warnings to standard output stream.
</p>


<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>warning-stream-stderr</span></span> <span class=
"Flag"><span style=
'font-size:10.0pt'></span></span></p>
<p class="IndentText">
Send warnings to standard error stream.
</p>


<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>error-stream</span></span> <span class=
"Flag"><span style=
'font-size:10.0pt'><i>&lt;file&gt;</i></span></span></p>
<p class="IndentText">
Send fatal errors to <i><span style='font-size:10.0pt'>&lt;file&gt;</span></i>.
</p>


<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>error-stream-stdout</span></span> <span class=
"Flag"><span style=
'font-size:10.0pt'></span></span></p>
<p class="IndentText">
Send fatal errors to standard output stream.
</p>


<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>error-stream-stderr</span></span> <span class=
"Flag"><span style=
'font-size:10.0pt'></span></span></p>
<p class="IndentText">
Send fatal errors to standard error stream.
</p>

        
<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
<a name="_Toc534975046">Expected Errors</a></p>
<p class="beforelist">Normally, Splint will expect to report no
errors.&nbsp; The exit status will be success (<span class=
"Keyword"><span style='font-size:10.0pt'>0</span></span>) if no
errors are reported, and failure if any errors are reported.&nbsp;
Flags can be used to set the expected number of reported
errors.&nbsp; Because of the provided error suppression mechanisms,
these options should probably not be used for final checking real
programs but may be useful in developing programs using make.</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>expect</span></span> <span class=
"Flag"><span style=
'font-size:10.0pt'><i>&lt;number&gt;</i></span></span></p>
<p class="IndentText">Exactly <span class=
      "Flag"><i><span style='font-size:10.0pt'>&lt;number&gt;</span></i></span>
      code errors are expected.&nbsp; Splint will exit with failure
      exit status unless <span class="Flag"><i><span style=
      'font-size:10.0pt'>&lt;number&gt;</span></i></span> code
      errors are detected.</p>
<p class="MsoHeading8" style='margin-left:0in;text-indent:0in'>
<a name="_Toc534975047">Message Format</a></p>
<p class="beforelist">These flags control how messages are
printed.&nbsp; They may be set at the command line, in options
files, or locally in syntactic comments.&nbsp; The
      <span class="Flag"><span style=
      'font-size:10.0pt'>line-len</span></span> and <span class=
      "Flag"><span style='font-size:10.0pt'>limit</span></span>
      flags may be preceded by <span class="Flag"><span style=
      'font-size:10.0pt'>+</span></span> or <span class=
      "Flag"><span style='font-size:10.0pt'>-</span></span> with
      the same meaning; for the other flags, <span class=
      "Flag"><span style='font-size: 10.0pt'>+</span></span> turns
      on the describe printing and <span class="Flag"><span style=
      'font-size:10.0pt'>-</span></span> turns it off.&nbsp; The
      box to the left of each flag gives its default value.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span class=
"Flag"><span style=
'font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>show-column</span></span></p>
<p class="IndentText">Show column number where error is found.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span class=
"Flag"><span style=
'font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>show-func</span></span></p>
<p class="IndentText">Show name of function (or macro) definition
containing error.&nbsp; The function name is printed once before
the first message detected in that function.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span class=
"Flag"><span style=
'font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>show-all-conjs</span></span></p>
<p class="IndentText">Show all possible alternate types (see
Section 4.4).</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span class=
"Flag"><span style=
'font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>paren-file-format</span></span></p>
<p class="IndentText">Use <span class="Flag"><i><span style=
'font-size:10.0pt'>&lt;file&gt;</span></i></span><span class=
"CodeText"><span style=
'font-size:10.0pt'>(</span></span><span class=
      "Flag"><i><span style='font-size:10.0pt'>&lt;line&gt;</span></i></span><span class="CodeText">
<span style='font-size:10.0pt'>)</span></span> format in
messages.&nbsp; (Default is + for Win32 for compatibility with
Microsoft VisualStudio.)</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span class=
"Flag"><span style=
'font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>hints</span></span></p>
<p class="IndentText">Provide hints describing an error and how a
message may be suppressed for the first error reported in each
error class.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span class=
"Flag"><span style=
'font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>force-hints</span></span></p>
<p class="IndentText">Provide hints for all errors reported, even
if the hint has already been displayed for the same error
class.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span class=
"Flag"><span style=
'font-size:10.0pt'>80</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>line-len</span></span> <span class=
"Flag"><span style=
'font-size:10.0pt'><i>&lt;number&gt;</i></span></span></p>
<p class="IndentText">Set length of maximum message line to
<span class="Flag"><i><span style=
'font-size:10.0pt'>&lt;number&gt;</span></i></span>
characters.&nbsp; Splint will split messages longer than
<span class="Flag"><i><span style=
'font-size: 10.0pt'>&lt;number&gt;</span></i></span> characters
long into multiple lines.</p>

<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span class=
"Flag"><span style=
'font-size:10.0pt'>3</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>indentspaces</span></span> <span class=
"Flag"><span style=
'font-size:10.0pt'><i>&lt;number&gt;</i></span></span></p>
<p class="IndentText">
Set the number of spaces to indent sub-messages.
</p>


<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span class=
"Flag"><span style=
'font-size:10.0pt'>3</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>locindentspaces</span></span> <span class=
"Flag"><span style=
'font-size:10.0pt'><i>&lt;number&gt;</i></span></span></p>
<p class="IndentText">
Set number of spaces to indent sub-messages that start with file locations.
</p>



<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span class=
"Flag"><span style=
'font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>showdeephistory</span></span> <span class=
"Flag"><span style=
'font-size:10.0pt'></span></span></p>
<p class="IndentText">
Show all available information about storage mentioned in warnings. 
</p>

<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span class=
"Flag"><span style=
'font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>showloadloc</span></span> <span class=
"Flag"><span style=
'font-size:10.0pt'></span></span></p>
<p class="IndentText">
Show location information for load files.
</p>


<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span class=
"Flag"><span style=
'font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>csv</span></span> <span class=
"Flag"><span style=
'font-size:10.0pt'></span></span></p>
<p class="IndentText">
Produce comma-separated values (CSV) warnings output file. 
</p>


<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span class=
"Flag"><span style=
'font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>csvoverwrite</span></span> <span class=
"Flag"><span style=
'font-size:10.0pt'></span></span></p>
<p class="IndentText">
Overwrite existing CVS output file Show location information for load files.
</p>


<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span class=
"Flag"><span style=
'font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>htmlfileformat</span></span> <span class=
"Flag"><span style=
'font-size:10.0pt'></span></span></p>
<p class="IndentText">
Show file locations as links.
</p>


<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span class=
"Flag"><span style=
'font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>streamoverwrite</span></span> <span class=
"Flag"><span style=
'font-size:10.0pt'></span></span></p>
<p class="IndentText">
Warn and exit if a stream output file would overwrite an existing file.
</p>


<p class="MsoHeading8" style='margin-left:0in;text-indent:0in'>
<a name="_Toc534975048">Mode Selector Flags</a></p>
<p class="TextFontCX">Mode selects flags set the mode checking
flags to predefined values.&nbsp; They provide a quick coarse-grain
way of controlling what classes of errors are reported. Specific
checking flags may be set after a mode flag to override the mode
settings.&nbsp; Mode flags may be used locally, however the mode
settings will override specific command line flag settings.&nbsp; A
warning is produced if a mode flag is used after a mode checking
flag has been set.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="beforelist">These are brief descriptions to give a
general idea of what each mode does.&nbsp; To see the complete flag
settings in each mode, use <span class="Flag"><span style=
'font-size:10.0pt'>splint -help modes</span></span>. A mode flag
has the same effect when used with either <span class=
"Flag"><span style='font-size:10.0pt'>+</span></span> or
<span class="Flag"><span style=
'font-size:10.0pt'>-</span></span>.</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>weak</span></span></p>
<p class="IndentText">Weak checking, intended for typical
unannotated C code.&nbsp; No modifies checking, macro checking, rep
exposure, or clean interface checking is done.&nbsp; Return values
of type <span class="CodeText"><span style=
'font-size:10.0pt'>int</span></span> may be ignored.&nbsp; The
types <span class="CodeText"><span style=
'font-size:10.0pt'>bool</span></span>, <span class=
"CodeText"><span style='font-size:10.0pt'>int</span></span>,
<span class="CodeText"><span style=
'font-size:10.0pt'>char</span></span> and user-defined
      <span class="CodeText"><span style=
      'font-size:10.0pt'>enum</span></span> types are all
      equivalent.&nbsp; Old style declarations are unreported.</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>standard</span></span></p>
<p class="IndentText">The default mode.&nbsp; All checking done by
<span class="Flag"><span style=
'font-size:10.0pt'>weak</span></span>, plus modifies checking,
global, alias checking, use all parameters, using released storage,
ignored return values or any type, macro checking, unreachable
code, infinite loops, and fall through cases.&nbsp; The types
<span class="CodeText"><span style=
'font-size:10.0pt'>bool</span></span>, <span class=
"CodeText"><span style='font-size:10.0pt'>int</span></span> and
<span class="CodeText"><span style=
'font-size:10.0pt'>char</span></span> are distinct.&nbsp; Old style
declarations are reported.</p>
<p class="TextFontCX">&nbsp;<span class="Flag"><span style=
'font-size:10.0pt'>checks</span></span></p>
<p class="IndentText">Moderately strict checking.&nbsp; All
checking done by <span class="Flag"><span style=
'font-size:10.0pt'>standard</span></span>, plus must modification
checking, rep exposure, return alias, memory management and
complete interfaces.</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>strict</span></span></p>
<p class="IndentText">Absurdly strict checking.&nbsp; All checking
done by <span class="Flag"><span style=
'font-size:10.0pt'>checks</span></span>, plus modifications and
global variables used in unspecified functions, strict standard
library, and strict typing of C operators. A special reward will be
presented to the first person to produce a real program that
produces no errors with <span class="Flag"><span style=
'font-size:10.0pt'>strict</span></span> checking.</p>
<p class="MsoHeading8" style='margin-left:0in;text-indent:0in'>
<a name="_Ref344798116"></a><a name="_Toc534975049">Checking
Flags</a></p>
<p class="TextFontCX">These flags control checking done by
Splint.&nbsp; They may be set locally using syntactic comments,
from the command line, or in an options file.&nbsp; Some flags
directly control whether a certain class of message is
reported.&nbsp; Preceding the flag by <span class=
"Flag"><span style='font-size:10.0pt'>+</span></span> turns
reporting on, and preceding the flag by <span class=
"Flag"><span style='font-size:10.0pt'>-</span></span> turns
reporting off.&nbsp; Other flags control checking less directly by
determining default values (what annotations are implicit), making
types equivalent (to prevent certain type errors), controlling
representation access, etc.&nbsp; For these flags, the effect of
<span class="Flag"><span style='font-size:10.0pt'>+</span></span>
is described, and the effect of <span class=
      "Flag"><span style='font-size:10.0pt'>-</span></span> is the
      opposite (or explicitly explained if there is no clear
      opposite).&nbsp; The organization of this section mirrors
      Sections 2-14.</p>
<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
<a name="_Toc534975051"></a>
<a name="_Toc534975056">Null
Dereferences</a> <span class="TextFontCXChar"><span style=
'font-size:11.0pt; font-weight:normal'>(Section
2)</span></span></p>

<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>null</span></span></p>
<p class="IndentText">A possibly null pointer may be dereferenced,
or used somewhere a non-null pointer is expected. (sets nulldref, nullpass, nullassign, and nullstate</p>

<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>
nullderef</span>
</span></p>
<p class="IndentText">A possibly null pointer is dereferenced.  Value is either the result of a function which may return null (in which case,
code should check it is not null), or a global, parameter or structure field declared with the null qualifier.
</P>



<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>
nullpass</span>
</span></p>
<p class="IndentText">
A possibly null pointer is passed as a parameter corresponding to a formal parameter with no /*@null@*/ annotation.  If NULL may be
used for this parameter, add a /*@null@*/ annotation to the function parameter declaration. 
</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>
nullret</span>
</span></p>
<p class="IndentText">
Function returns a possibly null pointer, but is not declared using /*@null@*/ annotation of result.  If function may return NULL, add /*@null@*/ annotation to the return value declaration.
</P>

<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>
nullstate</span>
</span></p>
<p class="IndentText">
A possibly null pointer is reachable from a parameter or global variable that is not declared using a /*@null@*/ annotation.
</P>


<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>
nullassign</span>
</span></p>
<p class="IndentText">
A reference with no null annotation is assigned or initialized to NULL.  Use /*@null@*/ to declare the reference as a possibly null pointer.
</P>

<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
<a name="_Toc534975055">Use Before Definition</a>
      <span class="TextFontCXChar"><span style=
      'font-size:11.0pt; font-weight:normal'>(Section
      3)</span></span></p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>usedef</span></span></p>
<p class="IndentText">The value of a location that may not be
initialized on some execution path is used.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>impouts</span></span></p>
<p class="IndentText">Allow unannotated pointer parameters to
functions to be implicit out parameters.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>compdef</span></span></p>
<p class="IndentText">Storage derivable from a parameter, return
value or global variable is not completely defined.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>uniondef</span></span></p>
<p class="IndentText">No field of a union is defined.&nbsp; (No
error is reported if at least one union field is defined.)</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>mustdefine</span></span></p>
<p class="IndentText">Parameter declared with <span class=
"Keyword"><span style='font-size:10.0pt'>out</span></span> is not
defined before return or scope exit.</p>


<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>

<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>
fullinitblock
</span></span></p>
<p class="IndentText">
Initializer does not set every field in the structure.
</p>


<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>
initallelments
</span></span></p>
<p class="IndentText">
Initializer does not define all elements of a declared array.
</p>


<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>
initsize
</span></span></p>
<p class="IndentText">
Initializer block contains more elements than the size of a declared array. 
</p>


<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>---</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>
impouts
</span></span></p>
<p class="IndentText">
Pointer parameters to unspecified functions may be implicit <span class=
"Keyword"><span style='font-size:10.0pt'>out</span></span> parameters.
</p>

<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
Declarations<span class="TextFontCXChar"><span style=
'font-size:11.0pt; font-weight:normal'></span></span>
<span class="TextFontCXChar">
<span style=
'font-size:11.0pt; font-weight:normal'>)</span></span></p>

<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>
incondefs
</span></span></p>
<p class="IndentText">
A function, variable or constant is redefined with a different type.
</p>

<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>
functionderef
</span></span></p>
<p class="IndentText">
A function type is dereferenced.  The ANSI standard allows this because of
 implicit conversion of function designators, however the dereference is unnecessary. 
</p>

<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>
redundantsharequal
</span></span></p>
<p class="IndentText">
A declaration of an immutable object uses a redundant observer qualifier. 
</p>


<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>
misplacedsharequal
</span></span></p>
<p class="IndentText">
A declaration of an unsharable object uses a sharing annotation. 
</p>

<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
Types <span class="TextFontCXChar"><span style=
'font-size:11.0pt; font-weight:normal'>(Section</span></span>
<span class="TextFontCXChar"><span style=
'font-size:11.0pt; font-weight:normal'>4</span></span>
<span class="TextFontCXChar">
<span style=
'font-size:11.0pt; font-weight:normal'>)</span></span></p>
<p class="IndentText">&nbsp;</p>

<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>
type
</span></span></p>
<p class="IndentText">Type mismatch.</p>

<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>
string-literal-too-long
</span></span></p>
<p class="IndentText">
A string literal is assigned to a char array too small to hold it. 
</p>

<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>
string-literal-no-room
</span></span></p>
<p class="IndentText">
A string literal is assigned to a char array that is not big enough to hold the null terminator. 
</p>


<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>++++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>
string-literal-no-room-final-null
</span></span></p>
<p class="IndentText">
A string literal is assigned to a char array that is not big enough to
      hold the final null terminator.  This may not be a problem because a null
      character has been explictedly included in the string literal using an
      escape sequence. 
</p>

<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>
string-literal-smaller
</span></span></p>
<p class="IndentText">
A string literal is assigned to a char array that smaller than the string literal needs.
</p>


<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>
enum-members
</span></span></p>
<p class="IndentText">
Type of initial values for enum members must be int. 
</p>

<p class="Heading10">Boolean Types <span class=
"HeadingNote"><span style=
'font-size:10.5pt;font-weight:normal;font-style:normal'>(Section</span></span>
<span class="HeadingNote"><span style=
'font-size:10.5pt;font-weight:normal;font-style: normal'>4.2</span></span><span class="HeadingNote">
<span style=
'font-size:10.5pt; font-weight:normal;font-style:normal'>)</span></span></p>
<p class="TextFontCX">These flags control the type name used to
represent Booleans, and whether the Boolean type is abstract.</p>
<p class="TextFontCX">&nbsp;</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>bool</span></span></p>
<p class="IndentText">Boolean type is an abstract type.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class="Flag"><span style=
'font-size:10.0pt'>bool</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>booltype</span></span> <span class=
"Flag"><span style=
'font-size:10.0pt'><i>&lt;name&gt;</i></span></span></p>
<p class="IndentText">Set name of Boolean type to
<i>&lt;name&gt;</i>.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span><span class="Flag"><span style=
'font-size:10.0pt'>FALSE</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>boolfalse</span></span> <span class=
"Flag"><span style=
'font-size:10.0pt'><i>&lt;name&gt;</i></span></span></p>
<p class="IndentText">Set name of Boolean false to
<i>&lt;name&gt;</i>.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class="Flag"><span style=
'font-size:10.0pt'>TRUE</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>booltrue</span></span> <span class=
"Flag"><span style=
'font-size:10.0pt'><i>&lt;name&gt;</i></span></span></p>
<p class="IndentText">Set name of Boolean true to
<i>&lt;name&gt;</i>.</p>

<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>
likelybool
</span></span></p>
<p class="IndentText">
Splint has found a type which appears to be the boolean type.  Use the -booltype, -boolfalse and -booltrue flags to change the name of the default boolean type.
</p>


<p class="Heading10"><a name="_Ref344871224">Predicates</a></p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>pred-bool-ptr</span></span></p>
<p class="IndentText">Type of condition test is a pointer.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>pred-bool-int</span></span></p>
<p class="IndentText">Type of condition test is an integral
type.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>++++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>pred-bool-others</span></span></p>
<p class="IndentText">Type of condition test is not a Boolean,
pointer or integral type.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>pred-bool</span></span></p>
<p class="IndentText">Sets <span class="Flag"><span style=
'font-size:10.0pt'>predboolint</span></span>, <span class=
"Flag"><span style='font-size:10.0pt'>predboolptr</span></span> and
<span class="Flag"><span style=
'font-size:10.0pt'>preboolothers</span></span>.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>pred-assign</span></span></p>
<p class="IndentText">The condition test is an assignment
expression. If an assignment is intended, add an extra parentheses
nesting (e.g., <span class="CodeText"><span style=
'font-size:10.0pt'>if ((a = b))</span></span> ...).</p>
<p class="Heading10">Primitive Operations</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>ptr-arith</span></span></p>
<p class="IndentText">Arithmetic involving pointer and integer.</p>

<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>
nullptrarith
</span></span></p>
<p class="IndentText">
Pointer arithmetic using a possibly null pointer and integer. 
</p>


<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>++--</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>
boolops
</span></span></p>
<p class="IndentText">
The operand of a boolean operator is not a boolean. Use +ptrnegate to allow ! to be used on pointers. 
</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>++--</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>ptr-negate</span></span></p>
<p class="IndentText">Allow the operand of the <span class=
"CodeText"><span style='font-size:10.0pt'>!</span></span> operator
to be a pointer.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>bitwise-signed</span></span><span class=
"Flag"><span style='font-size:10.0pt'>&nbsp;</span></span></p>
<p class="IndentText">An operand to a bitwise operator is not an
unsigned value. This may have unexpected results depending on the
signed representations.</p>


<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>
shiftimplementation 
</span></span></p>
<p class="IndentText">
The left operand to a shift operator may be negative (behavior is implementation-defined). 
</p>


<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>
shiftnegative
</span></span></p>
<p class="IndentText">
The right operand to a shift operator may be negative (behavior undefined).
</p>

<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>shift-signed</span></span></p>
<p class="IndentText">The left operand to a shift operator is not
an unsigned value.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>strict-ops</span></span></p>
<p class="IndentText">Primitive operation does not type check
strictly.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>sizeof-type</span></span></p>
<p class="IndentText">Operand of <span class=
      "CodeText"><span style='font-size:10.0pt'>sizeof</span></span>
      operator is a type.&nbsp; (Safer to use <span class=
      "CodeText"><span style='font-size:10.0pt'>int *x = sizeof
      (*x);</span></span> instead of <span class=
      "CodeText"><span style='font-size:10.0pt'>sizeof
      (int)</span></span>.)</p>
<p class="Heading10">Array Formal Parameters</p>
<p class="TextFontCX">These flags control reporting of common
errors caused by confusion about the semantics of array formal
parameters.</p>
<p class="TextFontCX">&nbsp;</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>sizeof-formal-array</span></span></p>
<p class="IndentText">The <span class="CodeText"><span style=
'font-size:10.0pt'>sizeof</span></span> operator is used on a
parameter declared as an array.&nbsp; (In many instances this has
unexpected behavior, since the result is the size of a pointer to
the element type, not the number of elements in the array.)</p>
<p class="IndentText">&nbsp;</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>fixed-formal-array</span></span></p>
<p class="IndentText">An array formal parameter is declared with a
fixed size (e.g., <span class="CodeText"><span style=
'font-size:10.0pt'>int x[20]</span></span>).&nbsp; This is likely
to be confusing, since the size is ignored.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>formal-array</span></span></p>
<p class="IndentText">A formal parameter is declared as an
array.&nbsp; This is probably not a problem, but can be confusing
since it is treated as a pointer.&nbsp;</p>
<p class="Heading10">Format Codes</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>format-code</span></span></p>
<p class="IndentText">Invalid format code in format string for
<span class="Annot"><span style=
'font-size:10.0pt'>printflike</span></span> or <span class=
"Annot"><span style='font-size:10.0pt'>scanflike</span></span>
function.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>format-type</span></span></p>
<p class="IndentText">Type-mismatch in parameter corresponding to
format code in a <span class="Annot"><span style=
'font-size:10.0pt'>printflike</span></span> or <span class=
"Annot"><span style='font-size:10.0pt'>scanflike</span></span>
function.</p>

<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>format-const</span></span></p>
<p class="IndentText">Format parameter is not known at compile-time.  This can lead to security vulnerabilities because the arguments cannot be type checked.</p>

<p class="Heading10">Main</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>main-type</span></span></p>
<p class="IndentText">Type of <span class=
      "CodeText"><span style='font-size:10.0pt'>main</span></span>
      does not match expected type (function returning an
      <span class="CodeText"><span style=
      'font-size:10.0pt'>int</span></span>, taking no parameters or
      two parameters of type <span class="CodeText"><span style=
      'font-size:10.0pt'>int</span></span> and <span class=
      "CodeText"><span style='font-size:10.0pt'>char
      **</span></span>.)</p>
<p class="Heading10">Comparisons</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><a name=
"boolcompare"></a><a name="boolprose"><span style=
'font-size:10.0pt'>m:</span></a><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>bool-compare</span></span></p>
<p class="IndentText">Comparison between Boolean values.&nbsp; This
is dangerous since there may be multiple true values as any
non-zero value is interpreted as true.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>real-compare</span></span></p>
<p class="IndentText">Comparison involving <span class=
"CodeText"><span style='font-size:10.0pt'>float</span></span> or
<span class="CodeText"><span style=
'font-size:10.0pt'>double</span></span> values.&nbsp; This is
dangerous since it may produce unexpected results because floating
point representations are inexact.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>ptr-compare</span></span></p>
<p class="IndentText">Comparison between pointer and number.</p>

<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>unsigned-compare</span></span></p>
<p class="IndentText">
An unsigned value is used in a comparison with zero in a way that is either a bug or confusing.
</p>

<p class="Heading10">Type Equivalence</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><a name=
"globs"></a><span style=
      'font-size:10.0pt'>m:</span><span class="Keyword"><span style='font-size: 10.0pt'>
+---</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>void-abstract</span></span></p>
<p class="IndentText">Allow <span class=
      "CodeText"><span style='font-size:10.0pt'>void
      *</span></span> to match pointers to abstract types.&nbsp;
      (Casting a pointer to an abstract type to a pointer to
      <span class="CodeText"><span style=
      'font-size:10.0pt'>void</span></span> is okay if <span class=
      "Flag"><span style=
      'font-size:10.0pt'>+void-abstract</span></span> is set.)</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P: +</span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>cast-fcn-ptr</span></span></p>
<p class="IndentText">&nbsp;A pointer to a function is cast to (or
used as) a pointer to void (or vice versa).</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>+---</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>forward-decl</span></span></p>
<p class="IndentText">Forward declarations of pointers to abstract
representation match abstract type.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>imp-type</span></span></p>
<p class="IndentText">A variable declaration has no explicit
type.&nbsp; The type is implicitly int.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>incomplete-type</span></span></p>
<p class="IndentText">A formal parameter is declared with an
incomplete type (e.g., <span class="Keyword"><span style=
'font-size:10.0pt'>int[][]</span></span>).</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>+---</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>char-index</span></span></p>
<p class="IndentText">Allow <span class=
      "CodeText"><span style='font-size:10.0pt'>char</span></span>
      to index arrays.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>enum-index</span></span></p>
<p class="IndentText">Allow members of <span class=
"CodeText"><span style='font-size:10.0pt'>enum</span></span>type to
index arrays.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>+---</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>bool-int</span></span></p>
<p class="IndentText">Make <span class=
      "CodeText"><span style='font-size:10.0pt'>bool</span></span>
      and <span class="CodeText"><span style=
      'font-size:10.0pt'>int</span></span> are equivalent.&nbsp;
      (No type errors are reported when a Boolean is used where an
      integral type is expected and vice versa.)</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>+---</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>char-int</span></span></p>
<p class="IndentText">Make <span class=
      "CodeText"><span style='font-size:10.0pt'>char</span></span>
      and <span class="CodeText"><span style=
      'font-size:10.0pt'>int</span></span> types equivalent</p>
      
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>+---</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>charunsignedchar</span></span></p>
<p class="IndentText">To allow <span class=
      "CodeText"><span style='font-size:10.0pt'>char</span></span>
      and <span class="CodeText"><span style=
      'font-size:10.0pt'>unsigned char</span></span> types to match use
<span class="Flag"><span style=
'font-size:10.0pt'>+charunsignedchar</span></span>
</p>
      
