- enough lclint annotations and fiddles already.

12 files changed, 477 insertions, 279 deletions

diff --git a/.lclintrc b/.lclintrc
index 81370f6..bf23f75 100644
--- a/.lclintrc
+++ b/.lclintrc
@@ -1,4 +1,4 @@
--I. -I.. -DHAVE_CONFIG_H
+-I. -I./build -I./lib -I./rpmio -I./popt -DHAVE_CONFIG_H -D_GNU_SOURCE
 
 +partial
 
@@ -7,16 +7,17 @@
 
 +unixlib
 
+# XXX ignore doxygen markings
+-unrecogcomments
+
 # don't-bother-me-yet parameters
-#-branchstate
--mustfree
+#-branchstate		# painful
+-mustfree		# alloca is painful
 
 # not-yet normal parameters
 -boolops		# w->n
-#-null
 -predboolint		# w->n
--type
-
+-type			#
 
 # -weak paramaters
 #+boolint
diff --git a/findme.c b/findme.c
index e65762d..f8d51bd 100644
--- a/findme.c
+++ b/findme.c
@@ -15,14 +15,16 @@ const char * findProgramPath(const char * argv0) {
     char * start, * chptr;
     char * buf;
 
+    if (argv0 == NULL) return NULL;	/* XXX can't happen */
     /* If there is a / in the argv[0], it has to be an absolute path */
     if (strchr(argv0, '/'))
 	return xstrdup(argv0);
 
-    if (!path) return NULL;
+    if (path == NULL) return NULL;
 
     start = pathbuf = alloca(strlen(path) + 1);
     buf = malloc(strlen(path) + strlen(argv0) + sizeof("/"));
+    if (buf == NULL) return NULL;	/* XXX can't happen */
     strcpy(pathbuf, path);
 
     chptr = NULL;
diff --git a/findme.h b/findme.h
index 2fe346d..1626ee5 100644
--- a/findme.h
+++ b/findme.h
@@ -14,6 +14,6 @@
  * @param argv0		name of executable
  * @return		(malloc'd) absolute path to executable (or NULL)
  */
-/*@null@*/ const char * findProgramPath(const char * argv0);
+/*@null@*/ const char * findProgramPath(/*@null@*/ const char * argv0);
 
 #endif
diff --git a/popt.c b/popt.c
index 168c46e..169c3a4 100644
--- a/popt.c
+++ b/popt.c
@@ -30,21 +30,26 @@ static char * strerror(int errno) {
 }
 #endif
 
-void poptSetExecPath(poptContext con, const char * path, int allowAbsolute) {
-    if (con->execPath) free((void *)con->execPath);
+void poptSetExecPath(poptContext con, const char * path, int allowAbsolute)
+{
+    con->execPath = _free(con->execPath);
     con->execPath = xstrdup(path);
     con->execAbsolute = allowAbsolute;
 }
 
 static void invokeCallbacksPRE(poptContext con, const struct poptOption * opt)
 {
+    if (opt != NULL)
     for (; opt->longName || opt->shortName || opt->arg; opt++) {
+	if (opt->arg == NULL) continue;		/* XXX program error. */
 	if ((opt->argInfo & POPT_ARG_MASK) == POPT_ARG_INCLUDE_TABLE) {
 	    /* Recurse on included sub-tables. */
 	    invokeCallbacksPRE(con, opt->arg);
 	} else if ((opt->argInfo & POPT_ARG_MASK) == POPT_ARG_CALLBACK &&
 		   (opt->argInfo & POPT_CBFLAG_PRE))
-	{   poptCallbackType cb = (poptCallbackType)opt->arg;
+	{   /*@-castfcnptr@*/
+	    poptCallbackType cb = (poptCallbackType)opt->arg;
+	    /*@=castfcnptr@*/
 	    /* Perform callback. */
 	    cb(con, POPT_CALLBACK_REASON_PRE, NULL, NULL, opt->descrip);
 	}
@@ -53,13 +58,17 @@ static void invokeCallbacksPRE(poptContext con, const struct poptOption * opt)
 
