Man Page lint.1
NAME
lint - a C program checker
SYNOPSIS
lint [-#] [-###] [-a] [-b] [-Cfilename] [-c] [-dirout=dir]
[-err=warn] [-errchk=l] [-errfmt=f] [-errhdr=h]
[-erroff=t] [-errtags=a] [-errwarn=t] [-F] [-fd]
[-flagsrc=file] [-h] [-Idir] [-k] [-Ldir] [-lx] [-m]
[-Ncheck=c] [-Nlevel=n] [-n] [-ox] [-p] [-Rfile] [-s]
[-u] [-V] [-v] [-Wfile] [-Xarch=v9] [-Xalias_level[=l]]
[-XCC=a] [-Xexplicitpar=a] [-Xkeeptmp=a] [-Xtemp=dir]
[-Xtime=a] [-Xtransition=a] [-x] [-y] files
DESCRIPTION
lint detects features of C program files which are likely to
be bugs, non-portable, or wasteful.
lint also checks type usage more strictly than the compiler.
lint issues error and warning messages. Among the things it
detects are:
o Unreachable statements
o Loops not entered at the top
o Automatic variables declared and not used
o Logical expressions whose value is constant.
lint checks for functions that return values in some places
and not in others, functions called with varying numbers or
types of arguments, and functions whose values are not used
or whose values are used but none returned.
lint can operate in two modes: basic, which is the default
for the lint program, and enhanced, which includes every-
thing done by basic lint, plus provides additional, detailed
analysis of code.
In enhanced mode, the analysis includes:
o Structure and flow analysis of source program
o Constant propagations and constant expression evalua-
tions
o Analysis of control flow and data flow
o Analysis of data types usages
Thus, lint can detect the following problems in enhanced
mode:
o Unused #include directives, variables, and procedures
o Memory usage after its deallocation
o Unused assignments
o Usage of a variable value before its initialization
o Deallocation of non-allocated memory
o Usage of pointers when writing in constant data segment
o Non-equivalent macro redefinitions
o Unreached code
o Nonconformity of the usages of value types in unions
o Implicit casts of actual arguments.
The enhanced mode is enabled by the -Nlevel or -Ncheck
options (see descriptions below).
Arguments whose names end with .c are taken to be C source
files; arguments ending in .i are taken to be preprocessor
output files (produced with the -P option to the compiler).
Arguments whose names end with .ln are taken to be the
result of an earlier invocation of lint with either the -C,
-c, or the -o option used. The .ln files are analogous to .o
(object) files that are produced by the cc(1) command when
given a .c file as input. Files with other suffixes are
warned about and ignored.
In enhanced mode, lint produces .ln files which store addi-
tional information than .ln files produced in basic mode. In
enhanced mode, lint can read and understand all .ln files
generated by either basic or enhanced lint modes. In basic
mode, lint can read and understand .ln files generated only
using basic lint mode.
lint takes all the .c, .i, .ln, and llib-lx.ln (specified by
-lx) files and processes them in their command-line order.
By default, lint appends the standard C lint library (llib-
lc.ln) to the end of the list of files. When the -C or -c
option is used, the .ln and the llib-lx.ln files are
ignored. When the -C or -c option is not used, the second
pass of lint checks the .ln and the llib-lx.ln list of files
for mutual compatibility.
Any number of lint options may be used, in any order, inter-
mixed with file-name arguments. The lint options are:
-# Show each component as it is invoked (verbose mode).
-### Show each component as it is invoked, but, unlike the
-# option, do not actually execute.
-a Suppress complaints about assignments of long values to
variables that are not long.
-b Suppress complaints about break statements that cannot
be reached.
-Cfilename
Produce a .ln file with the file name specified by
filename . These .ln files are the product of lint's
first pass only. filename can be a complete path name.
-c Cause lint to produce a .ln file for every .c file on
the command line. These .ln files are the product of
lint's first pass only, and are not checked for inter-
function compatibility.
-dirout=dir
Set a directory name where all lint output files be
will be placed. This option affects the -c option.
-err=warn
This is a macro for -errwarn=%all.