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>++--</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>enum-int</span></span></p>
<p class="IndentText">Make <span class=
      "CodeText"><span style='font-size:10.0pt'>enum</span></span>
      and <span class="CodeText"><span style=
      'font-size:10.0pt'>int</span></span> types equivalent</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>+---</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>float-double</span></span></p>
<p class="IndentText">Make <span class=
      "CodeText"><span style='font-size:10.0pt'>float</span></span>
      and <span class="CodeText"><span style=
      'font-size:10.0pt'>double</span></span> types equivalent</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>ignore-quals</span></span></p>
<p class="IndentText">Ignore type qualifiers (<span class=
"CodeText"><span style='font-size:10.0pt'>long</span></span>,
<span class="CodeText"><span style=
'font-size:10.0pt'>short</span></span>, <span class=
"CodeText"><span style=
'font-size:10.0pt'>unsigned</span></span>).</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>++--</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>relax-quals</span></span></p>
<p class="IndentText">Report qualifier mismatches only if dangerous
(information may be lost since a larger type is assigned to (or
passed as) a smaller one or a comparison uses <span class=
"CodeText"><span style='font-size:10.0pt'>signed</span></span> and
<span class="CodeText"><span style=
'font-size:10.0pt'>unsigned</span></span> values.)</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>ignore-signs</span></span></p>
<p class="IndentText">Ignore signs in type comparisons
      (<span class="CodeText"><span style=
      'font-size:10.0pt'>unsigned</span></span> matches
      <span class="CodeText"><span style=
      'font-size:10.0pt'>signed</span></span>).</p>
<p class="IndentText">&nbsp;</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>long-integral</span></span></p>
<p class="IndentText">Allow long type to match an arbitrary
integral type (e.g., <span class="CodeText"><span style=
'font-size:10.0pt'>dev_t</span></span>).</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>+---</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>long-unsigned-integral</span></span></p>
<p class="IndentText">Allow unsigned long type to match an
arbitrary integral type (e.g., <span class=
      "CodeText"><span style='font-size:10.0pt'>dev_t</span></span>).</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>match-any-integral</span></span></p>
<p class="IndentText">Allow any integral type to match an
arbitrary</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>long-unsigned-unsigned-integral</span></span></p>
<p class="IndentText">Allow unsigned long type to match an
arbitrary unsigned integral type (e.g., <span class=
"CodeText"><span style=
'font-size:10.0pt'>size_t</span></span>).</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>+---</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>long-signed-integral</span></span></p>
<p class="IndentText">Allow long type to match an arbitrary signed
integral type (e.g., <span class="CodeText"><span style=
'font-size:10.0pt'>ssize_t</span></span>).</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>&nbsp;</span></span></p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>num-literal</span></span></p>
<p class="IndentText">Integer literals can be used as floats.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>char-int-literal</span></span></p>
<p class="IndentText">A character constant may be used as an
<span class="CodeText"><span style=
'font-size:10.0pt'>int</span></span>.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>zero-ptr</span></span></p>
<p class="IndentText">Literal <span class=
      "CodeText"><span style='font-size:10.0pt'>0</span></span> may
      be used as a pointer.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>zero-bool</span></span></p>
<p class="IndentText">Treat <span class=
      "CodeText"><span style='font-size:10.0pt'>0</span></span> as a boolean.
 </p>     
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>relax-types</span></span></p>
<p class="IndentText">Allow all numeric types to match.</p>
</p>

<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>+---</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>shortint</span></span></p>
<p class="IndentText">
Make short int and int types equivalent.
</p>
<p class="Heading10"><a name="_Toc534975052">Abstract Types</a>
<span class="TextFontCXChar"><span style=
'font-size:11.0pt; font-weight:normal'>(Section</span></span>
<span class="TextFontCXChar"><span style=
'font-size:11.0pt; font-weight:normal'>4.3</span></span><span class="TextFontCXChar">
<span style=
'font-size:11.0pt; font-weight:normal'>)</span></span></p>



<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>abstract</span></span></p>
<p class="IndentText">A data abstraction barrier is violated</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class="Flag"><span style=
'font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>imp-abstract</span></span></p>
<p class="IndentText">Implicit <span class=
      "Annot"><span style='font-size:10.0pt'>abstract</span></span>
      annotation for type declarations that do not use <span class=
      "Annot"><span style=
      'font-size:10.0pt'>concrete</span></span>.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class="Flag"><span style=
'font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>mut-rep</span></span></p>
<p class="IndentText">Representation of mutable type has sharing
semantics.</p>
<p class="Heading10">Access <span class=
"TextFontCXChar"><span style=
'font-size:11.0pt; font-weight:normal'>(Section
4.3.1)</span></span></p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P: +</span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>access-module</span></span></p>
<p class="IndentText">An abstract type defined in
      <span class="ProgramNameChar"><i>M</i></span><span class=
      "ProgramNameChar">.h</span> (or specified in <span class=
      "ProgramNameChar"><i>M</i></span><span class=
      "ProgramNameChar">.lcl</span>) is accessible in <span class=
      "ProgramNameChar"><i>M</i></span><span class=
      "ProgramNameChar">.c</span>.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>access-file</span></span></p>
<p class="IndentText">An abstract type named <span class=
"CodeText"><i><span style='font-size:10.0pt'>type</span></i></span>
is accessible in files named <span class=
"ProgramNameChar"><i>type</i></span><span class=
"ProgramNameChar">.*</span></p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="MsoListBullet"><span class="Flag"><span style=
'font-size:10.0pt'>access-czech</span></span></p>
<p class="IndentText">An abstract type named <span class=
"CodeText"><i><span style='font-size:10.0pt'>type</span></i></span>
may be accessible in a function named <span class=
"CodeText"><i><span style=
'font-size:10.0pt'>type_name</span></i></span>. (Section
12.1.1)</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="MsoListBullet"><span class="Flag"><span style=
'font-size:10.0pt'>access-slovak</span></span></p>
<p class="IndentText">An abstract type named <span class=
"CodeText"><i><span style='font-size:10.0pt'>type</span></i></span>
may be accessible in a function named <span class=
"CodeText"><i><span style=
'font-size:10.0pt'>typeName</span></i></span>.&nbsp;
(Section.12.1.2)</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="MsoListBullet"><span class="Flag"><span style=
'font-size:10.0pt'>access-czechoslovak</span></span></p>
<p class="IndentText">An abstract type named <span class=
"CodeText"><i><span style='font-size:10.0pt'>type</span></i></span>
may be accessible in a function named <span class=
"CodeText"><i><span style=
'font-size:10.0pt'>type_name</span></i></span> or
      <span class="CodeText"><i><span style=
      'font-size:10.0pt'>typeName</span></i></span>.&nbsp; (Section
      12.1.3)</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>access-all</span></span></p>
<p class="IndentText">Sets <span class="Flag"><span style=
'font-size:10.0pt'>access-module</span></span>, <span class=
"Flag"><span style='font-size:10.0pt'>access-file</span></span> and
<span class="Flag"><span style=
'font-size:10.0pt'>access-czech</span></span>.</p>
<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
<a name="_Toc534975053">Memory Management</a> <span class=
"TextFontCXChar"><span style=
'font-size:11.0pt; font-weight:normal'>(Section</span></span>
<span class="TextFontCXChar"><span style=
'font-size:11.0pt; font-weight:normal'>5</span></span><span class="TextFontCXChar">
<span style=
'font-size:11.0pt; font-weight:normal'>)</span></span></p>
<p class="TextFontCX">Reporting of memory management errors is
controlled by flags setting checking and implicit annotations and
code annotations.&nbsp;</p>
<p class="Heading10">Deallocation Errors <span class=
"TextFontCXChar"><span style=
'font-size:11.0pt; font-weight:normal'>(Section
5.2)</span></span></p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>use-released</span></span></p>
<p class="IndentText">Storage used after it may have been
released.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>strict-use-released</span></span></p>
<p class="IndentText">An array element used after it may have been
released.</p>
<p class="Heading10">Inconsistent Branches</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>branch-state</span></span></p>
<p class="IndentText">Storage has inconsistent states of alternate
paths through a branch (e.g., it is released in the true branch of
an if-statement, but there is no else branch.)</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>strict-branch-state</span></span></p>
<p class="IndentText">Storage through array fetch has inconsistent
states of alternate paths through a branch.&nbsp; Since array
elements are not checked accurately, this may lead to spurious
errors.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>dep-arrays</span></span></p>
<p class="IndentText">Treat array elements as <span class=
"Annot"><span style='font-size:10.0pt'>dependent</span></span>
storage.&nbsp; Checking of array elements cannot be done accurately
by Splint.&nbsp; If <span class="Flag"><span style=
'font-size:10.0pt'>dep-arrays</span></span> is not set, array
elements are assumed to be independent, so code that releases the
same element more than once will produce no error.&nbsp; If
<span class="Flag"><span style=
'font-size:10.0pt'>dep-arrays</span></span> is set, array elements
are assumed to be dependent, so code that releases the same element
more that once will produce an error, but code that releases
different elements correctly will produce a spurious error.</p>
<p class="Heading10">Memory Leaks</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>must-free</span></span></p>
<p class="IndentText">Allocated storage was not released before
return or scope exit.&nbsp; Errors are reported for
      <span class="Annot"><span style=
      'font-size:10.0pt'>only</span></span>, <span class=
      "Annot"><span style='font-size:10.0pt'>fresh</span></span> or
      <span class="Annot"><span style=
      'font-size:10.0pt'>owned</span></span> storage.</p>
      

<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>mustfreefresh</span></span></p>
<p class="IndentText">
Allocated storage was not released before return or scope exit.  Errors are reported for 
       <span class="Annot"><span style='font-size:10.0pt'>fresh</span></span> storage
      </p>
      

<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>mustfreeonly</span></span></p>
<p class="IndentText">
Allocated storage was not released before return or scope exit.  Errors are reported for 
       <span class="Annot"><span style='font-size:10.0pt'>only</span></span> storage
      </p>
      
  <div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>shortcut</span><span class=
      "Keyword"><span style='font-size:10.0pt'></span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>memchecks</span></span></p>
<p class="IndentText">
Sets all dynamic memory checking flags
(<span class=
      "Flag"><span style='font-size:10.0pt'>memimplicit, mustfree, mustdefine,   mustnotalias, null, memtrans</span> </span>). 
      </p>
          
      <div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>comp-destroy</span></span></p>
<p class="IndentText">All only references derivable from
<span class="Annot"><span style='font-size:10.0pt'>out
only</span></span> parameter of type <span class=
"CodeText"><span style='font-size:10.0pt'>void *</span></span> must
be released.&nbsp; (This is the type of the parameter to
<span class="CodeText"><span style=
'font-size:10.0pt'>free</span></span>, but may also be used for
user-defined deallocation functions.)</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>strict-destroy</span></span></p>
<p class="IndentText">Report complete destruction errors for array
elements that may have been released.&nbsp; (If <span class=
"Flag"><span style='font-size:10.0pt'>strict-destroy</span></span>
is not set, Splint will assume that if any array element was
released, the entire array was correctly released.)</p>
<p class="Heading10">Transfer Errors</p>
<p class="beforelist">A transfer error is reported when storage is
transferred (by an assignment, passing a parameter, or returning)
in a way that is inconsistent.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>mem-trans</span></span></p>
<p class="IndentText">Sets all memory transfer errors flags.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>only-trans</span></span></p>
<p class="IndentText">Only storage transferred to non-only
reference (memory leak).</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>ownedtrans</span></span></p>
<p class="IndentText">Owned storage transferred to non-owned
reference (memory leak).</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>fresh-trans</span></span></p>
<p class="IndentText">Newly-allocated storage transferred to
non-only reference (memory leak).</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>shared-trans</span></span></p>
<p class="IndentText">Shared storage transferred to non-shared
reference</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>dependent-trans</span></span></p>
<p class="IndentText">Inconsistent <span class=
      "Annot"><span style='font-size:10.0pt'>dependent</span></span>
      transfer. Dependent storage is transferred to a non-dependent
      reference.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>temp-trans</span></span></p>
<p class="IndentText">Temporary storage (associated with a
<span class="Annot"><span style=
'font-size:10.0pt'>temp</span></span> formal parameter) is
transferred to a non-temporary reference.&nbsp; The storage may be
released or new aliases created.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>kept-trans</span></span></p>
<p class="IndentText">Kept storage (storage what was passed as
<span class="Annot"><span style=
'font-size:10.0pt'>keep</span></span>) transferred to non-temporary
reference.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>keep-trans</span></span></p>
<p class="IndentText">Keep storage is transferred in a way that may
add a new alias to it, or release it.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>refcount-trans</span></span></p>
<p class="IndentText">Reference counted storage is transferred in
an inconsistent way.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>newref-trans</span></span></p>
<p class="IndentText">A new reference transferred to a reference
counted reference (reference count is not set correctly).</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>immediate-trans</span></span></p>
<p class="IndentText">An immediate address (result of
      <span class="CodeText"><span style=
      'font-size:10.0pt'>&amp;</span></span>) is transferred
      inconsistently.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>static-trans</span></span></p>
<p class="IndentText">Static storage is transferred in an
inconsistent way.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>expose-trans</span></span></p>
<p class="IndentText">Inconsistent exposure transfer. Exposed
storage is transferred to a non-<span class=
      "Annot"><span style='font-size:10.0pt'>exposed</span></span>,
      non-<span class="Annot"><span style=
      'font-size:10.0pt'>observer</span></span> reference.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>observer-trans</span></span></p>
<p class="IndentText">Inconsistent <span class=
      "Annot"><span style='font-size:10.0pt'>observer</span></span>
      transfer. Observer storage is transferred to a non-observer
      reference.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>unqualified-trans</span></span></p>
<p class="IndentText">Unqualified storage is transferred in an
inconsistent way.</p>
<p class="Heading11">Initializers</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>only-unq-global-trans</span></span></p>
<p class="IndentText">Only storage transferred to an unqualified
global or static reference. This may lead to a memory leak, since
the new reference is not necessarily released.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>static-init-trans</span></span></p>
<p class="IndentText">Static storage is used as an initial value in
an inconsistent way.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>unqualified-init-trans</span></span></p>
<p class="IndentText">Unqualified storage is used as an initial
value in an inconsistent way.</p>
<p class="Heading11">Derived Storage</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>comp-mem-pass</span></span></p>
<p class="IndentText">Storage derivable from a parameter does not
match the alias kind expected for the formal parameter.</p>
<p class="Heading11">Stack References</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>++++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>stack-ref</span></span></p>
<p class="IndentText">A stack reference is pointed to by an
external reference when the function returns.&nbsp; Since the call
frame will be destroyed when the function returns the return value
will point to dead storage. (Section 5.2.6)</p>
<p class="Heading10">Implicit Memory Annotations <span class=
"HeadingNote"><span style=
'font-size:10.5pt;font-weight:normal;font-style:normal'>(Section</span></span>
<span class="HeadingNote"><span style=
'font-size:10.5pt;font-weight:normal;font-style: normal'>5.3</span></span><span class="HeadingNote">
<span style=
'font-size:10.5pt; font-weight:normal;font-style:normal'>)</span></span></p>


<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>shortcut</span> <span class=
      "Keyword"><span style='font-size:10.0pt'></span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>all-imp-only</span></span></p>
<p class="IndentText">Sets
<span class="Flag"><span style=
'font-size:10.0pt'>
glob-imp-only, ret-imp-only, struct-imp-only, specglobimponly, specretimponly
</span></span>
and
<span class="Flag"><span style=
'font-size:10.0pt'>
specstructimponly
</span></span>.
</p>


<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>glob-imp-only</span></span></p>
<p class="IndentText">Assume unannotated global storage is
only.</p>


<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>param-imp-temp</span></span></p>
<p class="IndentText">Assume unannotated parameter is
      <span class="Annot"><span style=
      'font-size:10.0pt'>temp</span></span>.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>ret-imp-only</span></span></p>
<p class="IndentText">Assume unannotated returned storage is
<span class="Annot"><span style=
'font-size:10.0pt'>only</span></span>.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>struct-imp-only</span></span></p>
<p class="IndentText">Assume unannotated structure or union field
is <span class="Annot"><span style=
'font-size:10.0pt'>only</span></span>.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>code-imp-only</span></span></p>
<p class="IndentText">Sets <span class="Flag"><span style=
'font-size:10.0pt'>glob-imp-only</span></span>, <span class=
"Flag"><span style='font-size:10.0pt'>ret-imp-only</span></span>
and <span class="Flag"><span style=
'font-size:10.0pt'>struct-imp-only</span></span>.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>mem-imp</span></span></p>
<p class="IndentText">Report memory errors for unqualified
storage.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>pass-unknown</span></span></p>
<p class="IndentText">Passing a value as an unannotated parameter
clears its annotation.&nbsp; This will prevent many spurious errors
from being report for unannotated programs, but eliminates the
possibility of detecting many errors.</p>
<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
<a name="_Toc534975054">Sharing</a> <span class=
"TextFontCXChar"><span style=
'font-size:11.0pt; font-weight:normal'>(Section
6)</span></span></p>
<p class="Heading10">Aliasing <span class=
"TextFontCXChar"><span style=
'font-size:11.0pt; font-weight:normal'>(Section</span></span>
<span class="TextFontCXChar"><span style=
'font-size:11.0pt; font-weight:normal'>6.1</span></span><span class="TextFontCXChar">
<span style=
'font-size:11.0pt; font-weight:normal'>)</span></span></p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>alias-unique</span></span></p>
<p class="IndentText">An actual parameter that is passed as a
<span class="Annot"><span style=
'font-size:10.0pt'>unique</span></span> formal parameter is aliased
by another parameter or global variable.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>may-alias-unique</span></span></p>
<p class="IndentText">An actual parameter that is passed as a
<span class="Annot"><span style=
'font-size:10.0pt'>unique</span></span> formal parameter may be
aliased by another parameter or global variable.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>must-not-alias</span></span></p>
<p class="IndentText">An alias has been added to a
      <span class="Annot"><span style=
      'font-size:10.0pt'>temp</span></span>-qualifier&nbsp;parameter
      or global that is visible externally when the function
      returns.&nbsp;</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>ret-alias</span></span></p>
<p class="IndentText">A function returns an alias to parameter or
global.</p>
<p class="Heading10">Exposure <span class=
      "HeadingNote"><span style='font-size: 10.5pt;font-weight:normal;font-style:normal'>
(Section</span></span> <span class="HeadingNote"><span style=
'font-size:10.5pt;font-weight:normal;font-style: normal'>6.2</span></span><span class="HeadingNote">
<span style=
'font-size:10.5pt; font-weight:normal;font-style:normal'>)</span></span></p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>rep-expose</span></span></p>
<p class="IndentText">The internal representation of an abstract
type is visible to the caller.&nbsp; This means clients may have
access to a pointer into the abstract representation.&nbsp; (Sets
<span class="Flag"><span style=
'font-size:10.0pt'>assign-expose</span></span>, <span class=
"Flag"><span style='font-size:10.0pt'>ret-expose</span></span>, and
<span class="Flag"><span style=
'font-size:10.0pt'>cast-expose</span></span>.)</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>assign-expose</span></span></p>
<p class="IndentText">Abstract representation is exposed by an
assignment or passed parameter.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>cast-expose</span></span></p>
<p class="IndentText">Abstract representation is exposed through a
cast.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>ret-expose</span></span></p>
<p class="IndentText">Abstract representation is exposed by a
return value.</p>
<p class="Heading11">Observer Modifications</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>mod-observer</span></span></p>
<p class="IndentText">Possible modification of observer
storage.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>mod-observer-uncon</span></span></p>
<p class="IndentText">Storage declared with observer may be
modified through a call to an unconstrained function.</p>
<p class="Heading11">String Literals <span class=
"TextFontCXChar"><span style=
'font-weight: normal;font-style:normal'>(Section
6.2.1)</span></span></p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>read-only-trans</span></span></p>
<p class="IndentText">Report memory transfer errors for
initializations to read-only string literals</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>read-only-strings</span></span></p>
<p class="IndentText">String literals are read-only (ISO
semantics).&nbsp; An error is reported if a string literal may be
modified or released.</p>
<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
Function Interfaces <span class="TextFontCXChar"><span style=
'font-size:11.0pt;font-weight:normal'>(Section</span></span>
<span class="TextFontCXChar"><span style=
'font-size:11.0pt; font-weight:normal'>7</span></span><span class="TextFontCXChar">
<span style=
'font-size:11.0pt; font-weight:normal'>)</span></span></p>
<p class="Heading10">Modification <span class=
"TextFontCXChar"><span style=
'font-size:11.0pt; font-weight:normal'>(Section
7.1)</span></span></p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>modifies</span></span></p>
<p class="IndentText">Undocumented modification of caller-visible
state.&nbsp; Without <span class="Flag"><span style=
'font-size:10.0pt'>+moduncon</span></span>, modification errors are
only reported in the definitions of functions declared with a
modifies clause (or specified).</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>must-mod</span></span></p>
<p class="IndentText">Documented modification is not
detected.&nbsp; An object listed in the modifies clause for a
function, is not modified by the implementation.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>mod-uncon</span></span></p>
<p class="IndentText">Report modification errors in functions
declared without a modifies clause.(Sets <span class=
"Flag"><span style='font-size:10.0pt'>mod-nomods</span></span>,
<span class="Flag"><span style=
'font-size:10.0pt'>mod-globs-nomods</span></span> and
      <span class="Flag"><span style=
      'font-size:10.0pt'>mod-strict-globs-nomods</span></span>.)</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>mod-nomods</span></span></p>
<p class="IndentText">Report modification errors (not involving
global variables) in functions declared without a modifies
clause.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>mod-uncon-nomods</span></span></p>
<p class="IndentText">An unconstrained function is called in a
function body where modifications are checked.&nbsp; Since the
unconstrained function may modify anything, there may be undetected
modifications in the checked function.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>mod-internal-strict</span></span></p>
<p class="IndentText">A function that modifies <span class=
"Annot"><span style='font-size:10.0pt'>internalState</span></span>
is called from a function that does not list <span class=
"Annot"><span style='font-size:10.0pt'>internalState</span></span>
in its modifies clause.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>mod-file-sys</span></span></p>
<p class="IndentText">A function modifies the file system but does
not list <span class="Annot"><span style=
'font-size:10.0pt'>fileSystem</span></span>&nbsp;in its modifies
clause.</p>
<p class="Heading10">Global Variables <span class=
"HeadingNote"><span style=
'font-size:10.5pt;font-weight:normal;font-style:normal'>(Section</span></span>
<span class="HeadingNote"><span style=
'font-size:10.5pt;font-weight:normal;font-style: normal'>7.2</span></span><span class="HeadingNote">
<span style=
'font-size:10.5pt; font-weight:normal;font-style:normal'>)</span></span></p>
<p class="beforelist"><a name="globflags"></a>Errors involving the
use and modification of global and file static variables are
reported depending on flag settings, annotations where the global
variable is declared, and whether or not the function where the
global is used was declared with a globals clause.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>globs</span></span></p>
<p class="IndentText">Undocumented use of a checked global variable
in a function with a globals list.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>++++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>glob-use</span></span></p>
<p class="IndentText">A global listed in the globals list is not
used in the implementation.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>glob-noglobs</span></span></p>
<p class="IndentText">Use of a checked global in a function with no
globals list.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>internal-globs</span></span></p>
<p class="IndentText">Undocumented use of internal state (should
have <span class="Annot"><span style='font-size:10.0pt'>globals
internalState</span></span>).</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>internal-globs-noglobs</span></span></p>
<p class="TextFontCX">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
Use of internal state in function with no globals list.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>glob-state</span></span></p>
<p class="IndentText">A function returns with global in
inconsistent state (null or undefined)</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>all-globs</span></span></p>
<p class="IndentText">Report use and modification errors for
globals not annotated with <span class="Annot"><span style=
'font-size:10.0pt'>unchecked</span></span>.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>++++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>check-strict-globs</span></span></p>
<p class="IndentText">Report use and modification errors for
<span class="Annot"><span style=
'font-size:10.0pt'>checkedstrict</span></span> globals.</p>
<p class="Heading11">Modification of Global Variables</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>mod-globs</span></span></p>
<p class="IndentText">Undocumented modification of a checked global
variable.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>mod-globs-unchecked</span></span></p>
<p class="IndentText">Undocumented modification of an
      <span class="Annot"><span style=
      'font-size:10.0pt'>unchecked</span></span>
      global&nbsp;variable.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>mod-globs-nomods</span></span></p>
<p class="IndentText">Undocumented modification of a checked global
variable in a function with no modifies clause.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>mod-strict-globs-nomods</span></span></p>
<p class="IndentText">Undocumented modification of a
      <span class="Annot"><span style=
      'font-size:10.0pt'>checkedstrict</span></span>
      global&nbsp;variable in a function declared with no modifies
      clause.</p>
<p class="Heading11">Globals Lists and Modifies Clauses</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>warn-missing-globs</span></span></p>
<p class="IndentText">Global variable used in modifies clause is
not listed in globals list.&nbsp; (The global is added to the
globals list.)</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>warn-missing-globs-noglobs</span></span></p>
<p class="IndentText">Global variable used in modifies clause of a
function with no globals list.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>globs-imp-mods-nothing</span></span></p>
<p class="IndentText">A function declared with a globals list but
no modifies clause is assumed to modify nothing.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>mods-imp-noglobs</span></span></p>
<p class="IndentText">A function declared with a modifies clause
but no globals list is assumed to use no globals.</p>
<p class="Heading11">Implicit Checking Annotations</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>imp-checked-globs</span></span></p>
<p class="IndentText">Implicit <span class=
      "Annot"><span style='font-size:10.0pt'>checked</span></span>&nbsp;annotation
      on global variables with no checking annotation.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>imp-checked-statics</span></span></p>
<p class="IndentText">Implicit <span class=
      "Annot"><span style='font-size:10.0pt'>checked</span></span>&nbsp;qualifier
      file static scope variables with no checking annotation.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>imp-checkmod-globs</span></span></p>
<p class="IndentText">Implicit <span class=
      "Annot"><span style='font-size:10.0pt'>checkmod</span></span>
      qualifier on global variables with no checking
      annotation.</p>
<p class="IndentText"><span class="Flag"><span style=
'font-size:10.0pt'>&nbsp;</span></span></p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>imp-checkmod-statics</span></span></p>
<p class="IndentText">Implicit <span class=
      "Annot"><span style='font-size:10.0pt'>checkmod</span></span>
      qualifier file static scope variables with no checking
      annotation.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>imp-checkedstrict-globs</span></span></p>
<p class="IndentText">Implicit <span class=
      "Annot"><span style='font-size:10.0pt'>checked</span></span>
      qualifier on global variables with no checking
      annotation.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>imp-checkedstrict-statics</span></span></p>
<p class="IndentText">Implicit <span class=
      "Annot"><span style='font-size:10.0pt'>checked</span></span>
      qualifier file static scope variables with no checking
      annotation.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>imp-checkmod-internals</span></span></p>
<p class="IndentText">Implicit <span class=
      "Annot"><span style='font-size:10.0pt'>checkmod</span></span>
      qualifier on function scope static variables with no checking
      annotation.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="IndentText" style='margin-left:0in'><span class=
"Keyword"><span style='font-size:10.0pt'>&nbsp;</span></span></p>
<p class="Heading11">Global Aliasing</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>glob-alias</span></span></p>
<p class="IndentText">Function returns with global aliasing
external state (sets <span class="Flag"><span style=
'font-size:10.0pt'>checkstrict-glob-alias</span></span>,
<span class="Flag"><span style=
'font-size:10.0pt'>checked-glob-alias</span></span>,
      c<span class="Flag"><span style=
      'font-size:10.0pt'>heckmod-glob-alias</span></span>&nbsp;and
      <span class="Flag"><span style=
      'font-size:10.0pt'>unchecked-glob-alias</span></span>).</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>checkstrict-glob-alias</span></span></p>
<p class="IndentText">Function returns with a <span class=
"Annot"><span style='font-size:10.0pt'>checkedstrict</span></span>
global&nbsp;aliasing external state.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>checked-glob-alias</span></span></p>
<p class="IndentText">Function returns with a <span class=
"Annot"><span style='font-size:10.0pt'>checked</span></span>
global&nbsp;aliasing external state.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>checkmod-glob-alias</span></span></p>
<p class="IndentText">Function returns with a <span class=
"Annot"><span style='font-size:10.0pt'>checkmod</span></span>
global&nbsp;aliasing external state.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>unchecked-glob-alias</span></span></p>
<p class="IndentText">Function returns with an <span class=
"Annot"><span style='font-size:10.0pt'>unchecked</span></span>
global&nbsp;aliasing external state.</p>
<p class="Heading10">Declaration Consistency <span style=
'font-weight:normal'>(Section 7.3)</span></p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>incon-defs</span></span></p>
<p class="IndentText">Identifier redeclared or redefined with
inconsistent type.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>incon-defs-lib</span></span></p>
<p class="IndentText">Identifier defined in a library is redefined
with inconsistent type.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>overload</span></span></p>
<p class="IndentText">Standard library function overloaded.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>match-fields</span></span></p>
<p class="IndentText">A <span class="CodeText"><span style=
'font-size:10.0pt'>struct</span></span> or <span class=
"CodeText"><span style='font-size:10.0pt'>enum</span></span> type
is redefined with inconsistent fields or members.</p>
<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
<a name="_Toc534975057">Macros</a> <span class=
"TextFontCXChar"><span style=
'font-size:11.0pt; font-weight:normal'>(Section</span></span>
<span class="TextFontCXChar"><span style=
'font-size:11.0pt; font-weight:normal'>11</span></span><span class="TextFontCXChar">
<span style=
'font-size:11.0pt; font-weight:normal'>)</span></span></p>
<p class="TextFontCX">These flags control expansion and checking of
macro definitions and invocations.</p>
<p class="Heading10">Macro Expansion</p>
<p class="beforelist">These flags control which macros are checked
as functions or constants, and which are expanded in the
pre-processing phase.&nbsp; Macros preceded by <span class=
"Annot"><span style=
'font-size:10.0pt'>/*@notfunction@*/</span></span> are never
expanded regardless of these flag settings. &nbsp;These flags may
be used in source-file control comments.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>fcn-macros</span></span></p>
<p class="IndentText">Macros defined with parameter lists are not
expanded and are checked as functions.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>const-macros</span></span></p>
<p class="IndentText">Macros defined without parameter lists are
not expanded and are checked as constants.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>all-macros</span></span></p>
<p class="IndentText">Sets <span class="Flag"><span style=
'font-size:10.0pt'>fcn-macros</span></span> and <span class=
"Flag"><span style=
'font-size:10.0pt'>const-macros</span></span>.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>lib-macros</span></span></p>
<p class="IndentText">Macros defining identifiers declared in a
loaded library are not expanded and are checked according to the
library information.<span class="Flag"><span style=
'font-size:10.0pt'>&nbsp;</span></span></p>
<p class="Heading10">Macro Definitions</p>
<p class="beforelist">These flags control what errors are reported
in macro definitions.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>macro-stmt</span></span></p>
<p class="IndentText">Macro definition is not syntactically
equivalent to function.&nbsp; This means if the macro is used as a
statement (e.g., <span class="CodeText"><span style=
'font-size:10.0pt'>if (test) macro();</span></span>) unexpected
behavior may result.&nbsp; One fix is to surround the macro body
with <span class="CodeText"><span style='font-size:10.0pt'>do {
&#8230; } while (FALSE)</span></span>.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>macro-return</span></span></p>
<p class="IndentText">
The body of a macro declared as a function uses a
<span class="CodeText"><span style='font-size:10.0pt'>return</span></span>
statement. This exhibits behavior that could not be implemented by a function.
</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>macro-assign</span></span></p>
<p class="IndentText">A macro parameter is used as the left side of
an assignment expression.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>macro-parens</span></span></p>
<p class="IndentText">A macro parameter is used without parentheses
(in potentially dangerous context).</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>macro-empty</span></span></p>
<p class="IndentText">Macro definition of a function is
empty.&nbsp;&nbsp;</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>macro-redef</span></span></p>
<p class="IndentText">Macro is redefined.&nbsp; There is another
macro defined with the same name.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>macro-unrecog</span></span>&nbsp;</p>
<p class="IndentText">An unrecognized identifier appears in a macro
definition.&nbsp; Since the identifier may be defined where the
macro is used, this could be okay, but Splint will not be able to
check the unrecognized identifier appropriately.</p>
<p class="Heading11">Corresponding Declarations</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>++++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>macro-match-name</span></span></p>
<p class="IndentText">An <span class="Annot"><span style=
'font-size:10.0pt'>iter</span></span>&nbsp;or <span class=
"Annot"><span style=
'font-size:10.0pt'>constant</span></span>&nbsp;macro is defined
using a different name from the one used in the previous syntactic
comment</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>macro-decl</span></span></p>
<p class="IndentText">A macro definition has no corresponding
declaration.&nbsp; (Sets <span class="Flag"><span style=
'font-size:10.0pt'>macrofcndecl</span></span>&nbsp;and
      <span class="Flag"><span style=
      'font-size:10.0pt'>macroconstdecl</span></span>.)</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>macro-fcn-decl</span></span></p>
<p class="IndentText">Macro definition with parameter list has no
corresponding function prototype. Without a prototype, the types of
the macro result and parameters are unknown.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>macro-const-decl</span></span></p>
<p class="IndentText">A macro definition without parameter list has
no corresponding constant declaration.<span class=
"Flag"><span style=
'font-size: 10.0pt'>&nbsp;&nbsp;&nbsp;</span></span></p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>next-line-macros</span></span></p>
<p class="IndentText">A constant or iter declaration is not
immediately followed by a macro definition.</p>
<p class="Heading10">Side Effect Free Parameters <span class=
"HeadingNote"><span style=
'font-size:10.5pt;font-weight:normal;font-style:normal'>(Section</span></span>
<span class="HeadingNote"><span style=
'font-size:10.5pt;font-weight:normal;font-style: normal'>11.2.1</span></span><span class="HeadingNote">
<span style=
'font-size: 10.5pt;font-weight:normal;font-style:normal'>)</span></span></p>
<p class="beforelist">These flags control error reporting for
parameters with inconsistent side effects in invocations of checked
function macros and function calls.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>sef-params</span></span></p>
<p class="IndentText">An actual parameter with side effects is
passed as a formal parameter declared with <span class=
"Annot"><span style='font-size:10.0pt'>sef</span></span>.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>sef-uncon</span></span></p>
<p class="IndentText">An actual parameter involving a call to an
unconstrained function (declared without modifies clause) that may
modify anything is passed as a <span class=
      "Annot"><span style='font-size:10.0pt'>sef</span></span>
      parameter.</p>
<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
<a name="_Toc534975058">Iterators</a></p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>iterbalance</span></span></p>
<p class="IndentText">Iter is not balanced with end
<span class="CodeText"><span style='font-size:10.0pt'> &ltiter&gt</span></span>.
</p>

