.\" $NetBSD: lint.1,v 1.64 2023/08/26 10:43:53 rillig Exp $
.\"
.\" Copyright (c) 1996 Christopher G. Demetriou.  All Rights Reserved.
.\" Copyright (c) 1994, 1995 Jochen Pohl
.\" All Rights Reserved.
.\"
.\" Redistribution and use in source and binary forms, with or without
.\" modification, are permitted provided that the following conditions
.\" are met:
.\" 1. Redistributions of source code must retain the above copyright
.\"    notice, this list of conditions and the following disclaimer.
.\" 2. Redistributions in binary form must reproduce the above copyright
.\"    notice, this list of conditions and the following disclaimer in the
.\"    documentation and/or other materials provided with the distribution.
.\" 3. All advertising materials mentioning features or use of this software
.\"    must display the following acknowledgement:
.\"      This product includes software developed by Jochen Pohl for
.\"      The NetBSD Project.
.\" 4. The name of the author may not be used to endorse or promote products
.\"    derived from this software without specific prior written permission.
.\"
.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
.Dd August 2, 2023
.Dt LINT 1
.Os
.Sh NAME
.Nm lint
.Nd a C program verifier
.Sh SYNOPSIS
.Nm
.Op Fl abceFgHhPprTVvwxz
.Op Fl i | Fl nu
.Op Fl S | Fl s | Fl t | Fl Ac11 | Fl Ac23
.Op Fl B Ar directory
.Op Fl D Ar name Ns Op =def
.Op Fl d Ar directory
.Op Fl I Ar directory
.Op Fl L Ar directory
.Op Fl MD
.Op Fl l Ar library
.Op Fl o Ar outputfile
.Op Fl q Ar id Ns Oo Ic , Ns Ar id Oc Ns ...
.Op Fl U Ar name
.Op Fl W Ar cppwarnarg
.Op Fl X Ar id Ns Oo Ic , Ns Ar id Oc Ns ...
.Op Fl Z Ar cpparg
.Ar
.Nm lint
.Op Fl abceFgHhprTVvwz
.Op Fl S | Fl s | Fl t | Fl Ac11 | Fl Ac23
.Fl C Ar library
.Op Fl B Ar directory
.Op Fl D Ar name Ns Op =def
.Op Fl d Ar directory
.Op Fl I Ar directory
.Op Fl MD
.Op Fl R Ar old=new
.Op Fl U Ar name
.Op Fl W Ar cppwarnarg
.Op Fl X Ar id Ns Oo Ic , Ns Ar id Oc Ns ...
.Op Fl Z Ar cpparg
.Ar
.Sh DESCRIPTION
.Nm
attempts to detect features of the named C program files
that are likely to be bugs, to be non-portable, or to be
wasteful.
It also performs stricter type checking than traditional pre-C90 C compilers.
The list of errors and warnings that
.Nm
produces are enumerated in
.Xr lint 7 .
.Pp
In the first synopsis form,
.Nm
checks each given file as a separate translation unit.
In the second synopsis form,
.Nm
cross-checks the results of the first synopsis form for inconsistencies
between translation units.
.Pp
.Nm
runs the C preprocessor as its first phase, with the
following preprocessor symbols
defined to allow certain questionable code to be altered
or skipped:
.Sy __LINT__ ,
.Sy lint ,
.Sy __lint ,
.Sy __lint__ .
These symbols should therefore be thought of as reserved
words for all code that is to be checked by
.Nm .
.Pp
Among the possible problems that are currently noted are
unreachable statements, loops not entered at the top,
variables declared and not used, and logical expressions
with constant values.
Function calls are checked for
inconsistencies, such as calls to functions that return
values in some places and not in others, non-prototype functions called
with varying numbers of arguments, non-prototype function calls that
pass arguments of a type other than the type the function
expects to receive, functions whose return values are not used,
and calls to non-prototype functions not returning values that nevertheless use
the non-existent return value of the function.
.Pp
Filename arguments ending with
.Pa \&.c
are taken to be C source files.
Filename arguments with names ending with
.Pa \&.ln
are taken to be the result of an earlier invocation of
.Nm ,
with either the
.Fl i ,
.Fl o
or
.Fl C
option in effect.
The
.Pa \&.ln
files are analogous to the
.Pa \&.o
(object) files produced by
.Xr cc 1
from
.Pa \&.c
files.
.Nm
also accepts special libraries specified with the
.Fl l
option, which contain definitions of library routines and
variables.
.Pp
.Nm
takes all the
.Pa \&.c , \&.ln ,
and
.Pa llib-l Ns Ar library Ns Pa \&.ln
(lint library) files and processes them in command-line order.