-errchk=l
Check structural arguments passed by value; Check por-
tability to environment for which the size of long
integers and pointers is 64 bits.
l is a comma-separated list of checks that consists
of one or more of the following:
locfmtchk
Use this option when you want lint to check
printf-like format strings during its first
pass. Regardless of whether or not you use
-errchk=locfmtchk, lint always checks for
printf-like format strings in its second pass.
parentheses
Use this option to enhance the maintainability
of code. If -errchk=parentheses returns a warn-
ing, consider using additional parentheses to
clearly signify the precedence of operations
within the code.
signext This option produces error messages when the
normal ANSI/ISO C value-preserving rules allow
the extension of the sign of a signed-integral
value in an expression of unsigned-integral
type. This option only produces error messages
when you specify -errchk=longptr64 as well.
sizematch
Warn when a larger integer is assigned to a
smaller integer. These warnings will also be
issued for assignment between same size
integers which differ in signedness; for exam-
ple, unsigned int = signed int.
structarg
Check structural arguments passed by value and
report the cases when formal parameter type is
not known.
longptr64
Check portability to environment for which the
size of long integers and pointers is 64 bits
and the size of plain integers is 32 bits.
Check assignments of pointer expressions and
long integer expressions to plain integers,
even when explicit cast is used.
%all Perform all of errchk's checks.
%none Perform none of errchk's checks. This is the
default.
no%structarg
Perform none of errchk's structarg checks.
no%longptr64
Perform none of errchk's longptr64 checks.
The values may be a comma separated list, for
example, -errchk=longptr64,structarg.
The default is -errchk=%none. Specifying -
errchk is equivalent to specifying -
errchk=%all.
-errfmt=f
Specify the format of lint output. f can be one of the
following: macro, simple, src, or tab.
The -errfmt values are:
macro Display the source code, the line number, and
the place of the error, with macro unfolding.
simple Display the line number and the place number,
in brackets, of the error, for one-line (sim-
ple) diagnostic messages. Similar to the -s
option, but includes error-position informa-
tion.
src Display the source code, the line number, and
the place of the error (no macro unfolding).
tab Display in tabular format.
The default is -errfmt = tab . Specifying -errfmt is
equivalent to specifying -errfmt = tab.
If more than one format is specified, the last format
specified is used, and lint warns about the unused for-
mats.
-errhdr=h
Enables the reporting of certain messages for header
files when used with -Ncheck. h is a comma-separated
list that consists of one or more of the following:
dir, no%dir, %all, %none, %user.
The -errhdr values are:
dir Check header files used in directory dir.
no%dir Do not check header files used in the directory
dir.
%all Check all used header files.
%none Do not check header files. This is the default.
%user Check all used user header files, that is, all
header files except those in /usr/include and
its subdirectories, as well as those supplied
by the compiler.
The default is -errhdr=%none. Specifying -errhdr is
equivalent to specifying -errhdr=%user.
-erroff=t
Suppress or enable lint error messages. t is a comma-
separated list that consists of one or more of the fol-
lowing: tag, no%tag, %all, %none.
The -erroff values are:
tag Suppress the message specified by this tag.
no%tag Enable the message specified by this tag.
%all Suppress all messages.
%none Enable all messages. This is the default.
The default is -erroff=%none. Specifying -erroff is
equivalent to specifying -erroff=%all.
-errtags=a
Displays the message tag for each error message. a can
be either yes or no. The default is -errtags=no. Speci-
fying -errtags is equivalent to -errtags=yes.
Works with all -errfmt options.
-errwarn=t
If the indicated warning message is issued, lint exits
with a failure status. t is a comma-separated list that
consists of one or more of the following:
tag Cause lint to exit with a fatal status if the
message specified by tag is issued as a warn-
ing message. Has no effect if tag in not
issued.
no%tag Prevent lint from exiting with a fatal status
if the message specified by tag is issued only
as a warning message. Has no effect if tag is
not issued. Use this option to revert a warn-
ing message that was previously specified by
this option with tag or %all from causing lint
to exit with a fatal status when issued as a
warning message.
%all Cause lint to exit with a fatal status if any
warning messages are issued. %all can be fol-
lowed by no%tag to exempt specific warning
messages from this behavior.
%none Prevents any warning messages from causing
lint to exit with a fatal status should any
warning tag be issued. This is the default.
-F Print path names of files. lint normally prints the
file name without the path.
-fd Report about old-style function definitions and
declarations.
-flagsrc=file
Execute lint with options contained in the file file.