<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>iteryield</span></span></p>
<p class="IndentText">Iter yield parameter is inappropriate.
</p>

<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>has-yield</span></span></p>
<p class="IndentText">An iterator has been declared with no
parameters annotated with <span class="Annot"><span style=
'font-size:10.0pt'>yield</span></span>.</p>

<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
<a name="_Toc534975059">Naming Conventions</a> <span class=
"TextFontCXChar"><span style=
'font-size:11.0pt; font-weight:normal'>(Section
12)</span></span></p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>name-checks</span></span></p>
<p class="IndentText">Turns all name checking on or off without
changing other settings.</p>
<p class="Heading10">Type-Based Naming Conventions
      <span style='font-size:10.5pt; font-weight:normal'>(Section
      12.1)</span></p>
<p class="Heading11">Czech Naming Convention</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>czech</span></span></p>
<p class="IndentText">Selects complete Czech naming convention
(sets <span class="Flag"><span style=
'font-size:10.0pt'>access-czech</span></span>, <span class=
"Flag"><span style='font-size:10.0pt'>czech-fcns</span></span>,
<span class="Flag"><span style=
'font-size:10.0pt'>czech-vars</span></span>, <span class=
"Flag"><span style='font-size:10.0pt'>czech-consts</span></span>,
<span class="Flag"><span style=
'font-size:10.0pt'>czech-macros</span></span>, and
      <span class="Flag"><span style=
      'font-size:10.0pt'>czech-types</span></span>).</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>access-czech</span></span></p>
<p class="IndentText">Allow access to abstract types&nbsp;following
Czech naming convention.&nbsp; The representation of an abstract
type named <span class="CodeText"><i><span style=
'font-size:10.0pt'>t</span></i></span> is accessible in the
definition of a function or constant named <span class=
"CodeText"><i><span style=
'font-size:10.0pt'>t_name</span></i></span>.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>czech-fcns</span></span></p>
<p class="IndentText">Function or iterator name is not consistent
with Czech naming convention.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>czech-vars</span></span></p>
<p class="IndentText">&nbsp;Variable name is not consistent with
Czech naming convention.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>czech-macros</span></span></p>
<p class="IndentText">&nbsp;Expanded macro name is not consistent
with Czech naming convention.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>czech-consts</span></span></p>
<p class="IndentText">Constant name is not consistent with Czech
naming convention.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>czech-types</span></span></p>
<p class="IndentText">Type name is not consistent with Czech naming
convention.&nbsp; Czech type names must not use the underscore
character.</p>
<p class="Heading11">Slovak Naming Convention</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>slovak</span></span></p>
<p class="IndentText">Selects complete Slovak naming convention
(sets <span class="Flag"><span style=
'font-size:10.0pt'>access-slovak</span></span>, <span class=
"Flag"><span style='font-size:10.0pt'>slovak-fcns</span></span>,
<span class="Flag"><span style=
'font-size:10.0pt'>slovak-vars</span></span>, <span class=
"Flag"><span style='font-size:10.0pt'>slovak-consts</span></span>,
<span class="Flag"><span style=
'font-size:10.0pt'>slovak-macros</span></span>, and
      <span class="Flag"><span style=
      'font-size:10.0pt'>slovak-types</span></span>).</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>access-slovak</span></span></p>
<p class="IndentText">Allow access to abstract types&nbsp;following
Slovak naming convention. The representation of an abstract type
named <span class="CodeText"><i><span style=
'font-size:10.0pt'>t</span></i></span> is accessible in the
definition of a function or constant named <span class=
"CodeText"><i><span style=
'font-size:10.0pt'>tName</span></i></span>.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>slovak-fcns</span></span></p>
<p class="IndentText">Function or iterator name is not consistent
with Slovak naming convention.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>slovak-macros</span></span></p>
<p class="IndentText">Expanded macro name is not consistent with
Slovak naming convention.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>slovak-vars</span></span></p>
<p class="IndentText">&nbsp;Variable name is not consistent with
Slovak naming convention.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>slovak-consts</span></span></p>
<p class="IndentText">&nbsp;Constant name is not consistent with
Slovak naming convention.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>slovak-types</span></span></p>
<p class="IndentText">Type name is not consistent with Slovak
naming convention.&nbsp; Slovak type names may not include
uppercase letters.</p>
<p class="Heading11">Czechoslovak Naming Convention</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>czechoslovak</span></span></p>
<p class="IndentText">Selects complete Czechoslovak naming
convention (sets <span class="Flag"><span style=
'font-size:10.0pt'>access-czechoslovak</span></span>,
      <span class="Flag"><span style=
      'font-size:10.0pt'>czechoslovak-fcns</span></span>,
      <span class="Flag"><span style=
      'font-size:10.0pt'>czechoslovak-vars</span></span>,
      <span class="Flag"><span style=
      'font-size:10.0pt'>czechoslovak-consts</span></span>,
      <span class="Flag"><span style=
      'font-size:10.0pt'>czechoslovak-macros</span></span>, and
      <span class="Flag"><span style=
      'font-size:10.0pt'>czechoslovak-types</span></span>).</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>access-czechoslovak</span></span></p>
<p class="IndentText">Allow access to abstract types&nbsp;by
Czechoslovak naming convention. The representation of an abstract
type named <span class="CodeText"><i><span style=
'font-size:10.0pt'>t</span></i></span> is accessible in the
definition of a function or constant named <span class=
"CodeText"><i><span style=
'font-size:10.0pt'>t_name</span></i></span> or <span class=
"CodeText"><i><span style=
'font-size:10.0pt'>tName</span></i></span>.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>czechoslovak-fcns</span></span></p>
<p class="IndentText">&nbsp;Function name is not consistent with
Czechoslovak naming convention.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>czechoslovak-macros</span></span></p>
<p class="IndentText">Expanded macro name is not consistent with
Czechoslovak naming convention.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>czechoslovak-vars</span></span></p>
<p class="IndentText">Variable name is not consistent with
Czechoslovak naming convention.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>czechoslovak-consts</span></span></p>
<p class="IndentText">Constant name is not consistent with
Czechoslovak naming convention.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>czechoslovak-types</span></span></p>
<p class="IndentText">Type name is not consistent with Czechoslovak
naming convention. Czechoslovak type names may not include
uppercase letters or the underscore character.</p>
<p class="Heading10">Namespace Prefixes <span style=
'font-size:10.5pt; font-weight:normal'>(Section 12.2)</span></p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>macro-var-prefix</span></span><span class=
"Flag"><span style='font-size:10.0pt'>&nbsp;<i>&lt;prefix
string&gt;</i></span></span></p>
<p class="IndentText">Set namespace prefix for variables declared
in a macro body.&nbsp; (Default is <span class=
"CodeText"><span style='font-size:10.0pt'>m_</span></span>.)</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'>P: <span class=
"Keyword"><span style=
'font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>macro-var-prefix-exclude</span></span></p>
<p class="IndentText">A variable declared outside a macro body
starts with the <span class="Flag"><span style=
'font-size:10.0pt'>macro-var-prefix</span></span>.</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>tag-prefix</span></span><span class=
"Flag"><span style='font-size:10.0pt'>&nbsp;<i>&lt;prefix
string&gt;</i></span></span></p>
<p class="IndentText">Set namespace prefix of <span class=
"CodeText"><span style='font-size:10.0pt'>struct</span></span>,
<span class="CodeText"><span style=
'font-size:10.0pt'>union</span></span> or <span class=
"CodeText"><span style='font-size:10.0pt'>enum</span></span> tag
identifiers.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>tag-prefix-exclude</span></span></p>
<p class="IndentText">An identifier that is not a tag starts with
the <span class="Flag"><span style=
'font-size:10.0pt'>tagprefix</span></span>.</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>enum-prefix</span></span><span class=
"Flag"><span style='font-size:10.0pt'>&nbsp;<i>&lt;prefix
string&gt;</i></span></span></p>
<p class="IndentText">Set namespace prefix for <span class=
"CodeText"><span style='font-size:10.0pt'>enum</span></span>
members.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>enum-prefix-exclude</span></span></p>
<p class="IndentText">An identifier that is not an
      <span class="CodeText"><span style=
      'font-size:10.0pt'>enum</span></span> member starts with the
      <span class="Flag"><span style=
      'font-size:10.0pt'>enumprefix</span></span>.</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>file-static-prefix</span></span><span class="Flag">
<span style='font-size:10.0pt'>&nbsp;<i>&lt;prefix
string&gt;</i></span></span></p>
<p class="IndentText">Set namespace prefix for file
      <span class="CodeText"><span style=
      'font-size:10.0pt'>static</span></span> declarations.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>file-static-prefix-exclude</span></span></p>
<p class="IndentText">An identifier that is not file static starts
with the <span class="Flag"><span style=
'font-size:10.0pt'>filestaticprefix</span></span>.</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>global-prefix</span></span><span class=
"Flag"><span style='font-size:10.0pt'>&nbsp;<i>&lt;prefix
string&gt;</i></span></span></p>
<p class="IndentText">Set namespace prefix for global
variables.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>global-prefix-exclude</span></span></p>
<p class="IndentText">An identifier that is not a global variable
starts with the <span class="Flag"><span style=
'font-size:10.0pt'>globalprefix</span></span>.</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>type-prefix</span></span><span class=
"Flag"><span style='font-size:10.0pt'>&nbsp;<i>&lt;prefix
string&gt;</i></span></span></p>
<p class="IndentText">Set namespace prefix for user-defined
types.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>type-prefix-exclude</span></span></p>
<p class="IndentText">An identifier that is not a type name starts
with the <span class="Flag"><span style=
'font-size:10.0pt'>typeprefix</span></span>.</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>external-prefix</span></span><span class=
"Flag"><span style='font-size:10.0pt'>&nbsp;<i>&lt;prefix
string&gt;</i></span></span></p>
<p class="IndentText">Set namespace prefix for external
identifiers.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>external-prefix-exclude</span></span></p>
<p class="IndentText">An identifier that is not external starts
with the <span class="Flag"><span style=
'font-size:10.0pt'>externalprefix</span></span>.</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>local-prefix</span></span><span class=
"Flag"><span style='font-size:10.0pt'>&nbsp;<i>&lt;prefix
string&gt;</i></span></span></p>
<p class="IndentText">Set namespace prefix for local variables.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>local-prefix-exclude</span></span></p>
<p class="IndentText">&nbsp;An identifier that is not a local
variable starts with the <span class="Flag"><span style=
'font-size:10.0pt'>localprefix</span></span>.</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>unchecked-macro-prefix</span></span><span class="Flag">
<span style='font-size:10.0pt'>&nbsp;<i>&lt;prefix
string&gt;</i></span></span></p>
<p class="IndentText">Set namespace prefix for unchecked
macros.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>unchecked-macro-prefix-exclude</span></span></p>
<p class="IndentText">An identifier that is not the name of an
unchecked macro starts with the <span class=
      "Flag"><span style='font-size:10.0pt'>uncheckedmacroprefix</span></span>.</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>const-prefix</span></span><span class=
"Flag"><span style='font-size:10.0pt'>&nbsp;<i>&lt;prefix
string&gt;</i></span></span></p>
<p class="IndentText">Set namespace prefix for constants.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>const-prefix-exclude</span></span></p>
<p class="IndentText">An identifier that is not a constant starts
with the <span class="Flag"><span style=
'font-size:10.0pt'>constantprefix</span></span>.</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>iter-prefix</span></span><span class=
"Flag"><span style='font-size:10.0pt'>&nbsp;<i>&lt;prefix
string&gt;</i></span></span></p>
<p class="IndentText">Set namespace prefix for iterators.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>iter-prefix-exclude</span></span></p>
<p class="IndentText">An identifier that is not an
      <span class="Flag"><span style=
      'font-size:10.0pt'>iter</span></span>&nbsp;starts with the
      <span class="Flag"><span style=
      'font-size:10.0pt'>iterprefix</span></span>.</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>proto-param-prefix</span></span><span class="Flag">
<span style='font-size:10.0pt'>&nbsp;<i>&lt;prefix
string&gt;</i></span></span></p>
<p class="IndentText">Set namespace prefix for parameters in
function prototypes.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>proto-param-prefix-exclude</span></span></p>
<p class="IndentText">An identifier that is not a parameter in a
function prototype starts with the <span class=
      "Flag"><span style='font-size:10.0pt'>protoprarmprefix</span></span>.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>proto-param-name</span></span></p>
<p class="IndentText">A parameter in a function prototype has a
name (can interfere with macro definitions).</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>proto-param-match</span></span></p>
<p class="IndentText">The name of a parameter in a function
definition does not match the corresponding name of the parameter
in a function prototype (after removing the <span class=
"Flag"><span style=
'font-size:10.0pt'>protoparamprefix</span></span>).</p>
<p class="Heading10">Naming Restrictions <span style=
'font-size:10.5pt; font-weight:normal'>(Section 12.3)</span></p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>shadow</span></span></p>
<p class="IndentText">Declaration reuses name visible in outer
scope.</p>
<p class="Heading11">Reserved Names</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>ansi-reserved</span></span></p>
<p class="IndentText">External name conflicts with name reserved
for the compiler or standard library.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>ansi-reserved-internal</span></span></p>
<p class="IndentText">&nbsp;Internal name conflicts with name
reserved for the compiler or standard library.</p>

<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>iso-reserved</span></span></p>
<p class="IndentText">
External name is reserved for system use by ISO C99 standard.
</p>

<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>iso-reserved-internal</span></span></p>
<p class="IndentText">
Internal name is reserved for system in ISO C99 standard (this should not be necessary unless you are worried about C library implementations that violate the standard and use  macros).
</p>

<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>cpp-names</span></span></p>
<p class="IndentText">Internal or external name conflicts with a
C++ reserved word.&nbsp; (Will cause problems if program is
compiled with a C++ compiler.)</p>
<p class="Heading11">Distinct External Names</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>distinct-external-names</span></span></p>
<p class="IndentText">An external name is not distinguishable from
another external name using <span class="Flag"><span style=
'font-size:10.0pt'>externalnamelen</span></span><i>&nbsp;</i>significant
characters.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P: 6</span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>external-name-len</span></span><span class="Flag">
<span style=
'font-size:10.0pt'>&nbsp;<i>&lt;number&gt;</i></span></span></p>
<p class="IndentText">Sets the number of significant characters in
an external name (ANSI default minimum is 6).&nbsp; Sets
<span class="Flag"><span style=
'font-size:10.0pt'>+distinct-external-names</span></span>.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>external-name-case-insensitive</span></span></p>
<p class="IndentText">Make alphabetic case insignificant in
external names.&nbsp; According to ANSI standard, case need not be
significant in an external name.&nbsp; If <span class=
"Flag"><span style=
'font-size:10.0pt'>+distinct-external-names</span></span>&nbsp;is
not set, sets <span class="Flag"><span style=
'font-size:10.0pt'>+distinct-external-names</span></span> with
unlimited external name length.</p>
<p class="Heading11">Distinct Internal Names</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>distinct-internal-names</span></span></p>
<p class="IndentText">An internal name is not distinguishable from
another internal name using <span class="Flag"><span style=
'font-size:10.0pt'>internalnamelen</span></span>&nbsp;significant
characters.&nbsp;&nbsp; (Also effected by <span class=
"Flag"><span style=
'font-size:10.0pt'>internal-name-case-insensitive</span></span>&nbsp;and
<span class="Flag"><span style=
'font-size:10.0pt'>internal-name-lookalike</span></span>.)</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class="Flag"><span style=
'font-size:10.0pt'>31</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>internal-name-len</span></span><span class="Flag">
<span style=
'font-size:10.0pt'>&nbsp;<i>&lt;number&gt;</i></span></span></p>
<p class="IndentText">Set the number of significant characters in
an internal name. Sets <span class="Flag"><span style=
'font-size:10.0pt'>+distinct-internal-names</span></span>.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>internal-name-case-insensitive</span></span></p>
<p class="IndentText">Set whether case is significant an internal
names (<span class="Flag"><span style=
'font-size:10.0pt'>-internal-name-case-insensitive</span></span>&nbsp;means
case is significant).&nbsp; If <span class=
      "Flag"><span style='font-size:10.0pt'>+distinct-internal-names</span></span>&nbsp;is
      not set, sets <span class="Flag"><span style=
      'font-size:10.0pt'>+distinct-internal-names</span></span>
      with unlimited internal name length.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>internal-name-lookalike</span></span></p>
<p class="IndentText">&nbsp;Set whether similar looking characters
(e.g., &#8220;<span class="Keyword"><span style=
'font-size:10.0pt'>1</span></span>&#8221; and
      &#8220;<span class="Keyword"><span style=
      'font-size:10.0pt'>l</span></span>&#8221;) match in internal
      names.</p>
<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
Control Flow <span class="TextFontCXChar"><span style=
'font-size:11.0pt; font-weight:normal'>(Section
8)</span></span></p>
<p class="Heading10">Undefined Evaluation Order <span class=
"HeadingNote"><span style=
'font-size:10.5pt;font-weight:normal;font-style:normal'>(Section</span></span>
<span class="HeadingNote"><span style=
'font-size:10.5pt;font-weight:normal;font-style: normal'>8.2</span></span><span class="HeadingNote">
<span style=
'font-size:10.5pt; font-weight:normal;font-style:normal'>)</span></span></p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="Heading10" style='margin:0in;margin-bottom:.0001pt'>
<span class="Flag"><span style=
'font-size:10.0pt;font-weight:normal'>eval-order</span></span></p>
<p class="IndentText">Behavior of an expression is unspecified or
implementation-dependent because sub-expressions contain
interfering side effects that may be evaluated in any order.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>eval-order-uncon</span></span></p>
<p class="IndentText">An expression may be undefined because a
sub-expression contains a call to an unconstrained function (no
modifies clause) that may modify something that may be modified or
used by another sub-expression.</p>
<p class="Heading10">Problematic Control Structures
      <span class="HeadingNote"><span style=
      'font-size:10.5pt;font-weight:normal;font-style:normal'>(Section</span></span>
      <span class="HeadingNote"><span style=
      'font-size:10.5pt;font-weight:normal;font-style: normal'>8.3</span></span><span class="HeadingNote">
<span style=
'font-size:10.5pt; font-weight:normal;font-style:normal'>)</span></span></p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>inf-loops</span></span></p>
<p class="IndentText">Likely infinite loop is detected (Section
8.3.1).</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>inf-loops-uncon</span></span></p>
<p class="IndentText">Likely infinite loop is detected.&nbsp; Loop
test or body calls an unconstrained function that may produce an
undetected modification.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>elseif-complete</span></span></p>
<p class="IndentText">There is no finals else following an else if
construct (Section 8.3.5).</p>

