How should the lint directive /*VARARGSn*/ work?

[Martin Weitzel]

We have observed some strange behavior of lint when we use the
/*VARAGSn*/ directive. What we supposed was that (similar to using
the ellipses in ANSI-C) lint will check the first `n' arguments
for their types and existence.

Here is some small test program:
----------------------------------------------------------------
#include <stdio.h>

/*VARARGS2*/
void foo(x, y, z)
	int x;
	long y;
	double z;
{
	if (x > 0) (void) printf("%ld\n", y);
	if (x > 1) (void) printf("%f\n", z);
}

main()
{
	foo(2, 20L, 3.14);
	foo(1, 12L);
	foo(0);	/* <--- shouldn't this be flagged as an error ?? */

	return 0;
}
----------------------------------------------------------------
At least the UNIX SysV lint (SCO's and ISC's) doesn't flag the line
where foo is called with only one argument as an error. The behavior
has started an internal discussion among several people here, which
centers at the following questions:

	1) Does lint behave as described in the manual? To quote the
	   man page:

	   -----
	   /*VARARGSn*/
	                 suppresses the usual checking for variable numbers
	                 of arguments in the following function declaration.
	                 The data types of the first n arguments are checked;
	                 a missing n is taken to be 0.
	   -----

	   One person here claimed that this promises checking the TYPE
	   of the argument *if* an argument is present, but that this
	   DOESN'T promise to check the PRESENCE of the argument.

	   (May be some native speaker understands it better than we do,
	   or maybe it requires a man page lawyer to decide this case :-))

	2) Are there situations where the current behavior is useful?
	   (In the meantime we have reached some consensus that there
	   *may* be situations where the current behavior *might* be
	   useful, but that there is a vast majority of cases where
	   it would be more useful if lint would flag it as an error,
	   if a /*VARAGSn*/ function has not at least "n" arguments.

	   For example in the standard lint library there are many of
	   the /*VARARGSn*/ constructs. Look at yours. The following
	   program suffers from the lint weakness:

	   ------
		#include <stdio.h>
		main()
		{
			(void) open(".");  /* has VARARGS2 in lint lib */
			(void) printf();   /* has VARARGS1 in lint lib */
			return 0;
		}
	   ------

	   It's obviously buggy but lint does not complain.

We have a last question which more or less follows from the second one,
but as we don't know how to send E-Mail to S. C. Johnson (for as much
as we know the originator of lint), it probably remains unanswered ...
but nevertheless: Was the current behavior *intended*, or is it just
the consequence of a quick hack to implement /*VARARGSn*/ painlessly.

Martin Weitzel, Co-Authors: Walter Mecky, Stefan Stapelberg
-- 
Martin Weitzel, email: martin at mwtech.UUCP, voice: 49-(0)6151-6 56 83