Multiple options can be specified in file, one per
line.
-h Do not apply heuristic tests that attempt to intuit
bugs, improve style, and reduce waste.
-Idir
Search for included header files in the directory dir
before searching the current directory and/or the stan-
dard place.
-k Alter the behavior of /*LINTED [message]*/ directives
or NOTE(LINTED(message)) annotations. Normally, lint
suppresses warning messages for the code following
these directives. Instead of suppressing the messages,
lint prints an additional message containing the com-
ment inside the directive or annotation.
-Ldir
Search for lint libraries in dir before searching the
standard place.
-lx Include the lint library llib-lx.ln. For example, you
can include a lint version of the math library llib-
lm.ln by inserting -lm on the command line. This argu-
ment does not suppress the default use of llib-lc.ln.
These lint libraries must be in the assumed directory.
This option can be used to reference local lint
libraries and is useful in the development of multi-
file projects.
-m Suppress complaints about external symbols that could
be declared static.
-Ncheck=c
Check header files for corresponding declarations;
check macros. c is a comma-separated list of checks
that consists of one or more of the following:
macro Check for consistency of macro definitions
across files.
extern Check for one-to-one correspondence of declara-
tions between source files and their associated
header files (for example, for file1.c and
file1.h). Ensure that there are neither
extraneous nor missing extern declarations in a
header file.
%all Perform all of
Ncheck's checks.
%none Perform none of
Ncheck's checks. This is the default.
no%macro
Perform none of Ncheck's macro checks.
no%extern
Perform none of Ncheck's extern checks.
The values may be combined with a comma, for example,
-Ncheck=extern,macro.
The default is -Ncheck=%none. Specifying -Ncheck is
equivalent to specifying -Ncheck=%all.
-Nlevel=n
Specify the level of analysis for reporting problems.
This option allows you to control the amount of
detected errors. The higher the level, the longer the
verification time. n is a number: 1, 2, 3, or 4.
-Nlevel=1 Analyze single procedures. Report uncondi-
tional errors that occur on some program execution
paths. Does not do global data and control flow
analysis.
-Nlevel=2 The default. Analyze the whole program,
including global data and control flow. Report uncondi-
tional errors that occur on some program execution
paths.
-Nlevel=3 Analyze the whole program, including constant
propagation, cases when constants are used as actual
arguments, as well as the analysis performed under
-Nlevel=2.
-Nlevel=4 Analyze the whole program, and report condi-
tional errors that could occur when certain program
execution paths are used, as well as the analysis per-
formed under -Nlevel=3.
At this level, there are additional diagnostic mes-
sages. The analysis algorithm generally corresponds to
the analysis algorithm of -Nlevel=3 with the exception
that any invalid values now generate an error message.
The amount of time required for analysis at this level
can increase as much as two orders (about 20 to 100
times more slowly). In this case, the extra time
required is directly proportional to the program com-
plexity as characterised by recursion, conditional
statements etc. As a result of this, it may be diffi-
cult to use this level of analysis for a program that
exceeds 100,000 lines.
-n Do not check compatibility against the standard C lint
library.
-ox Cause lint to create a lint library with the name
llib-lx.ln. This library is created from all the .ln
files that lint used in its second pass. The -c option
nullifies any use of the -o option. To produce a
llib-lx.ln without extraneous messages, you can use the
-x option. The -v option is useful if the source
file(s) for the lint library are just external inter-
faces. The lint library produced can be used later if
lint is invoked with the -lx option.
By default, you create libraries in lint's basic for-
mat. If you use lint's enhanced mode, the library
created will be in enhanced format, and can only be
used in enhanced mode.
-p Attempt to check portability to other dialects of C.
Along with stricter checking, this option causes all
non-external names to be truncated to eight characters
and all external names to be truncated to six charac-
ters and one case.
-Rfile
Write a .ln file to file, for use by cxref(1). This
option disables the enhanced mode, if it is switched
on.
-s Produce one-line diagnostics only. lint occasionally
buffers messages to produce a compound report.
-u Suppress complaints about functions and external vari-
ables used and not defined, or defined and not used.
This option is suitable for running lint on a subset of
files of a larger program.
-V Write to standard error the product name and release.
-v Suppress complaints about unused arguments in func-
tions.
