Splint (programming tool)

For other uses, see Splint.

Splint

Developer(s)	The Splint Developers
Stable release	3.1.2 / July 12, 2007
Operating system	Cross-platform
Type	Static code analysis
License	GPL
Website	splint.org

Splint, short for Secure Programming Lint, is a programming tool for statically checking C programs for security vulnerabilities and coding mistakes. Formerly called LCLint, it is a modern version of the Unix lint tool.

Splint has the ability to interpret special annotations to the source code, which gives it stronger checking than is possible just by looking at the source alone.

Splint is free software released under the terms of the GNU General Public License.

Recent development activity on Splint has slowed significantly. According to the CVS at SourceForge, as of January 2009 the most recent change in the repository was in August 2008. The whole year 2008 had only two write accesses to the repository. The maintainer has said that development is stagnant and the project needs new volunteers.

On the Splint homepage, the latest release is version 3.1.2 on July 12, 2007.

Example

#include <stdio.h>
int main ()
{
  char c;
  while (c != 'x');
  {
    c = getchar ();
    if (c = 'x') return 0;
    switch (c)
      {
      case '\n':
      case '\r':
        printf ("Newline\n");
      default:
        printf ("%c",c);
      }
  }
  return 0;
}

Splint's output:

Variable c used before definition
Suspected infinite loop.  No value used in loop test (c) is
Assignment of int to char: c = getchar()
Test expression for if is assignment expression: c = 'x'
Test expression for if not boolean, type char: c = 'x'
Fall through case (no preceding break)

Fixed source:

#include <stdio.h>

int main(void)
{
  int c;

  while (c = getchar(), c != EOF && c != 'x')
  {
    switch (c)
      {
      case '\n':
      case '\r':
        printf ("Newline\n");
        break;
      default:
        printf ("%c",c);
      }
  }
  return 0;
}

See also

• Buffer overflow
• Memory debugger
• Software testing
• List of tools for static code analysis

External links

• Home page
• Publications about checking techniques
• SourceForge project page
• splint-discuss mailing list archive