<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>case-break</span></span></p>
<p class="IndentText">There is a non-empty case in a switch not
followed by a <span class="CodeText"><span style=
'font-size:10.0pt'>break</span></span><span class=
"HeadingNote"><span style=
'font-size:10.5pt;font-style:normal'>(Section</span></span>
<span class="HeadingNote"><span style=
'font-size:10.5pt;font-style:normal'>8.3.2</span></span><span class="HeadingNote">
<span style=
'font-size:10.5pt;font-style:normal'>).</span></span></p>


<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>first-case</span></span></p>
<p class="IndentText">
The first statement after a switch is not a case.
</p>


<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>Duplicate-case</span></span></p>
<p class="IndentText">
Duplicate cases in switch.
</p>

<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>miss-case</span></span></p>
<p class="IndentText">A switch on an <span class=
"CodeText"><span style='font-size: 10.0pt'>enum</span></span> type
is missing a case for a member of the enumerator.</p>

<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P</span><span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>emptyreturn
</span></span></p>
<p class="IndentText">Empty return in function declared to return value.</p>

<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P</span><span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>alwaysexits
</span></span></p>
<p class="IndentText">
Loop predicate always exits. 
</p>

<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>shortcut</span><span class=
      "Keyword"><span style='font-size:10.0pt'></span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>loop-exec</span></span></p>
<p class="IndentText">Assume all loops execute at least once.&nbsp;
This effects use-before-definition&nbsp;and memory checking.&nbsp;
It should probably not be used globally, but may be used
surrounding a particular loop that is known to always execute to
prevent spurious messages.
 (sets
<span class="Flag"><span style=
'font-size:10.0pt'>
 for-loop-exec, while-loop-exec and iter-loop-exec
</span></span>
</p>

<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>for-loop-exec
</span></span></p>
<p class="IndentText">
Assume all<span class=
"CodeText"><span style='font-size: 10.0pt'>
for
</span></span>
 loops execute at least once.  This effects use-before-definition
and memory checking.  It should probably not be used globally, but may be used
surrounding a particular loop that is known to always execute to prevent spurious messages.
</p>



<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>while-loop-exec
</span></span></p>
<p class="IndentText">
Assume all<span class=
"CodeText"><span style='font-size: 10.0pt'>
while
</span></span>
 loops execute at least once.  This effects use-before-definition
and memory checking.  It should probably not be used globally, but may be used
surrounding a particular loop that is known to always execute to prevent spurious messages.
</p>


<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>iter-loop-exec
</span></span></p>
<p class="IndentText">
Assume all<span class=
"CodeText"><span style='font-size: 10.0pt'>
iter
</span></span>
 loops execute at least once.  This effects use-before-definition
and memory checking.  It should probably not be used globally, but may be used
surrounding a particular loop that is known to always execute to prevent spurious messages.
</p>



<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P</span><span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>obvious-loop-exec
</span></span></p>
<p class="IndentText">
Assume loop that can be determined to always execute always does.
</p>

<p class="Heading10">Deep Break <span class=
"TextFontCXChar"><span style=
'font-size:11.0pt; font-weight:normal'>(Section</span></span>
<span class="TextFontCXChar"><span style=
'font-size:11.0pt; font-weight:normal'>8.3.3</span></span><span class="TextFontCXChar">
<span style=
'font-size:11.0pt; font-weight:normal'>)</span></span></p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>deep-break</span></span></p>
<p class="IndentText">Report errors for <span class=
"CodeText"><span style='font-size:10.0pt'>break</span></span>
statements inside a nested <span class=
      "CodeText"><span style='font-size:10.0pt'>while</span></span>,
      <span class="CodeText"><span style=
      'font-size:10.0pt'>for</span></span> or <span class=
      "CodeText"><span style=
      'font-size:10.0pt'>switch</span></span>.&nbsp; (Sets all
      nested break and continue flags.)</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
<p class="MsoListBullet"><span class="Flag"><span style=
'font-size:10.0pt'>loop-loop-break</span></span></p>
<p class="IndentText"><span class="TextFontCXChar">There is
a</span> <span class="CodeText"><span style=
'font-size:10.0pt'>break</span></span> inside a <span class=
"CodeText"><span style='font-size:10.0pt'>while</span></span>,
<span class="CodeText"><span style=
'font-size:10.0pt'>for</span></span> or iterator loop that is
inside a <span class="CodeText"><span style=
'font-size: 10.0pt'>while</span></span>, <span class=
"CodeText"><span style='font-size:10.0pt'>for</span></span> or
iterator loop. Mark with <span class="Annot"><span style=
'font-size:10.0pt'>/*@innerbreak@*/</span></span> to suppress the
message.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
<p class="MsoListBullet"><span class="Flag"><span style=
'font-size:10.0pt'>switch-loop-break</span></span></p>
<p class="IndentText"><span class="TextFontCXChar">There is
a</span><span class="CodeText"><span style=
'font-size:10.0pt'>break</span></span> inside a <span class=
"CodeText"><span style='font-size:10.0pt'>while</span></span>,
<span class="CodeText"><span style=
'font-size:10.0pt'>for</span></span> or iterator loop that is
inside a <span class="CodeText"><span style=
'font-size: 10.0pt'>switch</span></span> statement.&nbsp; Mark with
<span class="Annot"><span style=
'font-size:10.0pt'>/*@loopbreak@*/</span></span>.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
<p class="MsoListBullet"><span class="Flag"><span style=
'font-size:10.0pt'>loop-switch-break</span></span></p>
<p class="IndentText"><span class="TextFontCXChar">There is
a</span><span class="CodeText"><span style=
'font-size:10.0pt'>break</span></span> inside a <span class=
"CodeText"><span style='font-size:10.0pt'>switch</span></span>
statement that is inside a <span class=
      "CodeText"><span style='font-size:10.0pt'>while</span></span>,
      <span class="CodeText"><span style=
      'font-size:10.0pt'>for</span></span> or iterator loop.&nbsp;
      Mark with /<span class="Annot"><span style=
      'font-size:10.0pt'>*@switchbreak@*/</span></span>.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
<p class="MsoListBullet" style='margin-left:0in;text-indent:0in'>
<span class="Flag"><span style=
'font-size:10.0pt'>switch-switch-break</span></span></p>
<p class="IndentText"><span class="TextFontCXChar">There is
a</span><span class="CodeText"><span style=
'font-size:10.0pt'>break</span></span> inside a <span class=
"CodeText"><span style='font-size:10.0pt'>switch</span></span>
statement that is inside another <span class=
      "CodeText"><span style='font-size: 10.0pt'>switch</span></span>
      statement.&nbsp; Mark with <span class="Annot"><span style=
      'font-size:10.0pt'>/*@innerbreak@*/</span></span>.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>loop-loop-continue</span></span></p>
<p class="IndentText">There is a <span class=
      "CodeText"><span style='font-size: 10.0pt'>continue</span></span>
      inside a while, for or iterator loop that is inside a while,
      for or iterator loop.&nbsp; Mark with <span class=
      "Annot"><span style=
      'font-size:10.0pt'>/*@innercontinue@*/</span></span>.</p>
<p class="Heading10">Loop and if Bodies <span class=
"TextFontCXChar"><span style=
'font-size:11.0pt; font-weight:normal'>(Section
8.3.4)</span></span></p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>all-empty</span></span></p>
<p class="IndentText">An if, while or for statement has no body
(sets <span class="Flag"><span style=
'font-size:10.0pt'>if-empty</span></span>, <span class=
"Flag"><span style=
'font-size:10.0pt'>while-empty</span></span>&nbsp;and
      <span class="Flag"><span style=
      'font-size:10.0pt'>for-empty</span></span>.)</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>all-block</span></span></p>
<p class="IndentText">The body of an <span class=
"CodeText"><span style='font-size: 10.0pt'>if</span></span>,
<span class="CodeText"><span style=
'font-size:10.0pt'>while</span></span> or <span class=
"CodeText"><span style='font-size:10.0pt'>for</span></span>
statement is not a block (sets <span class=
      "Flag"><span style='font-size:10.0pt'>if-block</span></span>,
      <span class="Flag"><span style=
      'font-size:10.0pt'>while-block</span></span>&nbsp;and
      <span class="Flag"><span style=
      'font-size:10.0pt'>for-block</span></span>.)</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>while-empty</span></span></p>
<p class="IndentText">A while statement has no body.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>while-block</span></span></p>
<p class="IndentText">&nbsp;The body of a <span class=
"CodeText"><span style='font-size: 10.0pt'>while</span></span>
statement is not a block</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>for-empty</span></span></p>
<p class="IndentText">A <span class="CodeText"><span style=
'font-size:10.0pt'>for</span></span> statement has no body.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>for-block</span></span></p>
<p class="IndentText">The body of a <span class=
"CodeText"><span style='font-size: 10.0pt'>for</span></span>
statement is not a block.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>++++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>if-empty</span></span></p>
<p class="IndentText">An <span class="CodeText"><span style=
'font-size:10.0pt'>if</span></span> statement has no body.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>ifblock</span></span></p>
<p class="IndentText">The body of an <span class=
"CodeText"><span style='font-size: 10.0pt'>if</span></span>
statement is not a block.</p>
<p class="Heading10">Suspicious Statements <span class=
"TextFontCXChar"><span style=
'font-size:11.0pt; font-weight:normal'>(Section
8.4)</span></span></p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>unreachable</span></span></p>
<p class="IndentText">Code is not reached on any possible
execution.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>noeffect</span></span></p>
<p class="IndentText">Statement has no effect.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>noeffect-uncon</span></span></p>
<p class="IndentText">Statement involving call to unconstrained
function may have no effect.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>noret</span></span></p>
<p class="IndentText">There is a path with no <span class=
"Keyword"><span style='font-size:10.0pt'>return</span></span> in a
function declared to return a non-<span class=
      "Keyword"><span style='font-size:10.0pt'>void</span></span>
      value.</p>
<p class="Heading10">Ignored Return Values <span class=
"TextFontCXChar"><span style=
'font-size:11.0pt; font-weight:normal'>(Section</span></span>
<span class="TextFontCXChar"><span style=
'font-size:11.0pt; font-weight:normal'>8.4.2</span></span><span class="TextFontCXChar">
<span style=
'font-size:11.0pt; font-weight:normal'>)</span></span></p>
<p class="beforelist">These flags control when errors are reported
for function calls that do not use the return value.&nbsp; Casting
the function call to <span class="CodeText"><span style=
'font-size:10.0pt'>void</span></span> or declaring the called
function to return <span class="Annot"><span style=
'font-size:10.0pt'>/*@alt void@*/</span></span>.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>ret-val-bool</span></span></p>
<p class="IndentText">Return value of type <span class=
"CodeText"><span style='font-size:10.0pt'>bool</span></span>
ignored.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>ret-val-int</span></span></p>
<p class="IndentText">Return value of type <span class=
"CodeText"><span style='font-size:10.0pt'>int</span></span>
ignored.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>++++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>ret-val-other</span></span></p>
<p class="IndentText">Return value of type other than
      <span class="CodeText"><span style=
      'font-size:10.0pt'>bool</span></span>&nbsp;or <span class=
      "CodeText"><span style='font-size:10.0pt'>int</span></span>
      ignored.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>ret-val</span></span></p>
<p class="IndentText">Return value ignored (Sets <span class=
"Flag"><span style='font-size:10.0pt'>retvalbool</span></span>,
<span class="Flag"><span style=
'font-size:10.0pt'>retvalint</span></span>, <span class=
"Flag"><span style=
'font-size:10.0pt'>retvalother</span></span>.)</p>

<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
Memory Bounds <span class="HeadingNote"><span style=
'font-size:10.5pt;font-weight:normal;font-style: normal'>(Section</span></span>
<span class="HeadingNote"><span style=
'font-size:10.5pt;font-weight:normal;font-style: normal'>9</span></span>)

<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>bounds</span></span></p>
<p class="IndentText">
Memory read or write may be out of bounds of allocated storage
(sets <span class=
"Flag"><span style='font-size:10.0pt'>boundsread</span></span>
and
<span class="Flag"><span style=
'font-size:10.0pt'>boundswrite</span></span>
</p>

<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
       <tr>
       <td valign="top" align="left" height="14" style=
       'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
       <p class="TextFontCX" align="center" style=
       'text-align:center;background:#CCCCCC'><span style=
       'font-size:10.0pt'>m:</span><span class=
             "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
	     <p class="TextFontCX"><span class="Flag"><span style=
	     'font-size:10.0pt'>boundsread</span></span></p>
	     <p class="IndentText">
	     A memory read references memory beyond the allocated storage
	     (also sets <span class=
	     "Flag"><span style='font-size:10.0pt'>likelyboundsread</span></span>.
	     </p>

<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
       <tr>
       <td valign="top" align="left" height="14" style=
       'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
       <p class="TextFontCX" align="center" style=
       'text-align:center;background:#CCCCCC'><span style=
       'font-size:10.0pt'>m:</span><span class=
             "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
	     <p class="TextFontCX"><span class="Flag"><span style=
	     'font-size:10.0pt'>boundswrite</span></span></p>
	     <p class="IndentText">
	     A memory write may write to an address beyond the allocated buffer
	     (also sets <span class=
	     "Flag"><span style='font-size:10.0pt'>likelyboundswrite</span></span>.
	     </p>
	     
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>likelybounds</span></span></p>
<p class="IndentText">
Likely memory read or write is likely to be out of bounds of allocated storage
(sets <span class=
"Flag"><span style='font-size:10.0pt'>likelyboundsread</span></span>
and
<span class="Flag"><span style=
'font-size:10.0pt'>likelyboundswrite)</span></span>
</p>


<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
       <tr>
       <td valign="top" align="left" height="14" style=
       'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
       <p class="TextFontCX" align="center" style=
       'text-align:center;background:#CCCCCC'><span style=
       'font-size:10.0pt'>m:</span><span class=
             "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
	     <p class="TextFontCX"><span class="Flag"><span style=
	     'font-size:10.0pt'>likelyboundsread</span></span></p>
	     <p class="IndentText">
	     A likely memory read references memory beyond the allocated storage
	     (also sets <span class=
	     "Flag"><span style='font-size:10.0pt'>likelyboundsread</span></span>.
	     </p>

<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
       <tr>
       <td valign="top" align="left" height="14" style=
       'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
       <p class="TextFontCX" align="center" style=
       'text-align:center;background:#CCCCCC'><span style=
       'font-size:10.0pt'>m:</span><span class=
             "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
	     <p class="TextFontCX"><span class="Flag"><span style=
	     'font-size:10.0pt'>likelyboundswrite</span></span></p>
	     <p class="IndentText">
	     A memory write is likely to write to an address beyond the allocated buffer.
	    </p>
	     
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
       <tr>
       <td valign="top" align="left" height="14" style=
       'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
       <p class="TextFontCX" align="center" style=
       'text-align:center;background:#CCCCCC'><span style=
       'font-size:10.0pt'>m:</span><span class=
             "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
	     <p class="TextFontCX"><span class="Flag">fcnpost<span style=
	     'font-size:10.0pt'></span></span></p>
	     <p class="IndentText">
	     Display function post conditions.
	     </p>


<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
       <tr>
       <td valign="top" align="left" height="14" style=
       'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
       <p class="TextFontCX" align="center" style=
       'text-align:center;background:#CCCCCC'><span style=
       'font-size:10.0pt'>m:</span><span class=
             "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
	     <p class="TextFontCX"><span class="Flag">redundantconstraints<span style=
	     'font-size:10.0pt'></span></span></p>
	     <p class="IndentText">
	     Display seemingly redundant conditions.
	     </p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
       <tr>
       <td valign="top" align="left" height="14" style=
       'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
       <p class="TextFontCX" align="center" style=
       'text-align:center;background:#CCCCCC'><span style=
       'font-size:10.0pt'>m:</span><span class=
             "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
	     <p class="TextFontCX"><span class="Flag">checkpost<span style=
	     'font-size:10.0pt'></span></span></p>
	     <p class="IndentText">
	     The functions implementation may not satidfy a post condition given in an ensures clause.
	    </p>


<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
       <tr>
       <td valign="top" align="left" height="14" style=
       'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
       <p class="TextFontCX" align="center" style=
       'text-align:center;background:#CCCCCC'><span style=
       'font-size:10.0pt'>P-</span><span class=
             "Keyword"><span style='font-size:10.0pt'></span></span></p></td></tr></table></div>
	     <p class="TextFontCX"><span class="Flag">showconstraintparens<span style=
	     'font-size:10.0pt'></span></span></p>
	     <p class="IndentText">
Display parentheses around constraint terms.
	    </p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
       <tr>
       <td valign="top" align="left" height="14" style=
       'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
       <p class="TextFontCX" align="center" style=
       'text-align:center;background:#CCCCCC'><span style=
       'font-size:10.0pt'>P+</span><span class=
             "Keyword"><span style='font-size:10.0pt'></span></span></p></td></tr></table></div>
	     <p class="TextFontCX"><span class="Flag">showconstraintlocation<span style=
	     'font-size:10.0pt'></span></span></p>
	     <p class="IndentText">
Display location for every constraint generated.
	    </p>
<br>
<p class="beforelist">	    
The following flags are mainly of interest to Splint developers.  The default values are adequate in normal use.  They are included for completeness.
</p>

<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
       <tr>
       <td valign="top" align="left" height="14" style=
       'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
       <p class="TextFontCX" align="center" style=
       'text-align:center;background:#CCCCCC'><span style=
       'font-size:10.0pt'>P-</span><span class=
             "Keyword"><span style='font-size:10.0pt'></span></span></p></td></tr></table></div>
	     <p class="TextFontCX"><span class="Flag">
debugfcnconstraint
<span style='font-size:10.0pt'></span></span></p>
	     <p class="IndentText">
Perform buffer overflow checking even if the errors would be inhibited.
	    </p>

	    

<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
       <tr>
       <td valign="top" align="left" height="14" style=
       'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
       <p class="TextFontCX" align="center" style=
       'text-align:center;background:#CCCCCC'><span style=
       'font-size:10.0pt'>P-</span><span class=
             "Keyword"><span style='font-size:10.0pt'></span></span></p></td></tr></table></div>
	     <p class="TextFontCX"><span class="Flag">
implictconstraints
<span style='font-size:10.0pt'></span></span></p>
	     <p class="IndentText">
Generate implicit constraints for functions.&nbsp;  This is an experimental option.&nbsp; 
Currently this option reduces the number of bounds errors but causes real error to be missed. 
	    </p>


<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
       <tr>
       <td valign="top" align="left" height="14" style=
       'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
       <p class="TextFontCX" align="center" style=
       'text-align:center;background:#CCCCCC'><span style=
       'font-size:10.0pt'>P-</span><span class=
             "Keyword"><span style='font-size:10.0pt'></span></span></p></td></tr></table></div>
	     <p class="TextFontCX"><span class="Flag">
orconstraint
<span style='font-size:10.0pt'></span></span></p>
	     <p class="IndentText">
This flags affects the internal constraint resolution.&nbsp  If set, the internal constraint resolution is more accurate.&nbsp The performance impact is minimal so there is little reason not to have this flag set.</p>

<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
Extensible Checking <span class="HeadingNote"><span style=
'font-size:10.5pt;font-weight:normal;font-style: normal'>(Section</span></span>
<span class="HeadingNote"><span style=
'font-size:10.5pt;font-weight:normal;font-style: normal'>13</span></span><span class="HeadingNote">
<span style=
'font-size:10.5pt;font-weight:normal;font-style: normal'>)</span></span></p>


<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
       <tr>
       <td valign="top" align="left" height="14" style=
       'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
       <p class="TextFontCX" align="center" style=
       'text-align:center;background:#CCCCCC'><span style=
       'font-size:10.0pt'>P-</span><span class=
             "Keyword"><span style='font-size:10.0pt'></span></span></p></td></tr></table></div>
	     <p class="TextFontCX"><span class="Flag">
mts &ltfilename&gt
<span style='font-size:10.0pt'></span></span></p>
	     <p class="IndentText">
Load meta state declaration and corresponding xh file.
</p>


<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
       <tr>
       <td valign="top" align="left" height="14" style=
       'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
       <p class="TextFontCX" align="center" style=
       'text-align:center;background:#CCCCCC'><span style=
       'font-size:10.0pt'>m:</span><span class=
             "Keyword"><span style='font-size:10.0pt'>++++</span></span></p></td></tr></table></div>
	     <p class="TextFontCX"><span class="Flag">
statetransfer
<span style='font-size:10.0pt'></span></span></p>
	     <p class="IndentText">
Transfer violates user-defined state rules.
</p>


<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
       <tr>
       <td valign="top" align="left" height="14" style=
       'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
       <p class="TextFontCX" align="center" style=
       'text-align:center;background:#CCCCCC'><span style=
       'font-size:10.0pt'>m:</span><span class=
             "Keyword"><span style='font-size:10.0pt'>++++</span></span></p></td></tr></table></div>
	     <p class="TextFontCX"><span class="Flag">
statemerge
<span style='font-size:10.0pt'></span></span></p>
	     <p class="IndentText">
Control path merge violates user-defined state merge rules. 
</p>
	    
<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
Completeness <span class="HeadingNote"><span style=
'font-size:10.5pt;font-weight:normal;font-style: normal'>(Section</span></span>
<span class="HeadingNote"><span style=
'font-size:10.5pt;font-weight:normal;font-style: normal'>13</span></span><span class="HeadingNote">
<span style=
'font-size:10.5pt;font-weight:normal;font-style: normal'>)</span></span></p>
<p class="Heading10">Unused Declarations <span class=
"HeadingNote"><span style=
'font-size:10.5pt;font-weight:normal;font-style:normal'>(Section</span></span>
<span class="HeadingNote"><span style=
'font-size:10.5pt;font-weight:normal;font-style: normal'>13.1</span></span><span class="HeadingNote">
<span style=
'font-size:10.5pt;font-weight:normal;font-style: normal'>)</span></span></p>
<p class="beforelist">These flags control when errors are reported
for declarations that are never used.&nbsp; The <span class=
"Annot"><span style='font-size:10.0pt'>unused</span></span>
annotation can be used to prevent unused errors from being report
for a particular declaration.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>top-use</span></span></p>
<p class="IndentText">An external declaration is not used in any
file.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>const-use</span></span></p>
<p class="IndentText">Constant never used.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>enum-mem-use</span></span></p>
<p class="IndentText">Member of enumerator never used.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>++++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>var-use</span></span></p>
<p class="IndentText">Variable never used.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>param-use</span></span></p>
<p class="IndentText">Function parameter never used.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>++++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>fcn-use</span></span></p>
<p class="IndentText">Function is never used.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>++++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>type-use</span></span></p>
<p class="IndentText">Defined type never used.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>field-use</span></span></p>
<p class="IndentText">Field of structure or union type is never
used.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>unused-special</span></span></p>
<p class="IndentText">Declaration in a special file (corresponding
to <span class="ProgramNameChar">.l</span> or <span class=
"ProgramNameChar">.y</span> file) is unused.</p>
<p class="Heading10">Complete Programs <span class=
"TextFontCXChar"><span style=
'font-size:11.0pt; font-weight:normal'>(Section
13.2)</span></span></p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>decl-undef</span></span></p>
<p class="IndentText">Function, variable, iterator or constant
declared but never defined.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>partial</span></span></p>
<p class="IndentText">Check as partial system (sets
      <span class="Flag"><span style=
      'font-size:10.0pt'>-decl-undef</span></span>, <span class=
      "Flag"><span style=
      'font-size:10.0pt'>-export-local</span></span>&nbsp;and
      prevents checking of macros in headers without corresponding
      <span class="ProgramNameChar">.c</span> files.)</p>
<p class="Heading10">Exports</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>export-local</span></span></p>
<p class="IndentText">A declaration is exported but not used
outside this module.&nbsp; (Declaration can use the
      <span class="CodeText"><span style=
      'font-size: 10.0pt'>static</span></span> qualifier.)</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>export-header</span></span></p>
<p class="IndentText">A declaration (other than a variable) is
exported but does not appear in a header file.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>export-header-var</span></span></p>
<p class="IndentText">A variable declaration is exported but does
not appear in a header file.</p>
<p class="Heading10">Unrecognized Identifiers</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>unrecog</span></span></p>
<p class="IndentText">An unrecognized identifier is used.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>sys-unrecog</span></span></p>
<p class="IndentText">Report unrecognized identifiers that start
with the system prefix, <span class="Keyword"><span style=
'font-size:10.0pt'>__</span></span> (two underscores).</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>repeat-unrecog</span></span></p>
<p class="IndentText">Report multiple messages for unrecognized
identifiers.&nbsp; If <span class="Flag"><span style=
'font-size:10.0pt'>repeatunrecog</span></span> is not set, an error
is reported only the first time a particular unrecognized
identifier appears in the file.</p>
<p class="Heading10">Multiple Definition and Declarations</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>redef</span></span></p>
<p class="IndentText">A function or variable is defined more than
once.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>redecl</span></span></p>
<p class="IndentText">An identifier is declared more than once.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>nested-extern</span></span></p>
<p class="IndentText">An <span class="Keyword"><span style=
'font-size:10.0pt'>extern</span></span> declaration is used inside
a function body.</p>
<p class="Heading10">ISO Conformance</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>noparams</span></span></p>
<p class="IndentText">A function is declared without a parameter
list prototype.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>old-style</span></span></p>
<p class="IndentText">Function definition is in old style
syntax.&nbsp; Standard prototype syntax is preferred.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>exit-arg</span></span></p>
<p class="IndentText">Argument to <span class=
"CodeText"><span style=
'font-size: 10.0pt'>exit</span></span>&nbsp;has implementation
defined behavior.&nbsp; The only valid arguments to
      <span class="CodeText"><span style=
      'font-size:10.0pt'>exit</span></span> are <span class=
      "CodeText"><span style=
      'font-size:10.0pt'>EXIT_SUCCESS</span></span>, <span class=
      "CodeText"><span style=
      'font-size:10.0pt'>EXIT_FAILURE</span></span> and
      <span class="CodeText"><span style=
      'font-size:10.0pt'>0</span></span>.&nbsp; An error is
      reported if Splint can determine statically that the argument
      to <span class="CodeText"><span style=
      'font-size:10.0pt'>exit</span></span> is not one of
      these.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>use-varargs</span></span></p>
<p class="IndentText">Report if <span class=
      "CodeText"><span style='font-size:10.0pt'>&lt;varargs.h&gt;</span></span>
      is used (should use <span class=
      "ProgramNameChar"><span style='font-size:10.0pt'>stdarg.h</span></span>).</p>
<p class="Heading10">Limits</p>
<p class="beforelist">The ANSI Standard includes limits on minimum
numbers that a conforming compiler must support.&nbsp; Whether of
not a particular compiler exceeds these limits, it is worth
checking that a program does not exceed them so that other
compilers may safely compile it.&nbsp; In addition, exceeding a
limit may indicate a problem in the code (e.g., it is too complex
if the control nest depth limit is exceeded) that should be fixed
regardless of the compiler.&nbsp; Splint checks the following
limits.&nbsp; For each limit, the maximum value may be set from the
command line (or locally using a stylized comment).&nbsp; The
minimum limits were increased for the ISO C99 specification.&nbsp;
If the <span class="Flag"><span style=
'font-size:10.0pt'>iso99-limits</span></span> flag is used, all
limits are checked with the minimum values of an ISO C99 conforming
compiler.&nbsp; If the <span class="Flag"><span style=
'font-size:10.0pt'>ansi89-limits</span></span> flag is used, all
limits are checked with the minimum values of an ANSI C89
conforming compiler.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>ansi89-limits</span></span></p>
<p class="IndentText">Check for violations of minimum limits
prescribed by ANSI C89 standard (sets <span class=
"Flag"><span style=
'font-size:10.0pt'>control-nest-depth</span></span>,
      <span class="Flag"><span style=
      'font-size:10.0pt'>string-literal-len</span></span>,
      <span class="Flag"><span style=
      'font-size:10.0pt'>include-nest</span></span>, <span class=
      "Flag"><span style=
      'font-size:10.0pt'>num-struct-fields</span></span>, and
      <span class="Flag"><span style=
      'font-size:10.0pt'>num-enum-members</span></span>).</p>
 <div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>iso99-limits</span></span></p>
<p class="IndentText">Check for violations of minimum limits
prescribed by ISO C99 standard (sets <span class=
"Flag"><span style=
'font-size:10.0pt'>control-nest-depth</span></span>,
      <span class="Flag"><span style=
      'font-size:10.0pt'>string-literal-len</span></span>,
      <span class="Flag"><span style=
      'font-size:10.0pt'>include-nest</span></span>, <span class=
      "Flag"><span style=
      'font-size:10.0pt'>num-struct-fields</span></span>, and
      <span class="Flag"><span style=
      'font-size:10.0pt'>num-enum-members</span></span>).</p>
           