 static void invokeCallbacksPOST(poptContext con, const struct poptOption * opt)
 {
+    if (opt != NULL)
     for (; opt->longName || opt->shortName || opt->arg; opt++) {
+	if (opt->arg == NULL) continue;		/* XXX program error. */
 	if ((opt->argInfo & POPT_ARG_MASK) == POPT_ARG_INCLUDE_TABLE) {
 	    /* Recurse on included sub-tables. */
 	    invokeCallbacksPOST(con, opt->arg);
 	} else if ((opt->argInfo & POPT_ARG_MASK) == POPT_ARG_CALLBACK &&
 		   (opt->argInfo & POPT_CBFLAG_POST))
-	{   poptCallbackType cb = (poptCallbackType)opt->arg;
+	{   /*@-castfcnptr@*/
+	    poptCallbackType cb = (poptCallbackType)opt->arg;
+	    /*@=castfcnptr@*/
 	    /* Perform callback. */
 	    cb(con, POPT_CALLBACK_REASON_POST, NULL, NULL, opt->descrip);
 	}
@@ -69,14 +78,16 @@ static void invokeCallbacksPOST(poptContext con, const struct poptOption * opt)
 static void invokeCallbacksOPTION(poptContext con,
 				  const struct poptOption * opt,
 				  const struct poptOption * myOpt,
-				  const void * myData, int shorty)
+				  /*@null@*/ const void * myData, int shorty)
 {
     const struct poptOption * cbopt = NULL;
 
+    if (opt != NULL)
     for (; opt->longName || opt->shortName || opt->arg; opt++) {
 	if ((opt->argInfo & POPT_ARG_MASK) == POPT_ARG_INCLUDE_TABLE) {
 	    /* Recurse on included sub-tables. */
-	    invokeCallbacksOPTION(con, opt->arg, myOpt, myData, shorty);
+	    if (opt->arg != NULL)	/* XXX program error */
+		invokeCallbacksOPTION(con, opt->arg, myOpt, myData, shorty);
 	} else if ((opt->argInfo & POPT_ARG_MASK) == POPT_ARG_CALLBACK &&
 		  !(opt->argInfo & POPT_CBFLAG_SKIPOPTION)) {
 	    /* Save callback info. */
@@ -85,12 +96,17 @@ static void invokeCallbacksOPTION(poptContext con,
 		   ((myOpt->shortName && opt->shortName && shorty &&
 			myOpt->shortName == opt->shortName) ||
 		    (myOpt->longName && opt->longName &&
+		/*@-nullpass@*/		/* LCL: opt->longName != NULL */
 			!strcmp(myOpt->longName, opt->longName)))
+		/*@=nullpass@*/
 		   )
-	{   poptCallbackType cb = (poptCallbackType)cbopt->arg;
+	{   /*@-castfcnptr@*/
+	    poptCallbackType cb = (poptCallbackType)cbopt->arg;
+	    /*@=castfcnptr@*/
 	    const void * cbData = (cbopt->descrip ? cbopt->descrip : myData);
 	    /* Perform callback. */
-	    cb(con, POPT_CALLBACK_REASON_OPTION, myOpt,
+	    if (cb != NULL)	/* XXX program error */
+		cb(con, POPT_CALLBACK_REASON_OPTION, myOpt,
 			con->os->nextArg, cbData);
 	    /* Terminate (unless explcitly continuing). */
 	    if (!(cbopt->argInfo & POPT_CBFLAG_CONTINUE))
@@ -104,18 +120,23 @@ poptContext poptGetContext(const char * name, int argc, const char ** argv,
 {
     poptContext con = malloc(sizeof(*con));
 
+    if (con == NULL) return NULL;	/* XXX can't happen */
     memset(con, 0, sizeof(*con));
 
     con->os = con->optionStack;
     con->os->argc = argc;
+    /*@-dependenttrans@*/	/* FIX: W2DO? */
     con->os->argv = argv;
+    /*@=dependenttrans@*/
     con->os->argb = NULL;
 
     if (!(flags & POPT_CONTEXT_KEEP_FIRST))
 	con->os->next = 1;			/* skip argv[0] */
 
     con->leftovers = calloc( (argc + 1), sizeof(char *) );
+    /*@-dependenttrans@*/	/* FIX: W2DO? */
     con->options = options;
+    /*@=dependenttrans@*/
     con->aliases = NULL;
     con->numAliases = 0;
     con->flags = flags;
@@ -130,7 +151,9 @@ poptContext poptGetContext(const char * name, int argc, const char ** argv,
 	con->flags |= POPT_CONTEXT_POSIXMEHARDER;
 
     if (name)
+	/*@-nullpass@*/		/* FIX: malloc can return NULL. */
 	con->appName = strcpy(malloc(strlen(name) + 1), name);
+	/*@=nullpass@*/
 
     invokeCallbacksPRE(con, con->options);
 
