Splint Release 3.1.2

12 July 2007 This release contains minor bug fixes, most of which were in the CVS code previously, but had not been released in an updated source distribution. See the change log for details.

Splint Release 3.1.0

21 April 2003 This release contains numerous enhancements. Among other imporvements, the accuracy of the bounds checking code has improved; Splint can produce output in html or comma separated value(CSV) format; and support for numabstract types has been added. Additionally the code contains numerous bugs fixes and house keeping updates. See the change log for details.

Splint Release 3.0.1.6

11 February 2002

The main changes in this release are extensions to the grammar. The grammar was extended to support ISO C99 and gcc obsolete extensions for initializing structure fields and array elements using explicit designators. Additionally we relaxed the grammar to allow null statements as external declarations. The release also fixes some internal bugs. See the change log for details.

Splint Release 3.0.1.5

5 February 2002

Some changes have been made which affect the format of splint error messages for bounds errors. Additionally the flag bounds-compact-error-messages has been added. This release also fixes some bugs in Splint 3.0.1.4. See the change log for details.

Splint Release 3.0.1

7 January 2002

Splint 3.0.1 is the successor to LCLint 2.5q. The main changes are support for detection of security vulnerabilities (including buffer overflows) and extensible checks and annotations.

Download

For information on the new features, see:

Improving Security Using Extensible Lightweight Static Analysis

David Evans and David Larochelle. In IEEE Software, Jan/Feb 2002. (PDF, 12 pages)

Most security attacks exploit instances of well-known classes of implementations flaws. This article describes how Splint can be used to detect common security vulnerabilities (including buffer overflows and format string vulnerabilities).

Statically Detecting Likely Buffer Overflow Vulnerabilities

David Larochelle and David Evans. In 2001 USENIX Security Symposium, Washington, D. C., August 13-17, 2001. (PDF, HTML, 13 pages) (Talk slides [PPT] [PDF])

Buffer overflow attacks may be today's single most important security threat. This paper presents a new approach to mitigating buffer overflow vulnerabilities by detecting likely vulnerabilities through an analysis of the program source code. Our approach exploits information provided in semantic comments and uses lightweight and efficient static analyses. This paper describes an implementation of our approach that extends the LCLint annotation-assisted static checking tool. Our tool is as fast as a compiler and nearly as easy to use. We present experience using our approach to detect buffer overflow vulnerabilities in two security-sensitive programs.

	Splint - Secure Programming Lint evans@virginia.edu Download - Documentation - Manual - Links Source - Linux - Publications - Talks Reporting Bugs    Sponsors - Credits