-Wfile
Write a .ln file to file, for use by cflow(1). This
option disables the enhanced mode, if it is switched
on.
-Xalias_level[=l]
where l is one of any, basic, weak, layout, strict,
std, or strong. See the C User's Guide for more infor-
mation.
If you do not specify -Xalias_level, the default of the
flag is -Xalias_level=any. This means that there is no
type-based alias-analysis. If you specify -Xalias_level
but do not supply a level, the default is
-Xalias_level=layout.
Be sure to run lint at a level of disambiguation that
is no more strict than the level at which you ran the
compiler. If you run lint at a level of disambiguation
that is more strict than the level at which you com-
piled, the results will be difficult to interpret and
possibly misleading.
-Xarch=v9
Predefines the __sparcv9 macro and searches for v9 ver-
sions of lint libraries.
-XCC=a
Accept C++-style comments. a can be either yes or no.
In particular, // can be used to indicate the start of
a comment. The default is -XCC=no; specifying -XCC is
equivalent to specifying -XCC=yes.
-Xexplicitpar=a
(SPARC) Directs lint to recognize #pragma MP direc-
tives. a can be either yes or no. The default is
-Xexplicitpar=no; specifying -Xexplicitpar is
equivalent to specifying -Xexplicitpar=yes.
-Xkeeptmp=a
Keep temporary files created during linting instead of
deleting them automatically. a can be either yes or no.
The default is -Xkeeptmp=no; specifying -Xkeeptmp is
equivalent to specifying -Xkeeptmp=yes.
-Xtemp=dir
Set the directory for temporary files to dir. Without
this option, temporary files go into /tmp.
-Xtime=a
Report the execution time for each lint pass. a can be
either yes or no. The default is -Xtime=no; specifying
-Xtime is equivalent to specifying -Xtime=yes.
-Xtransition=a
Issue warnings for the differences between K&R C and
Sun ANSI C. a can be either yes or no. The default is
-Xtransition=no; specifying -Xtransition is equivalent
to specifying -Xtransition=yes.
-x Do not report variables referred to by external
declarations but never used.
-y Specify that the file being linted be treated as if the
/*LINTLIBRARY*/ directive or the NOTE(LINTLIBRARY)
annotation had been used. A lint library is normally
created by using the /*LINTLIBRARY*/ directive or the
NOTE(LINTLIBRARY) annotation.
lint recognizes many cc (1) command-line options, including
-A, -D, -E, -g, -H, -O, -P, -U, -Xa, -Xc, -Xs, -Xt , and
-Y , although -g and -O are ignored. Unrecognized options
are warned about and ignored. The predefined macro lint is
defined to allow certain questionable code to be altered or
removed for lint. Thus, the symbol lint should be thought
of as a reserved word for all code that is planned to be
checked by lint.
lint provides the following predefinition predicate by
default (not valid in -Xc mode):
#assert lint (on)
Predefinitions, not valid in -Xc mode:
sun
lint
unix
sparc (SPARC only)
i386 (x86 only)
These predefinitions are valid in all modes:
__sparc (SPARC)
__i386 (x86)
__unix
__sun
__lint
__`uname -s` `_uname -r` (example: __SunOS_5_7)
__SVR4
__BUILTIN_VA_ARG_INCR
__SUNPRO_C=0x530
__RESTRICT (-Xa and -Xt modes only)
__sparcv9 (-Xarch=v9)
Certain conventional comments in the C source change the
behavior of lint:
/*ARGSUSEDn*/
makes lint check only the first n arguments for
usage; a missing n is taken to be 0 (this direc-
tive acts like the -v option for the next func-
tion).
/*CONSTCOND*/ or /*CONSTANTCONDITION*/
suppresses complaints about constant operands for
the conditional expression.
/*EMPTY*/
suppresses complaints about a null statement con-
sequent on an if statement. This directive should
be placed after the test expression, and before
the semicolon. This directive is supplied to sup-
port empty if statements when a valid else state-
ment follows. It suppresses messages on an empty
else consequent.
/*FALLTHRU*/ or /*FALLTHROUGH*/
suppresses complaints about fall through to a case
or default labelled statement. This directive
should be placed immediately preceding the label.
