First, a "Dank u wel!" to mailto://Arjan M Van Vught <[EMAIL PROTECTED]>
for a ~/.splintrc to work with VC++6.00. I shall try his work.

Now my problem. I have the following scenario.

C:\ftm\fromaix.6\src\c\libs> type t.c
#include <time.h> /* For strftime */
typedef char date_now_t[7+1]; /* YYYYDDD */
/*@dependent@*/ static const char *
fdate_now(/*@out@*/ /*@notnull@*/ date_now_t string, time_t const timenow)
     struct tm *l = localtime(&timenow);
     (void)strftime(string, 7+1, "%Y%j", l);
     return string;

#include <stdio.h>

void call(void) {
     date_now_t date_space;
     (void)puts(fdate_now(date_space, time(NULL)));

C:\ftm\fromaix.6\src\c\libs> splint -fixedformalarray t.c
Splint --- 11 Feb 2002

t.c: (in function fdate_now)
t.c(7,41): Possibly null storage l passed as non-null param: strftime (..., l)
   A possibly null pointer is passed as a parameter corresponding to a formal
   parameter with no /*@null@*/ annotation.  If NULL may be used for this
   parameter, add a /*@null@*/ annotation to the function parameter declaration.
   (Use -nullpass to inhibit warning)
    t.c(6,20): Storage l may become null

Finished checking --- 1 code warning


The first problem I have is with the need for the -fixedformalarray 
filter. I understand that C degrades a "char foo[8]" parameter to
"char *foo". I am trying to communicate that any call of "fdate_now" has
"string" passed as a set of 8 bytes.
Am I wrong to be surprised the following gives no buffer overflow 
message: "char foo[1]; foo[1] = 'b';"

The second problem is the message I am invited to suppress.
After I started writing this, I suppressed it with code like
if (l) strftime(string,, 7+1, "%Y%j", l) else strcpy(string, "YYYYDDD");

I then moved on and hit another point involving localtime().
It does not have an error interface specified in either C89 or
IEEE 1003-2001. I infer the same applies in C99.
I quote from IEEE 2001.
 > 23037 The localtime() function shall return a pointer to the broken-
 > down time structure.
 > 23040 ERRORS
 > 23041 No errors are defined.

splint allows localtime() to return NULL on failure. I think it should 
not. I changed lib/standard.h, rebuilt *.lcd and migrated them to the 
PC. (I had already reported a segmentation fault on the PC to 

Should splint not report unreachable code with constructs like:
"if (0) return 0; else return 1;"
It does with "return 0; return 1;" which gives "This code will never be 
reached on any possible execution. (Use -unreachable to inhibit 

I am sorry this became so complicated. I hope it sorts itself out!
Walter Briscoe

Reply via email to