is a tool for statically checking C programs for security
vulnerabilities and common programming mistakes. With minimal effort,
Splint can be used as a better lint(1).If additional effort is invested
adding annotations to programs, Splint can perform stronger checks than
can be done by any standard lint. For full documentation, please see
http://www.splint.org. This man page only covers a few of the available
These flags control directories and files used by Splint. They may be used from the
command line or in an options file, but may not be used as control comments in the
source code. Except where noted. they have the same meaning preceded by - or +.
Set directories for system files (default is "/usr/include"). Separate directories with colons (e.g.,
"/usr/include:/usr/local/lib"). Flag settings propagate to files in a system directory. If
-systemdirerrors is set, no errors are reported for files in system directories.
These flags are used to define or undefine pre-processor constants.
The -I<directory> flag is also passed to the C pre-processor.
Load state from <file> (created by -dump). The default extension .lcd is added if <file> has no
extension. Only one library file may be loaded.
By default, the standard library is loaded if the -load flag is not used to load a user library. If no user library is
loaded, one of the following flags may be used to select a different standard library. Precede the flag by + to
load the described library (or prevent a library from being loaded using nolib). See Apppendix F for
information on the provided libraries.
Use the strict version of the UNIX standard library.
These flags control what additional information is printed by Splint. Setting +<flag> causes the described
information to be printed; setting -<flag> prevents it. By default, all these flags are off.
Show a summary of all errors reported and suppressed. Counts of suppressed errors are not
necessarily correct since turning a flag off may prevent some checking from being done to save
computation, and errors that are not reported may propagate differently from when they are
At most <number> similar errors are reported consecutively. Further errors are suppressed, and a
message showing the number of suppressed messages is printed.
Normally, Splint will expect to report no errors. The exit status will be success (0) if no errors are reported,
and failure if any errors are reported. Flags can be used to set the expected number of reported errors.
Because of the provided error suppression mechanisms, these options should probably not be used for final
checking real programs but may be useful in developing programs using make.
These flags control how messages are printed. They may be set at the command line, in options files, or
locally in syntactic comments. The linelen and limit flags may be preceded by + or - with the same meaning;
for the other flags, + turns on the describe printing and - turns it off. The box to the left of each flag gives its
Set length of maximum message line to <number> characters. Splint will split messages longer
than <number> characters long into multiple lines. Default: 80
Mode selects flags set the mode checking flags to predefined values. They provide a quick coarse-grain way
of controlling what classes of errors are reported. Specific checking flags may be set after a mode flag to
override the mode settings. Mode flags may be used locally, however the mode settings will override specific
command line flag settings. A warning is produced if a mode flag is used after a mode checking flag has been
These are brief descriptions to give a general idea of what each mode does. To see the complete flag settings
in each mode, use splint -help modes. A mode flag has the same effect when used with either + or -.
Weak checking, intended for typical unannotated C code. No modifies checking, macro checking,
rep exposure, or clean interface checking is done. Return values of type int may be ignored. The
types bool, int, char and user-defined enum types are all equivalent. Old style declarations are
The default mode. All checking done by weak, plus modifies checking, global alias checking, use all
parameters, using released storage, ignored return values or any type, macro checking,
unreachable code, infinite loops, and fall-through cases. The types bool, int and char are distinct.
Old style declarations are reported.
Absurdly strict checking. All checking done by checks, plus modifications and global variables
used in unspecified functions, strict standard library, and strict typing of C operators. A special
reward will be presented to the first person to produce a real program that produces no errors with