By default,
.Nm
appends the standard C lint library
.Pq Pa llib-lc.ln
to the end of the list of files.
When the
.Fl i
option is used, the
.Pa \&.ln
files are ignored.
Also, when the
.Fl o
or
.Fl i
options are used, the
.Pa llib-l Ns Ar library Ns Pa \&.ln
files are ignored.
When the
.Fl i
option is
.Em omitted ,
the second pass of
.Nm
checks this list of files for mutual compatibility
but always exits successfully.
At this point, if a complaint stems not from a given source file,
but from one of its included files, the source filename will be
printed followed by a question mark.
.Pp
.Sy Options
.Bl -tag -width XXoutputfile
.It Fl Ac11
Allow features from C11, C99 and C90.
.It Fl Ac23
Allow features from C23, C17, C11, C99 and C90.
.It Fl a
Report assignments of
.Sy long
values to variables that are not
.Sy long .
.It Fl aa
Additional to
.Fl a ,
report
.Em all
assignments of integer values to other integer values which
cause implicit narrowing conversion.
.It Fl B Ns Ar path
Path to use when looking for the lint1 and lint2 binaries.
Defaults to
.Pa /usr/libexec .
.It Fl b
Report
.Sy break
statements that cannot be reached.
This is not the default because, unfortunately, most
.Xr lex 1
and many
.Xr yacc 1
outputs produce many such complaints.
.It Fl C Ns Ar library
Create a
.Nm
library with the name
.Pa llib-l Ns Ar library Ns Pa .ln .
This library is built from all
.Pa \&.c
and
.Pa \&.ln
input files.
After all global definitions of functions and
variables in these files are written to the newly created library,
.Nm
checks all input files, including libraries specified with the
.Fl l
option, for mutual compatibility.
.It Fl c
Complain about casts which have questionable portability.
.It Fl D Ns Ar name Ns Op =def
Define
.Ar name
for
.Xr cpp 1 ,
as if by a
.Li #define
directive.
If no definition is given,
.Ar name
is defined as 1.
.It Fl d Ns Ar directory
Use
.Ar directory
as the root directory
.Pq Va DESTDIR
to find include files.
.It Fl e
Complain about unusual operations on
.Sy enum
types and combinations of
.Sy enum
and integer types.
.It Fl F
Print pathnames of files, not only the basenames.
.Nm
normally prints the filename without the path.
.It Fl g
Don't print warnings for some extensions of
.Xr gcc 1
to the C language.
Currently these are nonconstant initializers in automatic aggregate
initializations, arithmetic on pointer to void, trailing commas in
enum declarations, C++ -style
.Dq //
comments,
zero sized structures, subscripting of non-lvalue arrays, prototypes
overriding old-style function declarations and long long
integer types.
The
.Fl g
flag also turns on the keywords
.Sy asm
and
.Sy inline
(alternative keywords with leading underscores for both
.Sy asm
and
.Sy inline
are always available).
.It Fl H
If a complaint stems from an included file,
print the name of the included file instead of the source file name
followed by a question mark.
.It Fl h
Apply a number of heuristic tests to attempt to intuit
bugs, improve style, and reduce waste.
.It Fl I Ns Ar directory
Add
.Ar directory
to the list of directories in which to search for include files.
.It Fl i
Produce a
.Pa \&.ln
file for every
.Pa \&.c
file on the command line.
These
.Pa \&.ln
files are the product of
.Nm Ns 's
first pass only, and are not checked for compatibility
between functions.
.It Fl L Ns Ar directory
Search for lint libraries in
.Ar directory
and
.Ar directory Ns Pa /lint
before searching the standard place.
.It Fl l Ns Ar library
Include the lint library
.Pa llib-l Ns Ar library Ns Pa \&.ln .
.It Fl MD
Pass
.Fl MD
to
.Xr cpp 1 ,
causing cpp to create files containing dependency information for
each source file.
.It Fl n
Do not check compatibility against the standard library.
.It Fl o Ns Ar outputfile
Name the output file
.Ar outputfile .
The output file produced is the input that is given to
.Nm Ns 's
second pass.
The
.Fl o
option simply saves this file in the named output file.
If the
.Fl i
option is also used, the files are not checked for compatibility.
To produce a
.Pa llib-l Ns Ar library Ns Pa \&.ln
without extraneous messages, use of the
.Fl u
option is suggested.
The
.Fl v
option is useful if the source file(s) for the lint library
are just external interfaces.
.It Fl P
Enable more portability warnings: enum comparisons, sign extension issues
when assigning to wider integer types, overflow warnings when assigning
to wider types.
.It Fl p
Attempt to check portability of code to other platforms of C.
.It Fl q Ar id Ns Oo Ic , Ns Ar id Oc Ns ...
