[splint-discuss] detecting buffer overflows

[Thomas]

Am Donnerstag, 15. Mai 2008 schrieb Jon Wilson:
> Thomas wrote:
> > Am Donnerstag, 15. Mai 2008 schrieb Bill Pringlemeir:
> >> Finally, I am not quite sure if some of your loops are infinite.  A
> >> good warning might be "loop terminates after overflow" for some of
> >> them.
> > 
> > How can this be enabled? And what kind of overflow?
> 
> For example, your case "d":
> 
> 	// d
> 	for(i = 10; i > 0; i++)
> 	{
> 		printf("%x.", i);
> 	}
> 
> is not an infinite loop as you intimate. It _will_ terminate because i 
> will go negative, but only after it overflows:

Ah, I missed that integer overflow. But for signed integers the C99 standard
does not define a behavior and it depends on the compiler's implementation
what will happen. The compiler can also choose to not increase the variable
anymore when it reaches INT_MAX and the loop will be infinite, splint does
not know anything about the compiler or the machine code created by it.

Bye
Thomas