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>control-nest-depth</span></span><span class="Flag">
<span style=
'font-size:10.0pt'>&nbsp;<i>&lt;number&gt;</i></span></span></p>
<p class="IndentText">Set maximum nesting depth of compound
statements, iteration control structures, and selection control
structures (ISO C99 minimum is 63; ANSI C89 minimum is 15).</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>string-literal-len</span></span><span class="Flag">
<span style=
'font-size:10.0pt'>&nbsp;<i>&lt;number&gt;</i></span></span></p>
<p class="IndentText">Set maximum length of string literals (ISO
C99 minimum is 4095; ANSI C89 minimum is 509).</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>num-struct-fields</span></span><span class="Flag">
<span style=
'font-size:10.0pt'>&nbsp;<i>&lt;number&gt;</i></span></span></p>
<p class="IndentText">Set maximum number of fields in a
      <span class="CodeText"><span style=
      'font-size:10.0pt'>struct</span></span> or <span class=
      "CodeText"><span style='font-size:10.0pt'>union</span></span>
      (ISO C99 minimum is 1023; ANSI minimum is 127).</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>num-enum-members</span></span><span class=
"Flag"><span style=
'font-size:10.0pt'>&nbsp;<i>&lt;number&gt;</i></span></span></p>
<p class="IndentText">Set maximum number of members of an
<span class="CodeText"><span style=
'font-size:10.0pt'>enum</span></span> type (ISO C99 minimum is
1023; ANSI minimum is 127).</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>include-nest</span></span><span class=
"Flag"><span style=
'font-size:10.0pt'>&nbsp;<i>&lt;number&gt;</i></span></span></p>
<p class="IndentText">Set maximum number of nested
      <span class="CodeText"><span style=
      'font-size:10.0pt'>#include</span></span> files (ISO C99
      minimum is 63; ANSI minimum is 8).</p>
<p class="Heading10">Header Inclusion <a name=
"_Ref344793948"><span class="TextFontCXChar"><span style=
'font-size:11.0pt; font-weight:normal'>(Section</span></span></a>
<span class="TextFontCXChar"><span style=
'font-size:11.0pt; font-weight:normal'>14.3</span></span><span class="TextFontCXChar">
<span style=
'font-size:11.0pt; font-weight:normal'>)</span></span></p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>skip-ansi-headers</span></span></p>
<p class="IndentText">Prevent inclusion of header files in a system
directory with names that match standard ANSI headers. The
symbolic information in the standard library is used instead.&nbsp;
Flag in effect only if a library that includes the standard library is
used.&nbsp; The ANSI headers are: <span class=
"CodeText"><span style='font-size:10.0pt'>assert</span></span>,
<span class=
"CodeText"><span style='font-size:10.0pt'>ctype</span></span>,
<span class="CodeText"><span style=
'font-size:10.0pt'>errno</span></span>,
<span class="CodeText"><span style=
'font-size:10.0pt'>float</span></span>,
<span class=
"CodeText"><span style='font-size:10.0pt'>limits</span></span>,
<span class="CodeText"><span style=
'font-size:10.0pt'>locale</span></span>, <span class=
"CodeText"><span style='font-size:10.0pt'>math</span></span>,
<span class="CodeText"><span style=
'font-size:10.0pt'>setjmp</span></span>, <span class=
"CodeText"><span style='font-size:10.0pt'>signal</span></span>,
<span class="CodeText"><span style=
'font-size:10.0pt'>stdarg</span></span>,
<span class="CodeText"><span style=
'font-size:10.0pt'>stddef</span></span>, <span class=
"CodeText"><span style='font-size:10.0pt'>stdio</span></span>,
<span class="CodeText"><span style=
'font-size:10.0pt'>stdlib</span></span>,
<span class=
"CodeText"><span style='font-size:10.0pt'>strings</span></span>,
<span class=
"CodeText"><span style='font-size:10.0pt'>string</span></span>,
 <span class=
"CodeText"><span style='font-size:10.0pt'>time</span></span>,
and <span class="CodeText"><span style=
'font-size:10.0pt'>wchar</span></span>.
</p>

<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>skip-iso-headers</span></span></p>
<p class="IndentText">Prevent inclusion of header files in a system
directory with names that match standard ISO C99 headers. The
symbolic information in the standard library is used instead.&nbsp;
In effect only if a library that includes the standard library is
used.&nbsp; The ISO C99 headers are: <span class=
"CodeText"><span style='font-size:10.0pt'>assert</span></span>,
<span class="CodeText"><span style=
'font-size:10.0pt'>complex</span></span>, <span class=
"CodeText"><span style='font-size:10.0pt'>ctype</span></span>,
<span class="CodeText"><span style=
'font-size:10.0pt'>errno</span></span>, <span class=
"CodeText"><span style='font-size:10.0pt'>fenv</span></span>,
<span class="CodeText"><span style=
'font-size:10.0pt'>float</span></span>, <span class=
"CodeText"><span style='font-size:10.0pt'>inttypes</span></span>,
<span class="CodeText"><span style=
'font-size:10.0pt'>iso646</span></span>, <span class=
"CodeText"><span style='font-size:10.0pt'>limits</span></span>,
<span class="CodeText"><span style=
'font-size:10.0pt'>locale</span></span>, <span class=
"CodeText"><span style='font-size:10.0pt'>math</span></span>,
<span class="CodeText"><span style=
'font-size:10.0pt'>setjmp</span></span>, <span class=
"CodeText"><span style='font-size:10.0pt'>signal</span></span>,
<span class="CodeText"><span style=
'font-size:10.0pt'>stdarg</span></span>, <span class=
"CodeText"><span style='font-size:10.0pt'>stdbool</span></span>,
<span class="CodeText"><span style=
'font-size:10.0pt'>stddef</span></span>, <span class=
"CodeText"><span style='font-size:10.0pt'>stdio</span></span>,
<span class="CodeText"><span style=
'font-size:10.0pt'>stdlib</span></span>, <span class=
"CodeText"><span style='font-size:10.0pt'>string</span></span>,
<span class="CodeText"><span style=
'font-size:10.0pt'>tgmath</span></span>, <span class=
"CodeText"><span style='font-size:10.0pt'>time</span></span>,
<span class="CodeText"><span style=
'font-size:10.0pt'>wchar</span></span>, and <span class=
"CodeText"><span style='font-size:10.0pt'>wctype</span></span>.</p>


<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>skip-posix-headers</span></span></p>
<p class="IndentText">Prevent inclusion of header files in a system
directory with names that match standard POSIX headers. The
symbolic information in the standard library is used instead.&nbsp;
In effect only if a library that includes the POSIX library is
used.&nbsp; The skipped POSIX headers are: <span class=
"CodeText"><span style='font-size:10.0pt'>dirent</span></span>,
<span class="CodeText"><span style=
'font-size:10.0pt'>fcntl</span></span>, <span class=
"CodeText"><span style='font-size:10.0pt'>grp</span></span>,
<span class="CodeText"><span style=
'font-size:10.0pt'>pwd</span></span>, <span class=
"CodeText"><span style='font-size:10.0pt'>termios</span></span>,
<span class="CodeText"><span style=
'font-size:10.0pt'>sys/stat</span></span>, <span class=
"CodeText"><span style='font-size:10.0pt'>sys/times</span></span>,
<span class="CodeText"><span style=
'font-size:10.0pt'>sys/types</span></span>, <span class=
"CodeText"><span style=
'font-size:10.0pt'>sys/utsname</span></span>, <span class=
"CodeText"><span style='font-size:10.0pt'>sys/wait</span></span>,
<span class="CodeText"><span style=
'font-size:10.0pt'>unistd</span></span>, and <span class=
"CodeText"><span style='font-size:10.0pt'>utime</span></span>.</p>

<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>warn-posix-headers</span></span></p>
<p class="IndentText">Report use of a POSIX header when checking a
program with a non-POSIX library.</p>
<p class="IndentText">&nbsp;</p>

<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>warn-unix-headers</span></span></p>
<p class="IndentText">
Warn the user that the unix library may not be compatible with all platforms.
</p>

<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>skip-sys-headers</span></span></p>
<p class="IndentText">Prevent inclusion of all header files in
system directories.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>sys-dir-expand-macros</span></span></p>
<p class="IndentText">Expand macros in system directories
regardless of other settings, except for macros corresponding to
names defined in a load library.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>sys-dir-errors</span></span></p>
<p class="IndentText">Report errors in files in system directories
(set by <span class="Flag"><span style=
'font-size:10.0pt'>-sys-dirs</span></span>).&nbsp;&nbsp;</p>
<p class="IndentText"><span class="HeadingNote"><span style=
'font-size:10.5pt; font-style:normal'>&nbsp;</span></span></p>

<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>
warn-sys-files
</span></span></p>
<p class="IndentText">
Warn when a system file was listed as a command line file but Splint
is not set to report errors for system files.  This prevents accidentally missing warnings
in system files when Splint is run in a system directory.
</p>

<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>global:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>single-include</span></span></p>
<p class="IndentText">Optimize header inclusion to only include
each header file once.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>global:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>never-include</span></span></p>
<p class="IndentText">Use library information instead of including
header files.</p>

<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>global:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>case-insensitive-filenames</span></span></p>
<p class="IndentText">
File names are case insensitive (file.h and FILE.H are the same file). 
</p>



<p class="Heading10">Comments</p>
<p class="beforelist">These flags control how syntactic comments
are interpreted.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class="Flag"><span style=
'font-size:10.0pt'>@</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>comment-char</span></span> <span class=
"Flag"><i><span style=
'font-size:10.0pt'>&lt;char&gt;</span></i></span></p>
<p class="IndentText">Set the marker character for syntactic
comments.&nbsp; Comments beginning with <span class=
"CodeText"><span style=
'font-size:10.0pt'>/*</span></span><span class=
"Flag"><i><span style=
'font-size:10.0pt'>&lt;char&gt;</span></i></span> are interpreted
by Splint.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>noaccess</span></span></p>
<p class="IndentText">Ignore access comments.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>nocomments</span></span></p>
<p class="IndentText">Ignore all stylized comments.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>sup-counts</span></span></p>
<p class="IndentText">Actual number of errors does not match number
in <span class="Annot"><span style=
'font-size:10.0pt'>/*@i</span></span><span class=
"Annot"><span style=
'font-size:10.0pt'>&lt;n&gt;@*/</span></span></p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>lint-comments</span></span></p>
<p class="IndentText">Interpret traditional lint comments
(<span class="CodeText"><span style=
'font-size:10.0pt'>/*FALLTHROUGH*/</span></span>,
      <span class="CodeText"><span style=
      'font-size:10.0pt'>/*NOTREACHED*/</span></span>, <span class=
      "CodeText"><span style=
      'font-size:10.0pt'>/*PRINTFLIKE*/</span></span>).</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>warn-lint-comments</span></span></p>
<p class="IndentText">Print a warning and suggest an alternative
when a traditional lint comment is used. &nbsp;&nbsp;</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P: +</span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>unrecog-comments</span></span></p>
<p class="IndentText">Stylized comment is unrecognized.</p>

<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P: +</span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>unrecog-flag-comments</span></span></p>
<p class="IndentText">
Semantic comment attempts to set a flag that is not recognized.
</p>


<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P: +</span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>annotationerror
</span></span></p>
<p class="IndentText">
A declaration uses an invalid annotation.
</p>


<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P: +</span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>commenterror
</span></span></p>
<p class="IndentText">
A syntactic comment is used inconsistently.
</p>

<p class="Heading10">Parsing</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>continue-comment</span></span></p>
<p class="IndentText">A line continuation marker
      (<span class="CodeText"><span style=
      'font-size:10.0pt'>\</span></span>) appears inside a comment
      on the same line as the comment close. Preprocessors should
      handle this correctly, but it causes problems for some
      preprocessors.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>nest-comment</span></span></p>
<p class="IndentText">A comment open sequence (<span class=
"CodeText"><span style='font-size:10.0pt'>/*</span></span>) appears
inside a comment.&nbsp; This usually indicates that an earlier
comment was not closed.</p>

<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>slashslashcomment</span></span></p>
<p class="IndentText">A
<span class=
"CodeText"><span style='font-size:10.0pt'>//</span></span>
comment is used.&nbsp ISO C99 allows
<span class=
"CodeText"><span style='font-size:10.0pt'>//</span></span>
comments, but earlier standards did not.
</p>

<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P: +</span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>duplicate-quals</span></span></p>
<p class="IndentText">Report duplicate type qualifiers (e.g.,
<span class="CodeText"><span style='font-size:10.0pt'>unsigned
unsigned</span></span>).</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>gnu-extensions</span></span></p>
<p class="IndentText">Support some GNU and Microsoft language
extensions.</p>

<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>syntax</span></span></p>
<p class="IndentText">Parse error.</p>

<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>try-to-recover</span></span></p>
<p class="IndentText">Try to recover from a parse error.&nbsp; If
<span class="Flag"><span style=
'font-size:10.0pt'>trytorecover</span></span> is not set, Splint
will abort checking after a parse error is detected.&nbsp; If it is
set, Splint will attempt to recover, but Splint does performs only
minimal error recovery.&nbsp; It is likely that trying to recover
after a parse error will lead to an internal assertion failing.</p>


<p class="Heading10">Warn use</p>
	
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-+++
</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>
bufferoverflow
</span></span></p>
<p class="IndentText">
Use of function that may lead to buffer overflow.
</p>

<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>++++
</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>
bufferoverflowhigh
</span></span></p>
<p class="IndentText">
Use of function that may lead to buffer overflow.
</p>



<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>--++
</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>
implementationoptional
</span></span></p>
<p class="IndentText">
Use of a declarator that is implementation optional, not required by ISO99.
</p>


<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>--++
</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>
multithreaded
</span></span></p>
<p class="IndentText">
Non-reentrant function should not be used in multithreaded code.
</p>

<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>--++
</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>
portability
</span></span></p>
<p class="IndentText">
Use of function that may have implementation-dependent behavior.
</p>


<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>--++
</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>
superuser
</span></span></p>
<p class="IndentText">
Call to function restricted to superusers.
</p>


<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>---+
</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>
toctou
</span></span></p>
<p class="IndentText">
Possible time of check, time of use vulnerability.
</p>



<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>----
</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>
unixstandard
</span></span></p>
<p class="IndentText">
Use of function that need not be provided by UNIX implementations
</p>

<p class="Heading10">ITS4 compatibility flags</p>


<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-
</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>
its4mostrisky
</span></span></p>
<p class="IndentText">
Security vulnerability classified as most risky in its4 database.
</p>

<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-
</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>
its4veryrisky
</span></span></p>
<p class="IndentText">
Security vulnerability classified as very risky in its4 database.
</p>


<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-
</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>
its4risky
</span></span></p>
<p class="IndentText">
Security vulnerability classified as risky in its4 database.
</p>


<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-
</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>
its4moderate
</span></span></p>
<p class="IndentText">
Security vulnerability classified as moderate risk in its4 database.
</p>



<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-
</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>
its4low
</span></span></p>
<p class="IndentText">
Security vulnerability classified as risky in its4 database.
</p>

<p class="Heading10">Debug flags</p>

<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>3
</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>
bugslimit
</span></span></p>
<p class="IndentText">
Set maximum number of bugs detected before giving up.
</p>


<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>----
</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>
debugfcnconstraint
</span></span></p>
<p class="IndentText">
Perform buffer overflow checking even if the errors would be suppressed.
</p>



<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-
</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>
grammar
</span></span></p>
<p class="IndentText">
Debug parsing.  Prints bison generated debuging information.
</p>



<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-
</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>
keep
</span></span></p>
<p class="IndentText">
Do not delete temporary files.
</p>


<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-
</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>
nopp
</span></span></p>
<p class="IndentText">
Do not pre-process input files. 
</p>


<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-
</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>
showsourceloc
</span></span></p>
<p class="IndentText">
Display the source code location where a warning is produced. 
</p>