In addition to the usual warnings and errors, run the selected queries,
which are listed in
.Xr lint 7 Ns .
These queries are similar to warnings,
they do not highlight possible bugs though,
but instead point to other events in the code
that may be interesting to look at on a case-by-case basis.
The most convenient way to run queries on a source file is to run:
.Pp
.Dl make LINT=\*qlint \-q3,5,7\*q source.ln
.Pp
To allow this command to be run repeatedly, the option
.Fl q
prevents creating the .ln file.
.It Fl R Ar old=new
Remap
.Ar old
directory prefixes to
.Ar new
for reproducible builds.
.It Fl r
In case of redeclarations, report the position of the previous declaration.
.It Fl S
C99 mode.
Currently not fully implemented.
.It Fl s
Strict ISO C90 mode.
Issue warnings and errors required by ISO C90, as opposed to traditional C.
Also do not produce warnings for constructs which behave
differently in traditional C and ISO C90.
With the
.Fl s
flag,
.Li __STRICT_ANSI__
is a predefined preprocessor macro.
.It Fl T
Treat
.Sy _Bool
as a data type that is incompatible with all other scalar types.
.It Fl t
Traditional C mode.
.Li __STDC__
is not predefined in this mode.
Warnings are printed for constructs not allowed in traditional C.
Warnings for constructs which behave differently in traditional C
and C90 are suppressed.
Preprocessor macros describing the machine type (e.g.
.Li sun3 )
and machine architecture (e.g.
.Li m68k )
are defined without leading and trailing underscores.
The keywords
.Sy const ,
.Sy volatile
and
.Sy signed
are not available in traditional C mode (although the alternative
keywords with leading underscores still are).
.It Fl U Ns Ar name
Remove any initial definition of
.Ar name
for the preprocessor.
.It Fl u
Do not complain about functions and external variables used
and not defined, or defined and not used (this is suitable
for running
.Nm
on a subset of files comprising part of a larger program).
.It Fl V
Print the command lines constructed by the controller program to
run the C preprocessor and
.Nm Ns 's
first and second pass.
.It Fl v
Suppress complaints about unused parameters in functions.
.It Fl W Ar cppwarnarg
Pass the warning directive to
.Xr cpp 1 .
.It Fl w
Treat warnings as errors.
.It Fl X Ar id Ns Oo Ic , Ns Ar id Oc Ns ...
Suppress error messages identified by the list of ids.
A list of messages and ids can be found in
.Xr lint 7 .
.It Fl x
Report variables referred to by
.Sy extern
declarations, but never used.
.It Fl Z Ar cpparg
Pass
.Ar cpparg
to
.Xr cpp 1
directly.
Multiple
.Fl Z
.Ar cppargs
can be passed in the order they are received.
.It Fl z
Do not complain about structures that are never defined
(for example, using a structure pointer without knowing
its contents).
.El
.Pp
.Sy Input Grammar
.Pp
.Nm Ns 's
first pass reads standard C source files.
.Nm
recognizes the following C comments as commands.
.Bl -tag -width Fl
.It Li /* ARGSUSED Ns Ar n Li */
Makes
.Nm
check only the first
.Ar n
parameters for usage; a missing
.Ar n
is taken to be 0 (this option acts like the
.Fl v
option for the next function).
.It Li /* BITFIELDTYPE */
Suppress error messages about illegal bitfield types if the type
is an integer type, and suppress non-portable bitfield type warnings.
.It Li /* CONSTCOND */ No or Li /* CONSTANTCOND */ No or Li /* CONSTANTCONDITION */
Suppress complaints about constant operands for the next expression.
.It Li /* FALLTHRU */ No or Li /* FALLTHROUGH */
Suppress complaints about fall through to a
.Sy case
or
.Sy default
labeled statement.
This directive should be placed immediately preceding the label.
.It Li /* LINTLIBRARY */
At the beginning of a file, mark all functions and variables defined
in this file as
.Em used .
Also shut off complaints about unused function parameters.
.It Li /* LINTED Ns Ar n Oo Ar comment Oc Li */ No or Li /* NOSTRICT Ns Ar n Oo Ar comment Oc Li */
Suppresses any intra-file warning except those dealing with
unused variables or functions.
This directive should be placed
on the line immediately preceding where the lint warning occurred.
The optional numeric argument suppresses the specific numbered
message instead of every message.
A list of messages and ids can be found in
.Xr lint 7 .
.It Li /* LONGLONG */
Suppress complaints about use of long long integer types.
.It Li /* NOTREACHED */
At appropriate points, inhibit complaints about unreachable code.
(This comment is typically placed just after calls to functions
like
.Xr exit 3 ) .
