How to return memory pointer from argument to apply to splint

Question

I met an issue to use splint. Here is the similar code

#include <stdio.h>
#include <stdlib.h>

static void getMem(/*@null@*/void **out, size_t size)
{

    if(out == NULL)
        return;

    *out = malloc(size);
}

int main(/*@unused@*/int argc, /*@unused@*/char *argv[])
{
    char *str = NULL;

    getMem((void **)&str, 1);
    if(str != NULL)
    {
        *str = 'a';
        (void)putchar(*str);
        free(str);
    }

    return 0;
}

splint gives warning message like this,

main.c: (in function getMem)
main.c:11:2: Function returns with possibly null storage derivable from
                parameter *out
  A possibly null pointer is reachable from a parameter or global variable that
  is not declared using a /*@null@*/ annotation. (Use -nullstate to inhibit
  warning)
   main.c:10:12: Storage *out may become null
main.c:11:2: Function returns storage out reachable from parameter not
                completely defined (**out is undefined)
  Storage derivable from a parameter, return value or global is not defined.
  Use /*@out@*/ to denote passed or returned storage which need not be defined.
  (Use -compdef to inhibit warning)
   main.c:10:12: Storage **out allocated

For argument out in function getMem, I need to check NULL pointer before use. And then return memory address. Annotation "/@out@/" can not be put before the first argument since it is used in the function. And "/@null@/" only indicates out can be null but not *out. I have no idea how to deal with it. Could anyone give some advises? Thanks in advance.

Is there any reason why getMem can't return the pointer to the memory instead of assigning it? — J Trana, Jan 27 '14 at 03:00
I wonder if `static void getMem(/*@null@*/void *(/*@null@*/*out), size_t size)` would work… I can't try it right now. — Floris, Jan 27 '14 at 05:46
@JTrana It's the code style of company so it is hard to change. — Catro, Jan 27 '14 at 07:49

score 2 · Answer 1 · answered Jan 27 '14 at 07:25

Ultimately you cannot express what you wish to express using splint. It simply is not possible with the given prototype. The main reason is that you'd need to tell splint, that *out is an /*@out@*/ and an /*@only@*/. Except that splint has no notion of returning /*@only@*/ storage via parameters. Whenever you place /*@only@*/ in a parameter splint assumes, that the function in question free()s the memory, but you intend to allocate here. You basically have two options now:

Change your function prototype in a way splint can handle. Specifically avoid returning allocated memory via parameters.
Relax checking for this function (e.g. by putting it in a separate, unchecked file) and write a wrapper function that has a prototype that splint can handle.

I wouldn't call it a bug. It's more a like a limitation that comes with the approach. — Helmut Grohne, Jan 27 '14 at 08:20

How to return memory pointer from argument to apply to splint

1 Answers1