<p class="MsoHeading7" style='margin-left:0in;text-indent:0in'>
<a name="_Toc534975062"></a><a name="_Ref348845752">Appendix
C<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
<a id="annotations" name="annotations">
Annotations</a></a></p>
<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
<a name="_Toc534975063"></a><a name="_Ref348010146">Suppressin</a>g
Warnings</p>
<p class="beforelist">Several annotations are provided for
suppressing messages.&nbsp; In general, it is usually better to use
specific flags to suppress a particular error permanently, but the
general error suppression flags may be more convenient for quickly
suppressing messages for code that will be corrected or documented
later.</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>ignore</span></span></p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>end</span></span></p>
<p class="IndentText">No errors will be reported in code regions
between <span class="Annot"><span style=
'font-size:10.0pt'>/*@ignore@*/</span></span> and
      <span class="Annot"><span style=
      'font-size:10.0pt'>/*@end@*/</span></span>.&nbsp; These
      comments can be used to easily suppress an unlimited number
      of messages, but are dangerous since if real errors are
      introduced in the <span class="Flag"><span style=
      'font-size:10.0pt'>ignore</span></span>&#8230;<span class=
      "Flag"><span style='font-size:10.0pt'>end</span></span>
      region they will not be reported. The <span class=
      "Annot"><span style='font-size:10.0pt'>ignore</span></span>
      and <span class="Annot"><span style=
      'font-size:10.0pt'>end</span></span> comments must be matched
      &#8212; a warning is printed if the file ends in an ignore
      region or if <span class="Flag"><span style=
      'font-size:10.0pt'>ignore</span></span> is used inside ignore
      region.</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>i</span></span></p>
<p class="IndentText">No errors will be reported from an
<span class="Annot"><span style=
'font-size:10.0pt'>/*@i@*/</span></span> comment to the end of the
line.</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>i</span></span><span class=
      "Flag"><span style='font-size:10.0pt'><i>&lt;n&gt;</i></span></span></p>
<p class="IndentText">No errors will be reported from an
<span class="Annot"><span style=
'font-size:10.0pt'>/*@i<i>&lt;n&gt;</i>@*/</span></span> (e.g.,
<span class="Annot"><span style=
'font-size:10.0pt'>/*@i3@*/</span></span>) comment to the end of
the line.&nbsp; If there are not exactly <i>n</i> errors suppressed
from the comment point to the end of the line, Splint will report
an error.&nbsp; This is more robust than <span class=
"Annot"><span style='font-size:10.0pt'>i</span></span> or
<span class="Annot"><span style=
'font-size:10.0pt'>ignore</span></span> since a message is
generated if the expected number errors is not present.&nbsp; Since
errors are not necessarily detected until after this file is
processed (for example, and unused variable error), suppress count
errors are reported after all files have been processed. &nbsp;The
<span class="Flag"><span style=
'font-size: 10.0pt'>&#8209;supcounts</span></span> flag may be used
to suppress these errors.&nbsp; This is useful when a system if
being rechecked with different flag settings.</p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>t</span></span></p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>t<i>&lt;n&gt;</i></span></span></p>
<p class="IndentText">Like <span class="Annot"><span style=
'font-size:10.0pt'>i</span></span> and <span class=
"Annot"><span style=
'font-size:10.0pt'>i<i>&lt;n&gt;</i></span></span>, except
controlled by <span class="Flag"><span style=
'font-size:10.0pt'>+tmpcomments</span></span> flag.&nbsp; These can
be used to temporarily suppress certain errors.&nbsp; Then,
<span class="Flag"><span style=
'font-size:10.0pt'>-tmpcomments</span></span> can be set to find
them again.</p>
<p class="MsoHeading8" style='margin-left:0in;text-indent:0in'>
<a name="_Toc534975064">Syntactic Annotations</a></p>
<p class="TextFontCX">The grammar below is the C syntax from
[K&amp;R,A13] modified to show the syntax of syntactic
comments.&nbsp; Only productions effected by Splint annotations are
shown.&nbsp; In the annotations, the <span class=
"Annot"><span style='font-size:10.0pt'>@</span></span> represents
the comment marker char, set by <span class=
      "Flag"><span style='font-size:10.0pt'>-commentchar</span></span>&nbsp;(default
      is <span class="Annot"><span style=
      'font-size:10.0pt'>@</span></span>).</p>
<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
<a name="_Toc534975065">Functions</a></p>
<p class="TextFontCX"><i>direct-declarator</i> <span style=
'font-family:Symbol'>&#222;</span></p>
<p class="TextFontCX" style='text-indent:.5in'><i>&nbsp;&nbsp;
direct-declarator</i> <span class="Annot"><span style=
'font-size:10.0pt'>(</span></span><i>parameter-type-list<sub>opt</sub></i>
<span class="Annot"><span style='font-size: 10.0pt'>)</span></span>
<i>stateClause*<sub>opt</sub> globals<sub>opt</sub>
modifies<sub>opt</sub></i></p>
<p class="TextFontCX" style='text-indent:.5in'><i>|&nbsp;
direct-declarator</i> <span class="Annot"><span style=
'font-size:10.0pt'>(</span></span><i>identifier-list<sub>opt</sub></i>
<span class="Annot"><span style='font-size: 10.0pt'>)</span></span>
<i>stateClause*<sub>opt</sub> globals<sub>opt</sub>
modifies<sub>opt</sub></i></p>
<p class="TextFontCX"><i>&nbsp;</i></p>
<p class="TextFontCX"><i>stateClause</i> <span style=
'font-family:Symbol'>&#222;</span> <span class=
      "Annot"><span style='font-size:10.0pt'>/*@</span></span> (
      <span class="Annot"><span style=
      'font-size:10.0pt'>uses</span></span> <i>|</i> <span class=
      "Annot"><span style='font-size:10.0pt'>sets</span></span>
      <i>|</i> <span class="Annot"><span style=
      'font-size:10.0pt'>defines</span></span> <i>|</i>
      <span class="Annot"><span style=
      'font-size:10.0pt'>allocates</span></span> <i>|</i>
      <span class="Annot"><span style=
      'font-size:10.0pt'>releases</span></span>)
      <i>reference,<sup>+</sup></i> <span class=
      "Annot"><span style='font-size:10.0pt'>;</span></span><i><sub>opt</sub></i>
      <span class="Annot"><span style=
      'font-size:10.0pt'>@*/</span></span></p>
<p class="TextFontCX" align="right" style='text-align: right'>
<i>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
&nbsp;&nbsp; |</i> <span class="Annot"><span style=
'font-size:10.0pt'>/*@</span></span> ( <span class=
"Annot"><span style='font-size:10.0pt'>ensures</span></span> |
<span class="Annot"><span style=
'font-size:10.0pt'>requires</span></span> ) <i>stateTag</i>
<i>reference,<sup>+</sup></i> <span class=
      "Annot"><span style='font-size:10.0pt'>;</span></span><i><sub>opt</sub></i>
      <span class="Annot"><span style=
      'font-size:10.0pt'>@*/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
      (Section 7.4)</p>
<p class="TextFontCX"><i>&nbsp;</i></p>
<p class="TextFontCX"><i>stateTag</i> <span style=
'font-family:Symbol'>&#222;</span> <span class=
      "Annot"><span style='font-size: 10.0pt'>only</span></span>
      <i>|</i> <span class="Annot"><span style=
      'font-size: 10.0pt'>shared</span></span> <i>|</i>
      <span class="Annot"><span style=
      'font-size: 10.0pt'>owned</span></span> <i>|</i> <span class=
      "Annot"><span style=
      'font-size: 10.0pt'>dependent</span></span> <i>|</i>
      <span class="Annot"><span style=
      'font-size:10.0pt'>observer</span></span> <i>|</i>
      <span class="Annot"><span style=
      'font-size:10.0pt'>exposed</span></span> <i>|</i>
      <span class="Annot"><span style=
      'font-size:10.0pt'>isnull</span></span> <i>|</i> <span class=
      "Annot"><span style=
      'font-size:10.0pt'>notnull</span></span></p>
<p class="TextFontCX" align="right" style=
'text-align: right;text-indent:.5in'><i>&nbsp;&nbsp;&nbsp;&nbsp; |
identifier&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</i>
(Annotation defined by metastate definition, Section 10)</p>
<p class="TextFontCX" style='text-indent:.5in'>
<i>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</i></p>
<p class="TextFontCX"><i>globals</i> <span style=
'font-family:Symbol'>&#222;</span> <span class=
      "Annot"><span style='font-size: 10.0pt'>/*@globals</span></span>
      <i>globitem,<sup>+</sup></i> <span class="Annot"><span style=
      'font-size:10.0pt'>;</span></span><i><sub>opt</sub></i>
      <span class="Annot"><span style=
      'font-size:10.0pt'>@*/</span></span> <i>|</i> <span class=
      "Annot"><span style=
      'font-size:10.0pt'>/*@globals</span></span><i>declaration-list<sub>opt&nbsp;</sub></i>
      <span class="Annot"><span style=
      'font-size: 10.0pt'>;</span></span><i><sub>opt</sub></i><span class="Annot">
<span style='font-size:10.0pt'>@*/</span></span><span class=
"Keyword"><span style='font-size:10.0pt'>&nbsp;</span></span></p>
<p class="TextFontCX"><i>globitem</i> <span style=
'font-family:Symbol'>&#222;</span> [ ( <span class=
"Annot"><span style='font-size:10.0pt'>undef</span></span> |
<span class="Annot"><span style=
'font-size:10.0pt'>killed</span></span> )* ] <span class=
"Keyword"><i><sub><span style=
'font-size:10.5pt;font-family:"Times New Roman"'>&nbsp;</span></sub></i></span><i>
&nbsp;identifier |&nbsp;</i> <span class="Annot"><span style=
'font-size:10.0pt'>internalState</span></span><i>|&nbsp;</i>
<span class="Annot"><span style=
'font-size:10.0pt'>fileSystem</span></span></p>
<p class="TextFontCX"><i>&nbsp;</i></p>
<p class="TextFontCX"><i>modifies</i> <span style=
'font-family:Symbol'>&#222;</span> <span class=
      "Annot"><span style='font-size:10.0pt'>/*@modifies</span></span>
      (<span class="Annot"><span style=
      'font-size:10.0pt'>nothing</span></span> <i>|</i>
      (<i>expression</i> | <span class="Annot"><span style=
      'font-size:10.0pt'>internalState</span></span> | <span class=
      "Annot"><span style=
      'font-size:10.0pt'>fileSystem</span></span>)<i><sup>+</sup></i><span class="Annot">
<span style=
'font-size:10.0pt'>;</span></span><i><sub>opt</sub></i>)
<span class="Annot"><span style=
'font-size:10.0pt'>@*/</span></span><span class=
"Keyword"><span style=
'font-size:10.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span></p>
<p class="TextFontCX" align="right" style='text-align: right'>
<span class="Keyword"><span style=
'font-size:10.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span></span> <i>|</i>
<span class="Annot"><span style=
'font-size:10.0pt'>/*@*/</span></span><span class=
"Keyword"><span style='font-size:10.0pt'>&nbsp;&nbsp;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>(Abbreviation for
no globals and modifies nothing.)</p>
<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
<a name="_Toc534975066">Iterators</a> <span class=
"TextFontCXChar"><span style=
'font-size:11.0pt; font-weight:normal'>(Section
11.4)</span></span></p>
<p class="beforelist">The globals and modifies clauses for an
iterator are the same as those for a function, except they are not
enclosed by a comment, since the iterator is already a comment.</p>
<p class="TextFontCX"><i>direct-declarator</i></p>
<p class="TextFontCX" style='text-indent:.5in'><span style=
'font-family:Symbol'>&#222;</span> <span class=
      "Annot"><span style='font-size: 10.0pt'>/*@iter</span></span>
      <i>identifier</i> <span class="Annot"><span style=
      'font-size:10.0pt'>(</span></span><i>parameter-type-list<sub>opt</sub></i>
      <span class="Annot"><span style=
      'font-size:10.0pt'>)</span></span>
      <i>iterGlobals<sub>opt</sub> iterModifies<sub>opt</sub></i>
      <span class="Annot"><span style=
      'font-size:10.0pt'>@*/</span></span></p>
<p class="TextFontCX"><i>&nbsp;</i></p>
<p class="TextFontCX"><i>iter-globals</i> <span style=
'font-family:Symbol'>&#222;</span> <span class=
      "Annot"><span style='font-size: 10.0pt'>globals</span></span>
      <i>declaration-list<sub>opt</sub></i> <span class=
      "Annot"><span style=
      'font-size:10.0pt'>;</span></span><i><sub>opt</sub></i></p>
<p class="TextFontCX"><i>iter-modifies</i> <span style=
'font-family:Symbol'>&#222;</span> <span class=
      "Annot"><span style='font-size: 10.0pt'>modifies</span></span><i>&nbsp;
      moditem,+</i><span class="Annot"><span style=
      'font-size:10.0pt'>;</span></span><i><sub>opt</sub></i><i>|</i>
      <span class="Annot"><span style=
      'font-size:10.0pt'>&nbsp;modifies
      nothing</span></span><span class="Annot"><span style=
      'font-size:10.0pt'>;</span></span><i><sub>opt</sub></i></p>
<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
<a name="_Toc534975067">Constants</a> <span class=
"TextFontCXChar"><span style=
'font-size:11.0pt; font-weight:normal'>(Section
11.1)</span></span></p>
<p class="TextFontCX"><i>external-declaration</i>
      <span style='font-family:Symbol'>&#222;</span> <span class=
      "Annot"><span style=
      'font-size: 10.0pt'>/*@constant</span></span> <i>declaration
      <sub>&nbsp;</sub></i><span class="Annot"><span style=
      'font-size:10.0pt'>;</span></span><i><sub>opt</sub></i><span class="Annot">
<span style='font-size:10.0pt'>@*/</span></span></p>
<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
<a name="_Toc534975068"></a><a name="_Ref344807420">Alternate
Types</a> <span class="TextFontCXChar"><span style=
'font-size:11.0pt; font-weight:normal'>(Section
4.4)</span></span></p>
<p class="beforelist">Alternate types may be used in the type
specification of parameters and return values.</p>
<p class="TextFontCX" align="left" style='text-align: left'>
<i>extended-type</i><span style='font-family:Symbol'>&#222;</span>
<i>type-specifier alt-type <sub>opt</sub></i></p>
<p class="TextFontCX"><i>alt-type</i> <span style=
'font-family:Symbol'>&#222;</span> <span class=
      "Annot"><span style='font-size: 10.0pt'>/*@alt</span></span>
      <i>basic-type,<sup>+</sup></i> <span class=
      "Annot"><span style='font-size:10.0pt'>@*/</span></span></p>
<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
<a name="_Toc534975069">Declarator Annotations</a></p>
<p class="TextFontCX">General annotations appear after
<i>storage-class-specifier</i>s and before
<i>type-specifier</i>s.&nbsp; Multiple annotations may be used in
any order.&nbsp; Here, annotations are without the surrounding
comment.&nbsp; In a declaration, the annotation would be surrounded
by <span class="Annot"><span style=
'font-size:10.0pt'>/*@</span></span> and <span class=
"Annot"><span style='font-size:10.0pt'>@*/</span></span>.&nbsp; In
a globals or modifies clause or iterator or constant declaration,
no surrounding comments would be used since they are within a
comment.</p>
<p class="Heading10" align="left" style='text-align:left'>Type
Definitions <span class="TextFontCXChar"><span style=
'font-size:11.0pt; font-weight:normal'>(Section
4.3)</span></span></p>
<p class="beforelist">A type definition may use any either
<span class="Annot"><span style=
'font-size:10.0pt'>abstract</span></span> or <span class=
"Annot"><span style='font-size:10.0pt'>concrete</span></span>,
either <span class="Annot"><span style=
'font-size:10.0pt'>mutable</span></span>&nbsp;or <span class=
"Annot"><span style='font-size:10.0pt'>immutable</span></span>, and
<span class="Annot"><span style=
'font-size:10.0pt'>refcounted</span></span>.&nbsp; Only a pointer
to a <span class="Annot"><span style=
'font-size:10.0pt'>struct</span></span> may be declared with
<span class="Annot"><span style=
'font-size:10.0pt'>refcounted</span></span>.&nbsp; Mutability
annotations may not be used with concrete types since concrete
types inherit their mutability from the actual type.</p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>abstract</span></span></p>
<p class="MsoNormal" style='margin-left:13.5pt'>Type is abstraction
(representation is hidden from clients.)</p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>concrete</span></span></p>
<p class="MsoNormal" style='margin-left:13.5pt'>Type is concrete
(representation is visible to clients.)</p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>immutable</span></span></p>
<p class="MsoNormal" style='margin-left:13.5pt'>Instances of the
type cannot change value.</p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>mutable</span></span></p>
<p class="MsoNormal" style='margin-left:13.5pt'>Instances of the
type can change value.</p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>refcounted</span></span></p>
<p class="IndentText">Reference counted (Section 5.4).</p>
<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
<a name="_Toc534975070">Type Access</a></p>
<p class="TextFontCX">Control comments may also be used to override
type access settings.</p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>&nbsp;</span></span></p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>/*@access
<i>&lt;type&gt;</i>,<sup>+</sup>@*/</span></span><span class=
"Annot"><span style='font-size:10.0pt'>&nbsp;</span></span></p>
<p class="IndentText">Allows the following code to access the
representation of <span class="Annot"><i><span style=
'font-size:10.0pt'>&lt;type&gt;</span></i></span>.&nbsp; Type
access applies from the point of the comment to the end of the file
or the next access control comment for this type.</p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>/*@noaccess</span></span> <span class=
"Annot"><span style=
'font-size:10.0pt'><i>&lt;type&gt;</i>,<sup>+</sup>@*/</span></span></p>
<p class="IndentText">Restricts access to the representation of
<span class="Annot"><i><span style=
'font-size:10.0pt'>&lt;type&gt;</span></i></span>.&nbsp; The type
in a <span class="Annot"><span style=
'font-size:10.0pt'>noaccess</span></span> comment must have been
declared as an abstract type.&nbsp;</p>
<p class="Heading10">Global Variables&nbsp; <span class=
"HeadingNote"><span style=
'font-size:10.5pt;font-weight:normal;font-style:normal'>(Section</span></span>
<span class="HeadingNote"><span style=
'font-size:10.5pt;font-weight:normal;font-style: normal'>7.2</span></span><span class="HeadingNote">
<span style=
'font-size:10.5pt;font-weight:normal;font-style: normal'>)</span></span></p>
<p class="beforelist">One check annotation may be used on a global
or file-static variable declaration.</p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>unchecked</span></span></p>
<p class="IndentText"><span class="Annot"><span style=
'font-size:10.0pt;font-family: "Times New Roman"'>Weakest checking
for global use.</span></span></p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>checkmod</span></span></p>
<p class="IndentText"><span class="Annot"><span style=
'font-size:10.0pt;font-family: "Times New Roman"'>Check
modification by not use of global.</span></span></p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>checked</span></span></p>
<p class="IndentText"><span class="Annot"><span style=
'font-size:10.0pt;font-family: "Times New Roman"'>Check use and
modification of global.</span></span></p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>checkedstrict</span></span></p>
<p class="IndentText"><span class="Annot"><span style=
'font-size:10.0pt;font-family: "Times New Roman"'>Check use of
global, even in functions with no global list.</span></span></p>
<p class="Heading10">Memory Management&nbsp; <span class=
"HeadingNote"><span style=
'font-size:10.5pt;font-weight:normal;font-style:normal'>(Section</span></span>
<span class="HeadingNote"><span style=
'font-size:10.5pt;font-weight:normal;font-style: normal'>3</span></span><span class="HeadingNote">
<span style=
'font-size:10.5pt; font-weight:normal;font-style:normal'>)</span></span></p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>dependent</span></span></p>
<p class="IndentText"><span class="Annot"><span style=
'font-size:10.0pt;font-family: "Times New Roman"'>A reference to
externally-owned storage.&nbsp; (Section</span></span>
      <span class="Annot"><span style=
      'font-size:10.0pt;font-family:"Times New Roman"'>5.2.2</span></span><span class="Annot">
<span style=
'font-size:10.0pt;font-family:"Times New Roman"'>)</span></span></p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>keep</span></span></p>
<p class="IndentText"><span class="Annot"><span style=
'font-size:10.0pt;font-family: "Times New Roman"'>A parameter that
is kept by the called function.&nbsp; The caller may use the
storage after the call, but the called function is responsible for
making sure it is deallocated.&nbsp; (Section</span></span>
<span class="Annot"><span style=
'font-size:10.0pt;font-family:"Times New Roman"'>5.2.4</span></span><span class="Annot">
<span style=
'font-size:10.0pt;font-family:"Times New Roman"'>)</span></span></p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>killref</span></span></p>
<p class="IndentText">A <span class="Annot"><span style=
'font-size:10.0pt'>refcounted</span></span> parameter.&nbsp; This
reference is killed by the call. (Section 5.4)</p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>only</span></span></p>
<p class="IndentText"><span class="Annot"><span style=
'font-size:10.0pt;font-family: "Times New Roman"'>An unshared
reference.&nbsp; Associated memory must be released before
reference is lost.&nbsp;
      (Section&nbsp;</span></span><span class="Annot"><span style=
      'font-size:10.0pt;font-family:"Times New Roman"'>5.2</span></span><span class="Annot">
<span style=
'font-size:10.0pt;font-family:"Times New Roman"'>)</span></span></p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>owned</span></span></p>
<p class="IndentText"><span class="Annot"><span style=
'font-size:10.0pt;font-family: "Times New Roman"'>Storage may be
shared by dependent references, but associated memory must be
released before this reference is lost.&nbsp;
(Section</span></span> <span class="Annot"><span style=
'font-size:10.0pt;font-family:"Times New Roman"'>5.2.2</span></span><span class="Annot">
<span style=
'font-size:10.0pt;font-family:"Times New Roman"'>)</span></span></p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>shared</span></span></p>
<p class="IndentText"><span class="Annot"><span style=
'font-size:10.0pt;font-family: "Times New Roman"'>Shared reference
that is never deallocated.&nbsp; (Section</span></span>
      <span class="Annot"><span style=
      'font-size:10.0pt;font-family:"Times New Roman"'>5.2.5</span></span><span class="Annot">
<span style=
'font-size:10.0pt;font-family:"Times New Roman"'>)</span></span></p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>temp</span></span></p>
<p class="IndentText">A temporary parameter.&nbsp; May not be
released, and new aliases to it may not be created.&nbsp; (Section
5.2.2)</p>
<p class="Heading10">Aliasing&nbsp; <span class=
"HeadingNote"><span style=
'font-size: 10.5pt;font-weight:normal;font-style:normal'>(Section</span></span>
<span class="HeadingNote"><span style=
'font-size:10.5pt;font-weight:normal;font-style: normal'>6</span></span><span class="HeadingNote">
<span style=
'font-size:10.5pt; font-weight:normal;font-style:normal'>)</span></span></p>
<p class="beforelist">Both alias annotations may be used on a
parameter declaration.</p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>unique</span></span></p>
<p class="IndentText"><span class="Annot"><span style=
'font-size:10.0pt;font-family: "Times New Roman"'>Parameter that
may not be aliased by any other reference visible to the function.
(Section&nbsp;</span></span><span class="Annot"><span style=
'font-size:10.0pt;font-family:"Times New Roman"'>6.1.1</span></span><span class="Annot">
<span style=
'font-size:10.0pt;font-family:"Times New Roman"'>)</span></span></p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>returned</span></span></p>
<p class="IndentText"><span class="Annot"><span style=
'font-size:10.0pt;font-family: "Times New Roman"'>Parameter that
may be aliased by the return value.&nbsp; (Section</span></span>
<span class="Annot"><span style=
'font-size:10.0pt;font-family:"Times New Roman"'>6.1.2</span></span><span class="Annot">
<span style=
'font-size:10.0pt;font-family:"Times New Roman"'>)</span></span></p>
<p class="Heading10">Exposure&nbsp; <span class=
"HeadingNote"><span style=
'font-size: 10.5pt;font-weight:normal;font-style:normal'>(Section</span></span>
<span class="HeadingNote"><span style=
'font-size:10.5pt;font-weight:normal;font-style: normal'>6.2</span></span><span class="HeadingNote">
<span style=
'font-size:10.5pt; font-weight:normal;font-style:normal'>)</span></span></p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>observer</span></span></p>
<p class="IndentText"><span class="Annot"><span style=
'font-size:10.0pt;font-family: "Times New Roman"'>Reference that
cannot be modified.&nbsp; (Section</span></span> <span class=
"Annot"><span style=
'font-size:10.0pt;font-family:"Times New Roman"'>6.2.1</span></span><span class="Annot">
<span style=
'font-size:10.0pt;font-family:"Times New Roman"'>)</span></span></p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>exposed</span></span></p>
<p class="IndentText"><span class="Annot"><span style=
'font-size:10.0pt;font-family: "Times New Roman"'>Exposed reference
to storage in another object. (Section</span></span>
      <span class="Annot"><span style=
      'font-size:10.0pt;font-family:"Times New Roman"'>6.2</span></span><span class="Annot">
<span style=
'font-size:10.0pt;font-family:"Times New Roman"'>)</span></span></p>
<p class="Heading10">Definition State <span class=
"HeadingNote"><span style=
'font-size:10.5pt;font-weight:normal;font-style:normal'>(Section</span></span>
<span class="HeadingNote"><span style=
'font-size:10.5pt;font-weight:normal;font-style: normal'>3</span></span><span class="HeadingNote">
<span style=
'font-size:10.5pt;font-weight:normal;font-style: normal'>)</span></span></p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>out</span></span></p>
<p class="IndentText"><span class="Annot"><span style=
'font-size:10.0pt;font-family: "Times New Roman"'>Storage reachable
from reference need not be defined.</span></span></p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>in</span></span></p>
<p class="IndentText"><span class="Annot"><span style=
'font-size:10.0pt;font-family: "Times New Roman"'>All storage
reachable from reference must be defined.</span></span></p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>partial</span></span></p>
<p class="IndentText"><span class="Annot"><span style=
'font-size:10.0pt;font-family: "Times New Roman"'>Partially
defined.&nbsp; A structure may have undefined fields.&nbsp; No
errors reported when fields are used.</span></span></p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>reldef</span></span></p>
<p class="IndentText"><span class="Annot"><span style=
'font-size:10.0pt;font-family: "Times New Roman"'>Relax definition
checking.&nbsp; No errors when reference is not defined, or when it
is used.</span></span></p>
<p class="Heading10">Global State <span class=
"TextFontCXChar"><span style=
'font-size:11.0pt; font-weight:normal'>(Section
7.2.2)</span></span></p>
<p class="TextFontCX">These annotations may only be used in globals
lists.&nbsp; Both annotations may be used for the same variable, to
mean the variable is undefined before and after the call.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>undef</span></span></p>
<p class="IndentText"><span class="Annot"><span style=
'font-size:10.0pt;font-family: "Times New Roman"'>Variable is
undefined before the call.</span></span></p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>killed</span></span></p>
<p class="IndentText"><span class="Annot"><span style=
'font-size:10.0pt;font-family: "Times New Roman"'>Variable is
undefined after the call.</span></span></p>
<p class="Heading10">Null State <span class=
"HeadingNote"><span style=
'font-size: 10.5pt;font-weight:normal;font-style:normal'>(Section</span></span>
<span class="HeadingNote"><span style=
'font-size:10.5pt;font-weight:normal;font-style: normal'>2</span></span><span class="HeadingNote">
<span style=
'font-size:10.5pt;font-weight:normal;font-style: normal'>)</span></span></p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>null</span></span></p>
<p class="IndentText"><span class="Annot"><span style=
'font-size:10.0pt;font-family: "Times New Roman"'>Possibly null
pointer.</span></span></p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>notnull</span></span><span class=
"Annot"><span style=
'font-size:10.0pt'>&nbsp;&nbsp;</span></span></p>
<p class="IndentText"><span class="Annot"><span style=
'font-size:10.0pt;font-family: "Times New Roman"'>Non-null
pointer.</span></span></p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>relnull</span></span></p>
<p class="IndentText"><span class="Annot"><span style=
'font-size:10.0pt;font-family: "Times New Roman"'>Relax null
checking.&nbsp; No errors when</span></span> <span class=
"CodeText"><span style=
'font-size:10.0pt'>NULL</span></span><span class=
"Annot"><span style=
'font-size:10.0pt;font-family:"Times New Roman"'>is assigned to it,
or when it is used as a non-null pointer.</span></span></p>
<p class="Heading10">Null Predicates <span class=
"HeadingNote"><span style=
'font-size:10.5pt;font-weight:normal;font-style:normal'>(Section</span></span>
<span class="HeadingNote"><span style=
'font-size:10.5pt;font-weight:normal;font-style: normal'>2.1.1</span></span><span class="HeadingNote">
<span style=
'font-size:10.5pt; font-weight:normal;font-style:normal'>)</span></span></p>
<p class="beforelist">A null predicate annotation may be used of
the return value of a function returning a Boolean type, taking a
possibly-null pointer for its first argument.</p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>nullwhentrue</span></span></p>
<p class="IndentText"><span class="Annot"><span style=
'font-size:10.0pt;font-family: "Times New Roman"'>If result is
true, first parameter is</span></span> <span class=
"CodeText"><span style=
'font-size:10.0pt'>NULL</span></span><span class=
"Annot"><span style=
'font-size:10.0pt;font-family:"Times New Roman"'>.</span></span></p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>falsewhennull</span></span></p>
<p class="IndentText"><span class="Annot"><span style=
'font-size:10.0pt;font-family: "Times New Roman"'>If result
is</span></span> <span class="CodeText"><span style=
'font-size:10.0pt'>TRUE</span></span><span class=
"Annot"><span style=
'font-size:10.0pt;font-family:"Times New Roman"'>, first parameter
is not</span></span> <span class="CodeText"><span style=
'font-size:10.0pt'>NULL</span></span><span class=
"Annot"><span style=
'font-size:10.0pt;font-family:"Times New Roman"'>.</span></span></p>
<p class="Heading10">Execution&nbsp; <span class=
"HeadingNote"><span style=
'font-size: 10.5pt;font-weight:normal;font-style:normal'>(Section</span></span>
<span class="HeadingNote"><span style=
'font-size:10.5pt;font-weight:normal;font-style: normal'>8.1</span></span><span class="HeadingNote">
<span style=
'font-size:10.5pt; font-weight:normal;font-style:normal'>)</span></span></p>
<p class="beforelist">The <span class="Annot"><span style=
'font-size:10.0pt'>noreturn</span></span>, <span class=
"Annot"><span style='font-size:10.0pt'>maynotreturn</span></span>
and <span class="Annot"><span style=
'font-size:10.0pt'>alwaysreturn</span></span> annotations may be
used on any function.&nbsp; The <span class=
      "Annot"><span style='font-size:10.0pt'>noreturnwhentrue</span></span>
      and <span class="Annot"><span style=
      'font-size:10.0pt'>noreturnwhenfalse</span></span>
      annotations may only be used on functions whose first
      argument is a Boolean.&nbsp;&nbsp;</p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>noreturn</span></span><span class=
"Annot"><span style=
'font-size:10.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span></p>
<p class="IndentText"><span class="Annot"><span style=
'font-size:10.0pt;font-family: "Times New Roman"'>Function never
returns.</span></span></p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>maynotreturn</span></span></p>
<p class="IndentText"><span class="Annot"><span style=
'font-size:10.0pt;font-family: "Times New Roman"'>Function may or
may not return.</span></span></p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>noreturnwhentrue</span></span></p>
<p class="IndentText"><span class="Annot"><span style=
'font-size:10.0pt;font-family: "Times New Roman"'>Function does not
return if first parameter is</span></span> <span class=
"Keyword"><span style=
'font-size:10.0pt'>TRUE</span></span><span class=
"Annot"><span style=
'font-size:10.0pt;font-family:"Times New Roman"'>.</span></span></p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>noreturnwhenfalse</span></span></p>
<p class="IndentText"><span class="Annot"><span style=
'font-size:10.0pt;font-family: "Times New Roman"'>Function does not
return if first parameter if</span></span> <span class=
"Keyword"><span style=
'font-size:10.0pt'>FALSE</span></span><span class=
"Annot"><span style=
'font-size:10.0pt;font-family:"Times New Roman"'>.</span></span></p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>alwaysreturn</span></span></p>
<p class="IndentText"><span class="Annot"><span style=
'font-size:10.0pt;font-family: "Times New Roman"'>Function always
returns.</span></span></p>
<p class="Heading10">Side Effects <span style=
'font-size:10.5pt;font-weight: normal'>(Section 11.2.1)</span></p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>sef</span></span></p>
<p class="IndentText"><span class="Annot"><span style=
'font-size:10.0pt;font-family:"Times New Roman"'>Corresponding
actual parameter has no side effects.</span></span></p>
<p class="Heading10">Declarations</p>
<p class="beforelist">These annotations can be used on a
declaration to control unused or undefined error reporting.</p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>unused</span></span></p>
<p class="IndentText"><span class="Annot"><span style=
'font-size:10.0pt;font-family: "Times New Roman"'>Identifier need
not be used (no unused errors reported.)&nbsp;
(Section</span></span> <span class="Annot"><span style=
'font-size:10.0pt;font-family:"Times New Roman"'>13.1</span></span><span class="Annot">
<span style=
'font-size:10.0pt;font-family:"Times New Roman"'>)</span></span></p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>external</span></span></p>
<p class="IndentText"><span class="Annot"><span style=
'font-size:10.0pt;font-family: "Times New Roman"'>Identifier is
defined externally (no undefined error reported.)
(Section</span></span> <span class="Annot"><span style=
'font-size:10.0pt;font-family:"Times New Roman"'>13.2</span></span><span class="Annot">
<span style=
'font-size:10.0pt;font-family:"Times New Roman"'>)</span></span></p>
<p class="Heading10">Switch Statements</p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>fallthrough</span></span></p>
<p class="IndentText"><span class="Annot"><span style=
'font-size:10.0pt;font-family:"Times New Roman"'>Fall through
case.&nbsp; No message is reported if the previous case may fall
through into the one immediately after the</span></span>
<span class="Annot"><span style=
'font-size:10.0pt'>fallthrough</span></span><span class=
"Annot"><span style=
'font-size:10.0pt;font-family:"Times New Roman"'>.</span></span></p>
<p class="Heading10">Break and Continue Statements
      <span class="TextFontCXChar"><span style=
      'font-size:11.0pt; font-weight:normal'>(Section
      8.3.3)</span></span></p>
<p class="beforelist">These annotations are used before a
<span class="CodeText"><span style=
'font-size:10.0pt'>break</span></span> or <span class=
"CodeText"><span style='font-size:10.0pt'>continue</span></span>
statement.</p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>innerbreak</span></span></p>
<p class="IndentText"><span class="Annot"><span style=
'font-size:10.0pt;font-family: "Times New Roman"'>Break is breaking
an inner loop or switch.</span></span></p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>loopbreak</span></span></p>
<p class="IndentText"><span class="Annot"><span style=
'font-size:10.0pt;font-family: "Times New Roman"'>Break is breaking
a loop.</span></span></p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>switchbreak</span></span></p>
<p class="IndentText"><span class="Annot"><span style=
'font-size:10.0pt;font-family: "Times New Roman"'>Break is breaking
a switch.</span></span></p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>innercontinue</span></span><span class=
"Annot"><span style=
'font-size:10.0pt'><i>&nbsp;</i></span></span></p>
<p class="IndentText"><span class="Annot"><span style=
'font-size:10.0pt;font-family: "Times New Roman"'>Continue is
continuing an inner loop.</span></span></p>
<p class="Heading10">Unreachable Code</p>
<p class="beforelist">This annotation is used before a statement to
prevent unreachable code errors.</p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>notreached</span></span></p>
<p class="IndentText"><span class="Annot"><span style=
'font-size:10.0pt;font-family: "Times New Roman"'>Statement may be
unreachable.</span></span></p>
<p class="Heading10">Format String Arguments&nbsp;</p>
<p class="beforelist">These annotations are used immediately before
a function declaration.</p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>printflike</span></span></p>
<p class="IndentText"><span class="Annot"><span style=
'font-size:10.0pt;font-family: "Times New Roman"'>Check variable
arguments like</span></span> <span class=
      "CodeText"><span style='font-size:10.0pt'>printf</span></span><span class="Annot">
<span style=
'font-size:10.0pt;font-family:"Times New Roman"'>library
function.&nbsp;&nbsp;</span></span></p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>scanflike</span></span></p>
<p class="IndentText"><span class="Annot"><span style=
'font-size:10.0pt;font-family: "Times New Roman"'>Check variable
arguments like</span></span> <span class=
      "CodeText"><span style='font-size:10.0pt'>scanf</span></span><a name="_Toc344355453">
</a><a name="_Ref343091002"></a><a name=
      "_Ref343065628"><span class="Annot"><span style=
      'font-size:10.0pt;font-family:"Times New Roman"'>library
      function.</span></span></a></p>
<p class="Heading10"><a name="_Ref348789839">Use Warnings</a></p>
<p class="beforelist">These annotations are used immediately before
