Splint (programming tool)

Splint
Developer(s) The Splint Developers
Stable release
3.1.2 / July 12, 2007 (2007-07-12)
Operating system Cross-platform
Type Static code analysis
License GPL
Website splint.org

Splint, short for Secure Programming Lint, is a programming tool for statically checking C programs for security vulnerabilities and coding mistakes. Formerly called LCLint, it is a modern version of the Unix lint tool.

Splint has the ability to interpret special annotations to the source code, which gives it stronger checking than is possible just by looking at the source alone. Splint is used by gpsd as part of an effort to design for zero defects.[1]

Splint is free software released under the terms of the GNU General Public License.

Recent development activity on Splint has slowed significantly. According to the CVS at SourceForge, as of September 2012 the most recent change in the repository was in November 2010.[2] The maintainer has said that development is stagnant and the project needs new volunteers.[3]

Example

#include <stdio.h>
int main()
{
    char c;
    while (c != 'x');
    {
        c = getchar();
        if (c = 'x')
            return 0;
        switch (c) {
        case '\n':
        case '\r':
            printf("Newline\n");
        default:
            printf("%c",c);
        }
    }
    return 0;
}

Splint's output:


Variable c used before definition
Suspected infinite loop. No value used in loop test (c) is modified by test or loop body.
Assignment of int to char: c = getchar()
Test expression for if is assignment expression: c = 'x'
Test expression for if not boolean, type char: c = 'x'
Fall through case (no preceding break)

Fixed source:

#include <stdio.h>
int main()
{
    int c = 0;  // Added an initial assignment definition.

    while (c != 'x') {
        c = getchar();  // Corrected type of c to int
        if (c == 'x') // Fixed the assignment error to make it a comparison operator.
            return 0;
        switch (c) {
        case '\n':
        case '\r':
            printf("Newline\n");
            break;  // Added break statement to prevent fall-through.
        default:
            printf("%c",c);
            break;  //Added break statement to default catch, out of good practice.
        }
    }
    return 0;
}

See also

References

  1. Raymond (2012). Brown, Amy; Wison, Greg, eds. The Architecture of Open Source Applications, Volume II (Eric ed.). Lulu. ISBN 9781105571817.
  2. "Splint project CVS statistics". Retrieved 2012-09-11.
  3. "splint-discuss: Moving to Google Code".


This article is issued from Wikipedia - version of the 8/10/2016. The text is available under the Creative Commons Attribution/Share Alike but additional terms may apply for the media files.