/*LINTED [message]*/
suppresses any intra-file warning except those
dealing with unused variables or functions. This
directive should be placed on the line immediately
preceding where the lint warning occurred. The -k
option alters the way in which lint handles this
directive. Instead of suppressing messages, lint
prints an additional message, if any, contained in
the comment. This directive is useful in conjunc-
tion with the -s option for post-lint filtering.
/*LINTLIBRARY*/
when -o is invoked, writes to a library .ln file
only definitions in the .c file it heads. This
directive suppresses complaints about unused func-
tions and function arguments in this file.
/*NOTREACHED*/
at appropriate points stops comments about
unreachable code. [This comment is typically
placed just after calls to functions like
exit(2)].
/*PRINTFLIKEn*/
makes lint check the first (n-1) arguments as
usual. The nth argument is interpreted as a
printf format string that is used to check the
remaining arguments.
/*PROTOLIBn*/
causes lint to treat function declaration proto-
types as function definitions if n is non-zero.
This directive can only be used in conjunction
with the /* LINTLIBRARY */ directive. If n is
zero, function prototypes are treated normally.
/*SCANFLIKEn*/
makes lint check the first (n-1) arguments as
usual. The nth argument is interpreted as a scanf
format string that is used to check the remaining
arguments.
/*VARARGSn*/
suppresses the usual checking for variable numbers
of arguments in the following function declara-
tion. The data types of the first n arguments are
checked; a missing n is taken to be 0. The use of
the ellipsis terminator (...) in the definition is
suggested in new or updated code.
lint directives can also be specified in the form of source
code annotations, by including the file note.h, for example:
#include <note.h>.
NOTE(ARGSUSED(n))
NOTE(CONSTANTCONDITION)
NOTE(EMPTY)
NOTE(FALLTHROUGH)
NOTE(LINTLIBRARY)
NOTE(LINTED(message))
NOTE(NOTREACHED)
NOTE(PRINTFLIKE(n))
NOTE(PRINTFLIKE(func_name,n))
NOTE(PROTOLIB(n))
NOTE(SCANFLIKE(n))
NOTE(SCANFLIKE(func_name,n))
NOTE(VARARGS(n))
NOTE(VARARGS(func_name,n))
The following two directives can be used only as annota-
tions:
NOTE(ALIGNMENT(func_name,n))
where n=1,2,4,8,16,32,64,128;
makes lint set following function result alignment in
n bytes. For example, malloc() is defined as returning
a char* or void* when in fact it really returns
pointers that are word (or even doubleword) aligned.
NOTE(ARGUNUSED(par_name[,par_name...]))
makes lint not check the mentioned arguments for usage
(this option acts only for the next function).
lint can, with certain options, show precise source file
lines with pointers to the line position where the error
occurred. The option enabling this feature is
-errfmt=[macro|simple|src|tab]. Under this option, lint pro-
vides the following information:
o Source line(s) and position(s)
o Macro unfolding
o Error-prone stack(s)
lint produces its first output on a per-source-file basis.
Complaints regarding included files are collected and
printed after all source files have been processed, if -s is
not specified. Finally, if the -C or -c option is not used,
information gathered from all input files is collected and
checked for consistency. At this point, if it is not clear
whether a complaint stems from a given source file or from
one of its included files, the source filename is printed
followed by a question mark.
The behavior of the -C, -c, and the -o options allows for
incremental use of lint on a set of C source files. Gen-
erally, one invokes lint once for each source file with the
-C or -c option. Each of these invocations produces a .ln
file that corresponds to the .c file, and prints all mes-
sages that are about just that source file. After all the
source files have been separately run through lint, it is
invoked once more (without the -C or -c option), listing all
the .ln files with the needed -lx options. This prints all
the inter-file inconsistencies. This scheme works well with
make; it allows make to be used to lint only the source
files that have been modified since the last time the set of
source files were linted.
ENVIRONMENT
TMPDIR usually /tmp but can be redefined by
setting the environment variable
TMPDIR [see tempnam in tmpnam(3S)].
NOTEPATH Colon separated paths of directories
containing note definition files
(see C User's Guide)
FILES
lint[12] first and second passes
lint2n enhanced second pass
llib-lc.ln declarations for C Library functions
(binary format)
TMPDIR/*lint* temporaries
SEE ALSO
cc(1), make(1s), cflow(1), cxref(1).
See the lint chapter in the C User's Guide.