a function, variable or type declaration.</p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>warn <i>&lt;flag-specifier&gt;</i>
<i>&lt;message&gt;</i></span></span></p>
<p class="IndentText">Issue a warning (controlled by
      <span class="Flag"><span style=
      'font-size:10.0pt'>flag-specifier</span></span>) where this
      declarator is used.</p>
<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
<a name="_Toc534975071">Macro Expansion</a></p>
<p class="TextFontCX"><a href=
"mailto:/*@notfunction@*/"><span class="Annot"><span style=
'font-size:10.0pt'>/*@notfunction@*/</span></span></a></p>
<p class="IndentText">The next macro definition is not intended to
be a function, and should be expanded in line instead of checked as
a macro function definition.</p>
<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
<a name="_Toc534975072">Arbitrary Integral Types</a></p>
<p class="TextFontCX">These annotations are used to represent
arbitrary integral types.&nbsp; Syntactically, they replace the
implicit <span class="Flag"><span style=
'font-size:10.0pt'>int</span></span> type.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>/*@integraltype@*/</span></span></p>
<p class="IndentText">An arbitrary integral type.&nbsp; The actual
type may be any one of <span class="CodeText"><span style=
'font-size:10.0pt'>short</span></span>, <span class=
"CodeText"><span style='font-size:10.0pt'>int</span></span>,
<span class="CodeText"><span style=
'font-size:10.0pt'>long</span></span>, <span class=
"CodeText"><span style='font-size:10.0pt'>unsigned
short</span></span>, <span class="CodeText"><span style=
'font-size:10.0pt'>unsigned</span></span>, or <span class=
"CodeText"><span style='font-size:10.0pt'>unsigned
long</span></span>.</p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>/*@unsignedintegraltype@*/</span></span></p>
<p class="IndentText">An arbitrary unsigned integral type.&nbsp;
The actual type may be any one of <span class=
"CodeText"><span style='font-size:10.0pt'>unsigned
short</span></span>, <span class="CodeText"><span style=
'font-size:10.0pt'>unsigned</span></span>, or <span class=
"CodeText"><span style='font-size:10.0pt'>unsigned
long</span></span>.</p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>/*@signedintegraltype@*/</span></span></p>
<p class="IndentText">An arbitrary signed integral type.&nbsp; The
actual type may be any one of <span class=
      "CodeText"><span style='font-size:10.0pt'>short</span></span>,
      <span class="CodeText"><span style=
      'font-size:10.0pt'>int</span></span>, or <span class=
      "CodeText"><span style=
      'font-size:10.0pt'>long</span></span>.</p>
<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
<a name="_Toc534975073"></a><a name="_Ref347471625">Traditional
Lint Comments</a></p>
<p class="TextFontCX">Some of the control comments supported by
most standard UNIX lints are supported by Splint so legacy systems
can be checked more easily.&nbsp; These comments are not lexically
consistent with Splint comments, and their meanings are less
precise (and may vary between different lint programs), so we
recommend that Splint comments are used instead except for checking
legacy systems already containing standard lint comments.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="beforelist">These standard lint comments supported by
Splint:</p>
<p class="TextFontCX"><span class="Annot"><span style=
'font-size:10.0pt'>/*FALLTHROUGH*/</span></span> (alternate
misspelling, <span class="Annot"><span style=
'font-size:10.0pt'>/*FALLTHRU*/</span></span>)</p>
<p class="IndentText">Prevents errors for fall through cases.&nbsp;
Same meaning as <span class="Annot"><span style=
'font-size:10.0pt'>/*@fallthrough@*/</span></span>.</p>
<p class="MsoListBullet"><span class="Annot"><span style=
'font-size:10.0pt'>/*NOTREACHED*/</span></span></p>
<p class="IndentText">Prevents errors about unreachable code (until
the end of the function).&nbsp; Same meaning as <span class=
"Annot"><span style=
'font-size:10.0pt'>/*@notreached@*/</span></span>.&nbsp;&nbsp;</p>
<p class="MsoListBullet"><span class="Annot"><span style=
'font-size:10.0pt'>/*PRINTFLIKE*/</span></span></p>
<p class="indentbefore">Arguments similar to the <span class=
"CodeText"><span style='font-size:10.0pt'>printf</span></span>
library function (there didn&#8217;t seem to be much of a consensus
among standard lints as to exactly what this means).&nbsp; Splint
supports:</p>
<p class="IndentText"><span class="Annot"><span style=
'font-size:10.0pt'>/*@printflike@*/</span></span></p>
<p class="IndentText" style='margin-left:.5in'>Function takes zero
or more arguments of any type, an unmodified <span class=
"CodeText"><span style='font-size:10.0pt'>char *</span></span>
format string argument and zero of more arguments of type and
number dictated by the format string.&nbsp; Format codes are
interpreted identically to the <span class=
      "CodeText"><span style='font-size:10.0pt'>printf</span></span>
      standard library function.&nbsp; May return a result of any
      type.&nbsp; (Splint interprets <span class=
      "Annot"><span style=
      'font-size:10.0pt'>/*PRINTFLIKE*/</span></span> as
      <span class="Annot"><span style=
      'font-size:10.0pt'>/*@printflike@*/</span></span>.)</p>
<p class="IndentText"><span class="Annot"><span style=
'font-size:10.0pt'>/*@scanflike@*/</span></span></p>
<p class="IndentText" style='margin-left:.5in'>Like
      <span class="Annot"><span style=
      'font-size:10.0pt'>printflike</span></span>, except format
      codes are interpreted as in the <span class=
      "CodeText"><span style='font-size:10.0pt'>scanf</span></span>
      library function.</p>
<p class="IndentText">&nbsp;</p>
<p class="MsoListBullet" style='margin-left:0in;text-indent:0in'>
<span class="Annot"><span style=
'font-size:10.0pt'>/*ARGSUSED*/</span></span></p>
<p class="IndentText">Turns off unused parameter messages for this
function.&nbsp; The control comment, <span class=
"Annot"><span style=
'font-size:10.0pt'>/*@&#8209;paramuse</span></span><span class="Annot">
<span style='font-size:10.0pt'>@*/</span></span> can be used to the
same effect, or <span class="Annot"><span style=
'font-size:10.0pt'>/*@unused@*/</span></span>&nbsp;can be used in
individual parameter declarations.</p>
<p class="IndentText">&nbsp;</p>
<p class="TextFontCX">Splint will ignore standard lint comments if
<span class="Flag"><span style=
'font-size:10.0pt'>-lint-comments</span></span> is used.&nbsp; If
<span class="Flag"><span style=
'font-size:10.0pt'>+warn-lint-comments</span></span> is used,
Splint generates a message for standard lint comments and suggest
replacements<a name="_Ref348801565">.</a></p>
<p class="MsoHeading8" style='margin-left:0in;text-indent:0in'>
<a name="_Toc534975074">Metastate Definitions</a></p>
<p class="TextFontCX">The grammar for <span class=
"ProgramNameChar">.mts</span> files is shown below.</p>
<p class="MsoNormal">&nbsp;</p>
<p class="TextFontCX" align="left" style=
'margin-left: .25in;text-align:left'><i><span lang=
"FR">metastate</span></i> <span lang="FR">&nbsp;&nbsp;</span>
<span style='font-family:Symbol'>&#222;</span> <span lang=
"FR">[</span> <span class="Annot"><span style=
'font-size:10.0pt'>global</span></span> <span lang="FR">]</span>
<span class="Annot"><span style=
'font-size:10.0pt'>attribute</span></span> <i><span lang=
"FR">identifier clause*</span></i> <span class=
      "Annot"><span style='font-size: 10.0pt'>end</span></span></p>
<p class="TextFontCX" align="left" style=
'margin-left: .25in;text-align:left'><i><span lang=
"FR">clause</span></i> <span lang=
"FR">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span> <span style=
'font-family:Symbol'>&#222;</span> <i><span lang=
"FR">contextClause</span></i> <span lang="FR">| <i>valuesClause</i>
| <i>defaultClause | defaultsClause</i></span></p>
<p class="TextFontCX" align="left" style=
'margin-left: .75in;text-align:left;text-indent:.25in'>
<i><span lang="FR">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></i>
<span lang="FR">| <i>annotationsClause</i> | <i>mergeClause |
transfersClause | loserefClause</i></span></p>
<p class="TextFontCX" align="left" style=
'margin-left: 1.25in;text-align:left'><i><span lang="FR">|
preconditionsClause | postconditionsClause</span></i></p>
<p class="TextFontCX" align="left" style=
'margin-left: .25in;text-align:left'><i><span lang=
"FR">contextClause</span></i><span style=
'font-family:Symbol'>&#222;</span> <span class=
      "Annot"><span style='font-size: 10.0pt'>context</span></span>
      <i><span lang="FR">contextSelector</span></i></p>
<p class="TextFontCX" align="left" style=
'margin-left: .25in;text-align:left'><i><span lang=
"FR">contextSelector</span></i> <span style=
'font-family:Symbol'>&#222;</span> <span lang="FR">(</span>
<span class="Annot"><span style=
'font-size:10.0pt'>parameter</span></span> <span lang="FR">|</span>
<span class="Annot"><span style=
'font-size:10.0pt'>reference</span></span> <span lang="FR">|</span>
<span class="Annot"><span style=
'font-size:10.0pt'>result</span></span> <span lang="FR">|</span>
<span class="Annot"><span style=
'font-size:10.0pt'>clause</span></span> <span lang="FR">|</span>
<span class="Annot"><span style=
'font-size:10.0pt'>literal</span></span> <span lang="FR">|</span>
<span class="Annot"><span style=
'font-size:10.0pt'>null</span></span> <span lang="FR">) [
<i>type</i> ]</span></p>
<p class="TextFontCX" align="left" style=
'margin-left: .25in;text-align:left'><i><span lang=
"FR">valuesClause</span></i><span style=
'font-family:Symbol'>&#222;</span> <span class=
      "Annot"><span style='font-size: 10.0pt'>oneof</span></span>
      <i>valueChoice</i>,*</p>
<p class="TextFontCX" align="left" style=
'margin-left: .25in;text-align:left'>&nbsp;</p>
<p class="TextFontCX" align="left" style=
'margin-left: .25in;text-align:left'><i><span lang=
"FR">defaultClause</span></i> <span style=
'font-family:Symbol'>&#222;</span> <span class=
      "Annot"><span style='font-size: 10.0pt'>default</span></span>
      <i>valueChoide</i></p>
<p class="TextFontCX" align="left" style=
'margin-left: .25in;text-align:left'><i><span lang=
"FR">defaultsClause</span></i><span style=
'font-family:Symbol'>&#222;</span> <span class=
      "Annot"><span style='font-size: 10.0pt'>defaults</span></span>
      <span lang="FR">( <i>contextSelector</i></span> <span class=
      "Annot"><span style='font-size:10.0pt'>==&gt;</span></span>
      <i>valueChoice</i> <span lang="FR">)*</span></p>
<p class="TextFontCX" align="left" style=
'margin-left: .25in;text-align:left'><i><span lang=
"FR">&nbsp;</span></i></p>
<p class="TextFontCX" align="left" style=
'margin-left: .25in;text-align:left'><i><span lang=
"FR">annotationsClause</span></i><span style=
'font-family:Symbol'>&#222;</span> <span class=
      "Annot"><span style='font-size: 10.0pt'>annotations</span></span>
      &nbsp;( <i>identifier</i> [ <i><span lang=
      "FR">contextSelector</span></i> <span lang="FR">]</span>
      <span class="Annot"><span style=
      'font-size: 10.0pt'>==&gt;</span></span> <i>valueChoice</i>
      )<i><span lang="FR">*</span></i></p>
<p class="TextFontCX" align="left" style=
'margin-left: .25in;text-align:left'><i><span lang=
"FR">&nbsp;</span></i></p>
<p class="TextFontCX" align="left" style=
'margin-left: .25in;text-align:left'><i><span lang=
"FR">mergeClause</span></i><span style=
'font-family:Symbol'>&#222;</span> <span class=
      "Annot"><span style='font-size: 10.0pt'>merge</span></span> (
      <i>mergeItem</i> <span class="Annot"><span style=
      'font-size:10.0pt'>+</span></span> <i>mergeItem</i>
      <span class="Annot"><span style=
      'font-size:10.0pt'>==&gt;</span></span> <i>transferAction</i>
      )<i><span lang="FR">*</span></i></p>
<p class="TextFontCX" align="left" style=
'margin-left: .25in;text-align:left'><i><span lang=
"FR">mergeItem</span></i><span style=
'font-family:Symbol'>&#222;</span> <i>valueChoice |</i>
      <span class="Annot"><span style=
      'font-size:10.0pt'>*</span></span></p>
<p class="TextFontCX" align="left" style=
'margin-left: .25in;text-align:left'><i><span lang=
"FR">&nbsp;</span></i></p>
<p class="TextFontCX" align="left" style=
'margin-left: .25in;text-align:left'><i><span lang=
"FR">transfersClause</span></i><span style=
'font-family:Symbol'>&#222;</span> <span class=
      "Annot"><span style='font-size: 10.0pt'>transfers</span></span>
      ( <i>valueChoice</i> <span class="Annot"><span style=
      'font-size:10.0pt'>as</span></span>
      <i>valueChoice</i><span class="Annot"><span style=
      'font-size:10.0pt'>==&gt;</span></span> <i>transferAction</i>
      )<i><span lang="FR">*</span></i></p>
<p class="TextFontCX" align="left" style=
'margin-left: .25in;text-align:left'><i><span lang=
"FR">loserefClause</span></i><span style=
'font-family:Symbol'>&#222;</span> <span class=
      "Annot"><span style='font-size: 10.0pt'>losereference</span></span>
      ( <i>valueChoice</i> <span class="Annot"><span style=
      'font-size:10.0pt'>==&gt;</span></span> <i>errorAction</i>
      )<i><span lang="FR">*</span></i></p>
<p class="TextFontCX" align="left" style=
'margin-left: .25in;text-align:left'><i><span lang=
"FR">&nbsp;</span></i></p>
<p class="TextFontCX" align="left" style=
'margin-left: .25in;text-align:left'><i><span lang=
"FR">transferAction</span></i><span style=
'font-family:Symbol'>&#222;</span> <i>valueChoice |
errorAction</i></p>
<p class="TextFontCX" align="left" style=
'margin-left: .25in;text-align:left'>
      <i>errorAction</i><span style='font-family:Symbol'>&#222;</span>
      <span class="Annot"><span style=
      'font-size:10.0pt'>error</span></span> [ <i>stringLiteral</i>
      ]</p>
<p class="TextFontCX" align="left" style=
'margin-left: .25in;text-align:left'><i><span lang=
"FR">&nbsp;</span></i></p>
<p class="TextFontCX" align="left" style=
'margin-left: .25in;text-align:left'><i><span lang=
"FR">valueChoice</span></i><span style=
'font-family:Symbol'>&#222;</span>
<i>identifier</i>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</p>
<p class="TextFontCX">&nbsp;</p>
<p class="MsoHeading7" style='margin-left:0in;text-indent:0in'>
<a name="_Toc534975075"></a><a name="_Ref397875216"></a><a name=
"_Ref350066976"></a><a name="_Ref348788300">Appendix
      D<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
<a id="specifications" name="specifications">
            Specifications</a>
</a>
	    </p>
<p class="TextFontCX">Another way of providing more information
about programs is to use formal specifications.&nbsp; Although this
document has largely ignored specifications, Splint was originally
designed to use the information in LCL specifications instead of
source-code annotations.&nbsp; This document focuses on annotations
since it takes less effort to add annotations to source code than
to maintain an additional specification file.&nbsp; Annotations can
express everything that can be expressed in LCL specifications that
is relevant to Splint checking.&nbsp; However, LCL specifications
can provide more precise documentation on program interfaces than
is possible with Splint annotations.&nbsp; This appendix (extracted
from [Evans94]) is a very brief introduction to LCL
Specifications.&nbsp; For more information, consult
[GH93].&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">The Larch family of languages is a two-tiered
approach to formal specification. A specification is built using
two languages &#8212; the <i>Larch Shared Language</i> (LSL), which
is independent of the implementation language, and a <i>Larch
Interface Language</i> designed for the specific implementation
language.&nbsp; An LSL specification defines <i>sorts</i>,
analogous to abstract&nbsp;types in a programming language, and
<i>operators</i>, analogous to procedures.&nbsp; It expresses the
underlying semantics of an abstraction.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">The interface language specifies an interface
to an abstraction in a particular programming language.&nbsp; It
captures the details of the interface needed by a client using the
abstraction and places constraints on both correct implementations
and uses of the module.&nbsp; The semantics of the interface are
described using primitives and sorts and operators defined in LSL
specifications.&nbsp; Interface languages have been designed for
several programming languages.</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX">LCL [GH93, Tan95] is a Larch interface
language for Standard C.&nbsp; LCL uses a C-like syntax.&nbsp;
Traditionally, a C module <span class=
      "Keyword"><i><span style='font-size:10.0pt;font-family:Arial; color:windowtext'>
M</span></i></span> consists of a source file, <span class=
"Keyword"><i><span style=
'font-size:10.0pt;font-family:Arial;color:windowtext'>M</span></i></span><span class="Keyword">
<span style=
'font-size:10.0pt;font-family:Arial;color:windowtext'>.c</span></span>,
and a header file, <span class="Keyword"><i><span style=
'font-size:10.0pt; font-family:Arial;color:windowtext'>M</span></i></span><span class="Keyword">
<span style=
'font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>.&nbsp;
The header file contains prototype declarations for functions,
variables and constants exported by <span class=
"Keyword"><i><span style=
'font-size:10.0pt; font-family:Arial;color:windowtext'>M</span></i></span>,
as well as those macro definitions that implement exported
functions or constants, and definitions of exported types. When
using LCL, a module includes two additional files &#8212;
<span class="Keyword"><i><span style=
'font-size:10.0pt;font-family:Arial;color:windowtext'>M</span></i></span><span class="Keyword">
<span style=
'font-size:10.0pt;font-family:Arial;color:windowtext'>.lcl</span></span>,
a formal specification of <span class=
      "Keyword"><i><span style='font-size:10.0pt; font-family:Arial;color:windowtext'>
M</span></i></span>, and <span class=
      "Keyword"><i><span style='font-size:10.0pt;font-family:Arial;color:windowtext'>
M</span></i></span><span class="Keyword"><span style=
'font-size:10.0pt;font-family:Arial;color:windowtext'>.lh</span></span>,
which is derived by Splint (if the <span class=
      "Flag"><span style='font-size:10.0pt'>lh</span></span> flag
      is on) from <span class="Keyword"><i><span style=
      'font-size:10.0pt;font-family:Arial;color:windowtext'>M</span></i></span><span class="Keyword">
<span style=
'font-size:10.0pt;font-family:Arial;color:windowtext'>.lcl</span></span>.&nbsp;
Clients use <span class="Keyword"><i><span style=
'font-size:10.0pt;font-family: Arial;color:windowtext'>M</span></i></span><span class="Keyword">
<span style=
'font-size:10.0pt;font-family:Arial;color:windowtext'>.lcl</span></span>
for documentation, and should not need to look at any
implementation file.&nbsp; The derived file, <span class=
"Keyword"><i><span style=
'font-size:10.0pt;font-family: Arial;color:windowtext'>M</span></i></span><span class="Keyword">
<span style=
'font-size:10.0pt;font-family:Arial;color:windowtext'>.lh</span></span>,
contains include directives (if <span class=
"Keyword"><i><span style=
'font-size: 10.0pt;font-family:Arial;color:windowtext'>M</span></i></span>
depends on other specified modules), prototypes of functions and
declarations of variables as specified in <span class=
"Keyword"><i><span style=
'font-size:10.0pt;font-family: Arial;color:windowtext'>M</span></i></span><span class="Keyword">
<span style=
'font-size:10.0pt;font-family:Arial;color:windowtext'>.lcl</span></span>.&nbsp;
The file <span class="Keyword"><i><span style=
'font-size:10.0pt;font-family:Arial; color:windowtext'>M</span></i></span><span class="Keyword">
<span style=
'font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>
should include <span class="Keyword"><i><span style=
'font-size:10.0pt;font-family: Arial;color:windowtext'>M</span></i></span><span class="Keyword">
<span style=
'font-size:10.0pt;font-family:Arial;color:windowtext'>.lh</span></span>
and retain the implementation aspects of the old <span class=
"Keyword"><i><span style=
'font-size:10.0pt;font-family:Arial;color:windowtext'>M</span></i></span><span class="Keyword">
<span style=
'font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>,
but is no longer used for c<a name="_Ref348845779">lient
documentation.</a></p>
<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
<a name="_Toc534975076">Specification Flags</a></p>
<p class="TextFontCX">These flags are relevant only when Splint is
used with LCL specifications.</p>
<p class="Heading10">Global Flags</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>lcs</span></span></p>
<p class="IndentText">Generate <span class=
      "Keyword"><span style='font-size:10.0pt; font-family:Arial;color:windowtext'>
.lcs</span></span>&nbsp;files containing symbolic state of
<span class="Keyword"><span style=
'font-size:10.0pt;font-family:Arial;color:windowtext'>.lcl</span></span>
files (used for imports).&nbsp; By default <span class=
"Keyword"><span style=
'font-size:10.0pt;font-family:Arial;color:windowtext'>.lcs</span></span>
files are generated for each <span class=
      "Keyword"><span style='font-size:10.0pt; font-family:Arial;color:windowtext'>
.lcl</span></span> file processed.&nbsp; Use <span class=
"Flag"><span style='font-size:10.0pt'>-lcs</span></span> to prevent
generation of <span class="Keyword"><span style=
'font-size:10.0pt;font-family: Arial;color:windowtext'>.lcs</span></span>
files.</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>lh</span></span></p>
<p class="IndentText">Generate <span class=
      "Keyword"><span style='font-size:10.0pt; font-family:Arial;color:windowtext'>
.lh</span></span> files.&nbsp; By default, <span class=
"Flag"><span style='font-size:10.0pt'>-lh</span></span> is set and
no <span class="Keyword"><span style=
'font-size:10.0pt;font-family:Arial;color:windowtext'>.lh</span></span>
files are generated.&nbsp; Use <span class=
      "Flag"><span style='font-size:10.0pt'>+lh</span></span> to
      enable <span class="Flag"><span style=
      'font-size:10.0pt'>.lh</span></span> file
      generation.&nbsp;</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>i</span></span> <span class=
      "Flag"><span style='font-size:10.0pt'>&lt;file&gt;</span></span></p>
<p class="IndentText">Set LCL initialization file to
      <span class="Flag"><i><span style=
      'font-size:10.0pt'>&lt;file&gt;</span></i></span>.&nbsp; The
      LCL initialization file is read if any <span class=
      "Keyword"><span style=
      'font-size: 10.0pt;font-family:Arial;color:windowtext'>.lcl</span></span>
      files are listed on the command line.&nbsp; The default file
      is <span class="Keyword"><span style=
      'font-size:10.0pt;font-family:Arial;color:windowtext'>lclinit.lci</span></span>,
      found on the <span class="Keyword"><span style=
      'font-size:10.0pt;font-family: Arial;color:windowtext'>LARCH_PATH</span></span>.</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>lclexpect</span></span> <span class=
"Flag"><span style=
'font-size:10.0pt'><i>&lt;number&gt;</i></span></span></p>
<p class="IndentText">Exactly <span class=
      "Flag"><i><span style='font-size:10.0pt'>&lt;number&gt;</span></i></span>
      specification errors are expected.&nbsp; Specification errors
      are errors detected when checking the specifications.&nbsp;
      They do not depend on the source code.</p>
<p class="Heading10">Implicit Globals Checking Qualifiers</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-++-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>imp-checked-spec-globs</span></span></p>
<p class="IndentText">Implicit <span class=
      "Annot"><span style='font-size:10.0pt'>checked</span></span>
      qualifier on global variables specified in an LCL file with
      no checking annotation.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>imp-checkmod-spec-globs</span></span></p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
<p class="IndentText">Implicit <span class=
      "Annot"><span style='font-size:10.0pt'>checkmod</span></span>
      qualifier on global variables specified in an LCL file with
      no checking annotation.</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>imp-checkedstrict-spec-globs</span></span></p>
<p class="IndentText">Implicit <span class=
      "Annot"><span style='font-size:10.0pt'>checked</span></span>
      qualifier on global variables specified in an LCL file with
      no checking annotation.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="Heading10">Implicit Annotations</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>spec-glob-imp-only</span></span></p>
<p class="IndentText">Implicit <span class=
      "Annot"><span style='font-size:10.0pt'>only</span></span>
      annotation on global variable declaration in an LCL file with
      no allocation annotation.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>spec-ret-imp-only</span></span></p>
<p class="IndentText">Implicit <span class=
      "Annot"><span style='font-size:10.0pt'>only</span></span>
      annotation on return value declaration in an LCL file with no
      allocation annotation.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>spec-struct-imp-only</span></span></p>
<p class="IndentText">Implicit <span class=
      "Annot"><span style='font-size:10.0pt'>only</span></span>
      annotation on structure field declarations in an LCL file
      with no allocation annotation.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>spec-imp-only</span></span></p>
<p class="IndentText">Sets <span class="Flag"><span style=
'font-size:10.0pt'>spec-glob-imp-only</span></span>,
      <span class="Flag"><span style=
      'font-size:10.0pt'>spec-ret-imp-only</span></span> and
      <span class="Flag"><span style=
      'font-size:10.0pt'>spec-struct-imp-only</span></span>.</p>
<p class="Heading10">Macro Expansion</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>spec-macros</span></span></p>
<p class="IndentText">Macros defining specified identifiers are not
expanded and are checked according to the
      specification.<span class="Flag"><span style=
      'font-size:10.0pt'>&nbsp;</span></span></p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
<p class="Heading10">Complete Programs and Specifications</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>spec-undef</span></span></p>
<p class="IndentText">Function, variable, iterator or constant
specified but never defined.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>spec-undecl</span></span></p>
<p class="IndentText">Function, variable, iterator or constant
specified but never declared.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>P:</span> <span class=
      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>need-spec</span></span></p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
<p class="IndentText">There is information in the specification
that is not duplicated in syntactic comments.&nbsp; Normally, this
is not an error, but it may be useful to detect it to make sure
checking incomplete systems without the specifications will still
use this information.</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>export-any</span></span></p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
<p class="IndentText">An error is reported for any identifier that
is exported but not specified.&nbsp; (Sets all export flags
below.)</p>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>export-const</span></span></p>
<p class="IndentText">Constant exported but not specified.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>export-var</span></span></p>
<p class="IndentText">Variable exported but not specified.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>export-fcn</span></span></p>
<p class="IndentText">Function exported but not specified.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>export-iter</span></span></p>
<p class="IndentText">Iterator exported but not specified.</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>export-macro</span></span></p>
<p class="IndentText">An expanded macro exported but not
specified</p>
<div>
<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
       height="14" align="left">
<tr>
<td valign="top" align="left" height="14" style=
'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
<p class="TextFontCX" align="center" style=
'text-align:center;background:#CCCCCC'><span style=
'font-size:10.0pt'>m:</span><span class=
      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
<p class="TextFontCX"><span class="Flag"><span style=
'font-size:10.0pt'>export-type</span></span></p>
<p class="IndentText">Type definition exported but not
specified</p>
<p class="MsoHeading7" style='margin-left:0in;text-indent:0in'>
<a name="_Toc534975077"></a><a name="_Ref534642451"></a><a name=
"_Toc344355450">Appendix E<span style=
'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
<a id="annotated" name="annotated">
Annotated Bibliography</a></a></p>
<h4 style='margin-left:0in;text-indent:0in'>Splint</h4>
<p class="TextFontCX">All of these papers are available at
<span style='font-size:10.0pt;font-family:Arial'><a href=
"http://www.splint.org/publications/">http://www.splint.org/publications/</a></span>.&nbsp;&nbsp;&nbsp;&nbsp;</p>
<p class="TextFontCX">&nbsp;</p>
<p class="TextFontCX" align="left" style='text-align: left'>
[Barker01] Chris Barker. <i>Static Error Checking of C Applications
Ported from UNIX to WIN32 Systems Using LCLint</i>. Senior Thesis,
University of Virginia Deptartment of Computer Science.&nbsp; May
2001.</p>
<p class="TextFontCX" align="left" style='text-align: left'>
&nbsp;</p>
<p class="IndentText">Describes annotations and checks useful for
porting applications.</p>
<p class="TextFontCX" align="left" style='text-align: left'>
&nbsp;</p>
<p class="TextFontCX" align="left" style='text-align: left'>
[Evans94] David Evans. <i>Using specifications to check source
code</i>.&nbsp; MIT/LCS/TR 628, Laboratory for Computer Science,
MIT, June 1994.</p>
<p class="TextFontCX" align="left" style='text-align: left'>
&nbsp;</p>
<p class="IndentText">MIT SM Thesis.&nbsp; Describes research
behind Splint, focusing on how specifications can be exploited to
do lightweight checking.&nbsp; Includes case studies using
LCLint.</p>
<p class="TextFontCX" align="left" style='text-align: left'>
&nbsp;</p>
<p class="TextFontCX" align="left" style='text-align: left'>
[EGHT94] David Evans, John Guttag, Jim Horning and Yang Meng
Tan.&nbsp; <i>LCL</i><i>int: A tool for using specifications to
check code</i>.&nbsp; SIGSOFT Symposium on the Foundations of
Software Engineering, December 1994.</p>
<p class="TextFontCX" align="left" style='text-align: left'>
&nbsp;</p>
<p class="IndentText">Somewhat obsolete introduction to
LCLint.&nbsp; Shows how LCLint is used to find errors in a sample
program.</p>
<p class="TextFontCX" align="left" style='text-align: left'>
&nbsp;</p>
<p class="TextFontCX" align="left" style='text-align: left'>
[Evans96] David Evans.&nbsp; <i>Static Detection of Dynamic Memory
Errors</i>.&nbsp; SIGPLAN Conference on Programming Language Design
and Implementation (PLDI &#8217;96), Philadelphia, PA., May
1996.</p>
<p class="TextFontCX" align="left" style='text-align: left'>
&nbsp;</p>
<p class="IndentText">Describes approach for exploiting annotations
added to code to detect a wide class of errors.&nbsp; Focuses on
memory management checks described in Section 5 of this
manual.&nbsp;</p>
<p class="TextFontCX" align="left" style='text-align: left'>
&nbsp;</p>
<p class="TextFontCX" align="left" style='text-align: left'>
[Evans00] David Evans.&nbsp; <i>Annotation-Assisted Lightweight
Static Checking.&nbsp;</i> First International Workshop on
Automated Program Analysis, Testing and Verification.&nbsp;
February, 2000.</p>
<p class="IndentText">&nbsp;</p>
<p class="IndentText">Short position paper describing research
agenda behind Splint.</p>
<p class="IndentText" style='margin-left:0in'>&nbsp;</p>
<p class="IndentText" style='margin-left:0in'>[Evans02] David Evans
and David Larochelle.&nbsp; <i>Improving Security Using Extensible
Lightweight Static Analysis</i>.&nbsp; IEEE Software, Jan/Feb
2002.</p>
<p class="IndentText" style='margin-left:0in'>&nbsp;</p>
<p class="IndentText">Most security attacks exploit instances of
well-known classes of implementations flaws.&nbsp; This article
describes how Splint can be used to detect common security
vulnerabilities (including buffer overflows and format string
vulnerabilities).</p>
<p class="IndentText">&nbsp;</p>
<p class="IndentText" style='margin-left:0in'>[Larochelle01] David
Larochelle and David Evans.&nbsp; Statically Detecting Likely
Buffer Overflow Vulnerabilities.&nbsp; 2001 USENIX Security
Symposium, Washington, D. C., August 13-17, 2001.&nbsp;</p>
<p class="IndentText">&nbsp;</p>
<p class="IndentText">Buffer overflow attacks may be today's single
most important security threat. This paper describes how Splint can
be used to detect likely vulnerabilities through an analysis of the
program source code and presents experience using our approach to
detect buffer overflow vulnerabilities in two security-sensitive
programs.</p>
<p class="IndentText">&nbsp;</p>
<h4 style='margin-left:0in;text-indent:0in'>C</h4>
<p class="TextFontCX" align="left" style='text-align: left'>[ISO99]
International Standard ISO/IEC 9899.&nbsp; <i>Programming languages
&#8211; C.</i>&nbsp; Second edition.&nbsp; December 1999.</p>
<p class="IndentText">&nbsp;</p>
<p class="IndentText">International standard specification for C
programming language.&nbsp; Approved by ANSI May 2000.</p>
<p class="TextFontCX" align="left" style='text-align: left'>
&nbsp;</p>
<p class="TextFontCX" align="left" style='text-align: left'>[KR88]
Brian W. Kernighan and Dennis M. Ritchie.&nbsp; <i>The C
Programming Language</i>, second edition.&nbsp; Prentice Hall, New
Jersey, 1988.</p>
<p class="TextFontCX" align="left" style='text-align: left'>
&nbsp;</p>
<p class="IndentText">Standard reference for ANSI C.&nbsp; If you
haven&#8217;t heard of this one, you probably didn&#8217;t get this
far (unless you started at the back).</p>
<p class="TextFontCX" align="left" style='text-align: left'>
&nbsp;</p>
<p class="TextFontCX" align="left" style='text-align: left'>[vdL94]
Peter van der Linden.&nbsp; <i>Expert C Programming:&nbsp; Deep C
Secrets</i>.&nbsp; SunSoft Press, Prentice Hall, New Jersey,
1994.</p>
<p class="TextFontCX" align="left" style='text-align: left'>
&nbsp;</p>
<p class="IndentText">Filled with useful information on the darker
corners of C, as well as lots of industry anecdotes and
humor.&nbsp; Splint&#8217;s reserved name checking is loosely based
on the list of reserved names in this book.</p>
<h4 style='margin-left:0in;text-indent:0in'>Methodology</h4>
<p class="TextFontCX" align="left" style='text-align: left'>[GH93]
John Guttag and James Horning with Stephen J. Garland, Kevin D.
Jones, Andr&#233;s Modet, and Jeannette M. Wing.&nbsp; <i>Larch:
Languages and Tools for Formal Specification</i>. Springer-Verlag,
Texts and Monographs in Computer Science, 1993.</p>
<p class="IndentText">&nbsp;</p>
<p class="IndentText">Overview of the Larch family of specification
languages and related tools.&nbsp; Includes a chapter on LCL, the
Larch C interface language, on which Splint is based.</p>
<p class="IndentText" style='margin-left:0in'>&nbsp;</p>
<p class="TextFontCX" align="left" style='text-align: left'>[LG86]
Barbara Liskov and John Guttag.&nbsp; <i>Abstraction and
Specification in Program Development</i>, MIT Press, Cambridge, MA,
1986.</p>
<p class="IndentText">&nbsp;</p>
<p class="IndentText">Describes a programming methodology using
abstract types&nbsp;and specified interfaces.&nbsp; Much of the
methodology upon which Splint is based comes from this book.&nbsp;
Uses the CLU programming language.&nbsp;</p>
<p class="IndentText">&nbsp;</p>
<p class="TextFontCX" align="left" style='text-align: left'>
[Liskov01] Barbara Liskov with John Guttag.&nbsp; <i>Program
Development in Java</i>, Addison Wesley, 2001.</p>
<p class="IndentText">&nbsp;</p>
<p class="IndentText">An updated version of [LG86] for the Java
programming language.&nbsp;</p>
<p class="IndentText">&nbsp;</p>
<p class="TextFontCX" align="left" style='text-align: left'>[Tan95]
Yang Meng Tan.&nbsp; <i>Formal Specification Techniques for
Engineering Modular C</i>.&nbsp; Kluwer International Series in
Software Engineering, Volume 1, Kluwer Academic Publishers, Boston,
1995.</p>
<p class="MsoNormal" align="left" style='text-align:left'>
&nbsp;</p>
<p class="IndentText">Modified and updated version of MIT Ph D
thesis, previously published as MIT/LCS/TR-619, 1994.&nbsp;
Includes presentation of the semantics of LCL and a case study
using LCL.</p>
<p class="IndentText" style='margin-left:0in'>&nbsp;</p>
<h4 style='margin-left:0in;text-indent:0in'>Secure Programming</h4>
<p class="TextFontCX" align="left" style='text-align: left'>[Hat95]
Les Hatton.&nbsp; <i>Safer C: Developing Software for
High-integrity and Safety-critical Systems</i>.&nbsp; McGraw-Hill
International Series in Software Engineering, 1995.</p>
<p class="TextFontCX" align="left" style='text-align: left'>
&nbsp;</p>
<p class="IndentText">A broad work on all aspects of developing
safety-critical software, focusing on the C language.&nbsp;
Provides good justification for the use of C in safety-critical
systems, and the necessity of tool-supported programming
standards.&nbsp; Splint users will be interested to see how many of
the errors listed as only being dynamically detectable can be
detected statically by Splint.</p>
<p class="IndentText" style='margin-left:0in'>&nbsp;</p>
<p class="IndentText" style='margin-left:0in'>[VM02] John Viega and
Gary McGraw.&nbsp; <i>Building Secure Software: How to Avoid
Security Problems the</i> <i>Right Way</i><i>.</i>&nbsp;
Addison-Wesley, 2002.</p>
<p class="IndentText">A comprehensive survey of techniques and
principles for building secure programs.</p>
<p class="IndentText" style='margin-left:0in'>&nbsp;</p>
<p class="IndentText" style='margin-left:0in'>See also [Evans02]
and
[Larochelle01].</p></center></center></center></center></center></center></center></center></center></center></center></div>
<span style=
'font-size:11.0pt;font-family:"Times New Roman"'><br clear="all"
style='page-break-before:right'></span> 