.It Li /* PRINTFLIKE Ns Ar n Li */
Makes
.Nm
check the first
.Pq Ar n Ns No -1
arguments as usual.
The
.Ar n Ns No -th
argument is interpreted as a
.Sy printf
format string that is used to check the remaining arguments.
.It Li /* PROTOLIB Ns Ar n Li */
Causes
.Nm
to treat function declaration prototypes as function definitions
if
.Ar n
is non-zero.
This directive can only be used in conjunction with the
.Li /* LINTLIBRARY */
directive.
If
.Ar n
is zero, function prototypes will be treated normally.
.It Li /* SCANFLIKE Ns Ar n Li */
Makes
.Nm
check the first
.Pq Ar n Ns No -1
arguments as usual.
The
.Ar n Ns No -th
argument is interpreted as a
.Sy scanf
format string that is used to check the remaining arguments.
.It Li /* VARARGS Ns Ar n Li */
Suppress the usual checking for variable numbers of arguments in
the following function declaration.
The data types of the first
.Ar n
arguments are checked; a missing
.Ar n
is taken to be 0.
.El
.Pp
The behavior of the
.Fl i
and the
.Fl o
options allows for incremental use of
.Nm
on a set of C source files.
Generally, one invokes
.Nm
once for each source file with the
.Fl i
option.
Each of these invocations produces a
.Pa \&.ln
file that corresponds to the
.Pa \&.c
file, and prints all messages that are about just that
source file.
After all the source files have been separately run through
.Nm ,
it is invoked once more (without the
.Fl i
option), listing all the
.Pa \&.ln
files with the needed
.Fl l Ns Ar library
options.
This will print all the inter-file inconsistencies.
This scheme works well with
.Xr make 1 ;
it allows
.Xr make 1
to be used to
.Nm
only the source files that have been modified since the last
time the set of source files were
.Nm Ns No ed .
.Sh EXIT STATUS
.Ex -std lint
If the
.Fl w
flag is given, warnings are considered errors.
.Sh ENVIRONMENT
.Bl -tag -width Fl
.It Ev LIBDIR
The directory where the lint libraries specified by the
.Fl l Ns Ar library
option must exist.
If this environment variable is undefined, then the default path
.Pa /usr/libdata/lint
will be used to search for the libraries.
.It Ev LINT_KEEP_CPPOUT
If set to
.Sq Li yes ,
or if set to
.Sq Li on-error
and
.Nm
exits unsuccessfully, do no delete the output from the C preprocessor,
allowing for manual inspection.
.It Ev TMPDIR
Usually the path for temporary files can be redefined by setting
this environment variable.
.It Ev CC
Location of the C compiler program.
Defaults to
.Pa /usr/bin/cc .
.El
.Sh FILES
.Bl -tag -width /usr/libdata/lint/llib-lc.ln -compact
.It Pa /usr/libexec/lint Ns Bq 12
programs
.It Pa /usr/libdata/lint/llib-l*.ln
various prebuilt lint libraries
.It Pa /tmp/lint*
temporaries
.El
.Sh EXAMPLES
.Bl -tag
.It Li Nm Fl i Fl Sg Pa source.c
Run
.Nm
in C99 mode with GNU extensions,
with only few checks,
creating
.Pa source.ln .
.It Li Nm Fl i Fl abcFghprSxz Pa source.c
Run
.Nm
with the same checks as in the NetBSD build.
.It Li Nm Fl i Fl Ac11 Fl g Fl aabceFhpPrTxz Pa source.c
Run
.Nm
in C11 mode with GNU extensions,
enabling all available checks,
including lossy conversions on small integer types,
unusual operations on enum types,
more portability warnings,
and strict bool mode.
.El
.\" .Sh DIAGNOSTICS
.Sh SEE ALSO
.Xr cc 1 ,
.Xr cpp 1 ,
.Xr make 1 ,
.Xr lint 7
.\" .Sh STANDARDS
.\" .Sh HISTORY
.Sh AUTHORS
.An Jochen Pohl
(1995)
.An Roland Illig
(2021 to 2023)
.\" .Sh CAVEATS
.Sh BUGS
The routines
.Xr exit 3 ,
.Xr longjmp 3
and other functions that do not return are not understood; this
causes various incorrect diagnostics.
.Pp
Static functions which are used only before their first
extern declaration are reported as unused.
.Pp
Libraries created by the
.Fl o
option will, when used in later
.Nm
runs, cause certain errors that were reported when the libraries
were created to be reported again, and cause line numbers and file
names from the original source used to create those libraries
to be reported in error messages.
For these reasons, it is recommended to use the
.Fl C
option to create lint libraries.
.\" .Sh SECURITY CONSIDERATIONS