<span style=
'font-size:11.0pt;font-family:"Times New Roman"'><br clear="all"
style='page-break-before:auto'></span> 
<div class="Section8">
<p class="IndentText">&nbsp;</p></div>
<div><br clear="all">
 
<hr align="left" size="1" width="33%">
<div id="ftn1">
<p class="MsoFootnoteText"><a href="#_ftnref1" name="_ftn1"
   title=""><span class="MsoFootnoteReference"><span class=
   "MsoFootnoteReference"><span style=
   'font-size:10.0pt;font-family:"Times New Roman"'>[1]</span></span></span></a>
   Lint is a common programming tool for detecting anomalies in C
   programs.&nbsp; S. C. Johnson developed the original lint in the
   late seventies, mainly because early versions of C did not
   support function prototypes.&nbsp; Splint was originally named
   LCLint because it was originally intended to check for
   inconsistencies between LCL specifications and C
   implementations.&nbsp; To reflect divergence from LCL and
   increased focus on detecting security vulnerabilities, the name
   was changed to Splint, short for &#8220;Specification
   Lint&#8221; and &#8220;Secure Programming Lint&#8221;.</p></div>
<div id="ftn2">
<p class="MsoFootnoteText"><a href="#_ftnref2" name="_ftn2"
   title=""><span class="MsoFootnoteReference"><span class=
   "MsoFootnoteReference"><span style=
   'font-size:10.0pt;font-family:"Times New Roman"'>[2]</span></span></span></a>
   The meta-notation, <span class="Annot">item,<sup>+</sup></span>
   is used to denote a comma separated list of items.&nbsp; For
   example,
   &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
   <span class="Annot">/*@access mstring, intSet@*/</span></p>
<p class="MsoFootnoteText">allows access to the representations of
both <span class="CodeText">mstring</span> and <span class=
"CodeText">intSet</span>.)&nbsp;&nbsp;</p></div>
<div id="ftn3">
<p class="MsoFootnoteText"><a href="#_ftnref3" name="_ftn3"
   title=""><span class="MsoFootnoteReference"><span class=
   "MsoFootnoteReference"><span style=
   'font-size:10.0pt;font-family:"Times New Roman"'>[3]</span></span></span></a>
   This section is largely based on [Evans96].&nbsp; It
   semi-formally defines some of the terms needed to describe
   memory management checking; if you are satisfied with an
   intuitive understanding of these terms, this section may be
   skipped.</p></div>
<div id="ftn4">
<p class="MsoFootnoteText"><a href="#_ftnref4" name="_ftn4"
   title=""><span class="MsoFootnoteReference"><span class=
   "MsoFootnoteReference"><span style=
   'font-size:10.0pt;font-family:"Times New Roman"'>[4]</span></span></span></a>
   This is similar to the LISP storage model, except that objects
   are typed.</p></div>
<div id="ftn5">
<p class="TextFontCX"><a href="#_ftnref5" name="_ftn5" title=
""><span class="MsoFootnoteReference"><span class=
"MsoFootnoteReference"><span style=
'font-size:11.0pt;font-family:"Times New Roman"'>[5]</span></span></span></a>
<span style='font-size:10.0pt'>Except</span> <span class=
"CodeText"><span style=
'font-size:10.0pt'>sizeof</span></span><span style=
'font-size:10.0pt'>, which does not need the value of its
argument.</span></p></div>
<div id="ftn6">
<p class="TextFontCX"><a href="#_ftnref6" name="_ftn6" title=
""><span class="MsoFootnoteReference"><span class=
"MsoFootnoteReference"><span style=
'font-size:11.0pt;font-family:"Times New Roman"'>[6]</span></span></span></a>
If the storage is not assigned to a reference, an internal
reference is created to track the storage.</p></div>
<div id="ftn7">
<p class="MsoFootnoteText"><a href="#_ftnref7" name="_ftn7"
   title=""><span class="MsoFootnoteReference"><span class=
   "MsoFootnoteReference"><span style=
   'font-size:10.0pt;font-family:"Times New Roman"'>[7]</span></span></span></a>
   The declaration of <span class="CodeText">free</span> has a
   <span class="Annot">null</span>&nbsp;annotation on the parameter
   to indicate that the argument may be <span class=
   "CodeText">NULL</span>.&nbsp; According to [ISO, 7.20.3.2],
   <span class="CodeText">NULL</span> may be passed to
      <span class="CodeText">free</span> without no action.&nbsp;
      On some UNIX platforms, passing <span class=
      "CodeText">NULL</span> to free causes a program crash so the
      UNIX version of the standard library specifies <span class=
      "CodeText">free</span> without the <span class=
      "Annot">null</span> annotation on its parameter. To check
      that allocated objects are completely destroyed (e.g., all
      unshared objects inside a structure are deallocated before
      the structure is deallocated), Splint checks that any
      parameter passed as an <span class="CodeText">out only void
      *</span> does not contain references to live, unshared
      objects.&nbsp; This makes sense, since such a parameter could
      not be used sensibly in any way other than deallocating its
      storage.</p></div>
<div id="ftn8">
<p class="MsoFootnoteText"><a href="#_ftnref8" name="_ftn8"
   title=""><span class="MsoFootnoteReference"><span class=
   "MsoFootnoteReference"><span style=
   'font-size:10.0pt;font-family:"Times New Roman"'>[8]</span></span></span></a>
   In versions of Splint before 3.0, the <span class=
   "Annot">noreturn</span> annotation was named <span class=
   "Annot">exits</span>.&nbsp; The <span class=
   "Annot">noreturn</span> annotation means the same thing, but is
   a more appropriate name.&nbsp; For legacy code, Splint still
   supports the <span class="Annot">exits</span> annotations.&nbsp;
   Similarly, <span class="Annot">maynotreturn</span> replaces
   <span class="Annot">mayexit</span>, <span class=
   "Annot">noreturnwhentrue</span> replaces <span class=
   "Annot">truexit</span> and <span class=
   "Annot">noreturnwhenfalse</span> replaces <span class=
   "Annot">falseexit</span>.</p></div>
<div id="ftn9">
<p class="MsoFootnoteText"><a href="#_ftnref9" name="_ftn9"
   title=""><span class="MsoFootnoteReference"><span class=
   "MsoFootnoteReference"><span style=
   'font-size:10.0pt;font-family:"Times New Roman"'>[9]</span></span></span></a>The
   <span class="Annot">sef</span> annotation denotes a parameter as
   side effect free (see Section 11.2.1).&nbsp; We use
      <span class="CodeText">bool /*@alt int@*/</span> as the type
      of the parameter, to indicate that it may be either a Boolean
      or an integer.</p></div>
<div id="ftn10">
<p class="MsoFootnoteText"><a href="#_ftnref10" name="_ftn10"
   title=""><span class="MsoFootnoteReference"><span class=
   "MsoFootnoteReference"><span style=
   'font-size:10.0pt;font-family:"Times New Roman"'>[10]</span></span></span></a>
   Peter van der Linden estimates that default fall through is the
   wrong behavior 97% of the time.&nbsp; [vdL95, p. 37]</p></div>
<div id="ftn11">
<p class="MsoFootnoteText"><a href="#_ftnref11" name="_ftn11"
   title=""><span class="MsoFootnoteReference"><span class=
   "MsoFootnoteReference"><span style=
   'font-size:10.0pt;font-family:"Times New Roman"'>[11]</span></span></span></a>
   &#8220;Software Glitch Cripples AT&amp;T Network&#8221;,
   Telephony, 22 January 1990.</p></div>
<div id="ftn12">
<p class="MsoFootnoteText"><a href="#_ftnref12" name="_ftn12"
   title=""><span class="MsoFootnoteReference"><span class=
   "MsoFootnoteReference"><span style=
   'font-size:10.0pt;font-family:"Times New Roman"'>[12]</span></span></span></a>
   See [Larochelle01] for information on internal aspects of the
   checking.</p></div>
<div id="ftn13">
<p class="MsoFootnoteText"><a href="#_ftnref13" name="_ftn13"
   title=""><span class="MsoFootnoteReference"><span class=
   "MsoFootnoteReference"><span style=
   'font-size:10.0pt;font-family:"Times New Roman"'>[13]</span></span></span></a>
   This section is largely based on [Evans02].</p></div>
<div id="ftn14">
<p class="MsoFootnoteText"><a href="#_ftnref14" name="_ftn14"
   title=""><span class="MsoFootnoteReference"><span class=
   "MsoFootnoteReference"><span style=
   'font-size:10.0pt;font-family:"Times New Roman"'>[14]</span></span></span></a>
   C. Cowan et al., <i>FormatGuard: Automatic Protection from
   printf Format String Vulnerabilities</i>.&nbsp; 10th Usenix
   Security Symposium, 2001.</p></div>
<div id="ftn15">
<p class="MsoFootnoteText"><a href="#_ftnref15" name="_ftn15"
   title=""><span class="MsoFootnoteReference"><span class=
   "MsoFootnoteReference"><span style=
   'font-size:10.0pt;font-family:"Times New Roman"'>[15]</span></span></span></a>
   To be completely correct, all the macro parameters should be
   evaluated before the macro has any side effects.&nbsp; Splint
   does not check this.</p></div>
<div id="ftn16">
<p class="MsoFootnoteText"><a href="#_ftnref16" name="_ftn16"
   title=""><span class="MsoFootnoteReference"><span class=
   "MsoFootnoteReference"><span style=
   'font-size:10.0pt;font-family:"Times New Roman"'>[16]</span></span></span></a>
   Functions that do not produce to the same result each time they
   are called with the same arguments should be declared to modify
   <span class="Annot">internalState</span> so they will lead to
   errors if they are passed as <span class="Annot">sef</span>
   parameters.</p></div>
<div id="ftn17">
<p class="MsoFootnoteText"><a href="#_ftnref17" name="_ftn17"
   title=""><span class="MsoFootnoteReference"><span class=
   "MsoFootnoteReference"><span style=
   'font-size:10.0pt;font-family:"Times New Roman"'>[17]</span></span></span></a>
   The most renowned C naming convention is the Hungarian naming
   convention, introduced by Charles Simonyi [Simonyi, Charles, and
   Martin Heller.&nbsp; &#8220;The Hungarian
   Revolution.&#8221;&nbsp; <i>BYTE</i>, August 1991, p.
   131-38].&nbsp; The names for Splint naming conventions follow
   the tradition of using Central European nationalities as
   mnemonics for naming conventions.&nbsp; The Splint conventions
   are similar to the Hungarian naming convention in that they
   encode type information in names, except that the Splint
   conventions encode the names of accessible abstract
   types&nbsp;instead of the type of the declaration of return
   value.&nbsp; Prefixes used in the Hungarian naming convention
   are not supported by Splint.</p>
<p class="MsoFootnoteText">&nbsp;</p></div>
<div id="ftn18">
<p class="MsoFootnoteText"><a href="#_ftnref18" name="_ftn18"
   title=""><span class="MsoFootnoteReference"><span class=
   "MsoFootnoteReference"><span style=
   'font-size:10.0pt;font-family:"Times New Roman"'>[18]</span></span></span></a>
   Of course, namespace prefixes should really be described by
   regular expressions.&nbsp; If there is sufficient interest (that
   is, someone volunteers to program it), regular expressions will
   be supported in a future version of Splint.</p></div>
<div id="ftn19">
<p class="MsoFootnoteText"><a href="#_ftnref19" name="_ftn19"
   title=""><span class="MsoFootnoteReference"><span class=
   "MsoFootnoteReference"><span style=
   'font-size:10.0pt;font-family:"Times New Roman"'>[19]</span></span></span></a>
   POSIX library was contributed by Jens
   Schweikhardt.</p></div></div>
<!--#include virtual="footer.html"-->
</body>
</html>