@@ -139,30 +162,20 @@ poptContext poptGetContext(const char * name, int argc, const char ** argv,
 
 static void cleanOSE(struct optionStackEntry *os)
 {
-    if (os->nextArg) {
-	free((void *)os->nextArg);
-	os->nextArg = NULL;
-    }
-    if (os->argv) {
-	free((void *)os->argv);
-	os->argv = NULL;
-    }
-    if (os->argb) {
-	PBM_FREE(os->argb);
-	os->argb = NULL;
-    }
+    os->nextArg = _free(os->nextArg);
+    os->argv = _free(os->argv);
+    os->argb = PBM_FREE(os->argb);
 }
 
-void poptResetContext(poptContext con) {
+void poptResetContext(poptContext con)
+{
     int i;
 
+    if (con == NULL) return;
     while (con->os > con->optionStack) {
 	cleanOSE(con->os--);
     }
-    if (con->os->argb) {
-	PBM_FREE(con->os->argb);
-	con->os->argb = NULL;
-    }
+    con->os->argb = PBM_FREE(con->os->argb);
     con->os->currAlias = NULL;
     con->os->nextCharArg = NULL;
     con->os->nextArg = NULL;
@@ -173,25 +186,27 @@ void poptResetContext(poptContext con) {
     con->restLeftover = 0;
     con->doExec = NULL;
 
-    for (i = 0; i < con->finalArgvCount; i++) {
-	if (con->finalArgv[i]) {
-	    free((void *)con->finalArgv[i]);
-	    con->finalArgv[i] = NULL;
-	}
-    }
+    if (con->finalArgv != NULL)
+    for (i = 0; i < con->finalArgvCount; i++)
+	/*@-unqualifiedtrans@*/		/* FIX: typedef double indirection. */
+	con->finalArgv[i] = _free(con->finalArgv[i]);
+	/*@=unqualifiedtrans@*/
 
     con->finalArgvCount = 0;
-
-    if (con->arg_strip) {
-	PBM_FREE(con->arg_strip);
-	con->arg_strip = NULL;
-    }
+    con->arg_strip = PBM_FREE(con->arg_strip);
+    /*@-nullstate@*/	/* FIX: con->finalArgv != NULL */
+    return;
+    /*@=nullstate@*/
 }
 
 /* Only one of longName, shortName may be set at a time */
-static int handleExec(poptContext con, char * longName, char shortName) {
+static int handleExec(poptContext con, /*@null@*/ const char * longName,
+		char shortName)
+{
     int i;
 
+    if (con->execs == NULL || con->numExecs <= 0) /* XXX can't happen */
+	return 0;
     i = con->numExecs - 1;
     if (longName) {
 	while (i >= 0 && (!con->execs[i].longName ||
@@ -220,29 +235,42 @@ static int handleExec(poptContext con, char * longName, char shortName) {
     }
 
     i = con->finalArgvCount++;
+    if (con->finalArgv != NULL)	/* XXX can't happen */
     {	char *s  = malloc((longName ? strlen(longName) : 0) + 3);
-	if (longName)
-	    sprintf(s, "--%s", longName);
-	else
-	    sprintf(s, "-%c", shortName);
-	con->finalArgv[i] = s;
+	if (s != NULL) {	/* XXX can't happen */
+	    if (longName)
+		sprintf(s, "--%s", longName);
+	    else
+		sprintf(s, "-%c", shortName);
+	    con->finalArgv[i] = s;
+	} else
+	    con->finalArgv[i] = NULL;
     }
 
+    /*@-nullstate@*/	/* FIX: con->finalArgv[] == NULL */
     return 1;
+    /*@=nullstate@*/
 }
 
 /* Only one of longName, shortName may be set at a time */
-static int handleAlias(poptContext con, const char * longName, char shortName,
-		       /*@keep@*/ const char * nextCharArg) {
+static int handleAlias(poptContext con,
+		/*@null@*/ const char * longName, char shortName,
+		/*@keep@*/ /*@null@*/ const char * nextCharArg)
+{
+    int rc;
     int i;
 
     if (con->os->currAlias && con->os->currAlias->longName && longName &&
+	/*@-nullpass@*/	/* LCL: con->os->currAlias->longName != NULL */
 	!strcmp(con->os->currAlias->longName, longName))
+	/*@=nullpass@*/
 	return 0;
     if (con->os->currAlias && shortName &&
 	    shortName == con->os->currAlias->shortName)
 	return 0;
 
+    if (con->aliases == NULL || con->numAliases <= 0) /* XXX can't happen */
+	return 0;
     i = con->numAliases - 1;
     if (longName) {
 	while (i >= 0 && (!con->aliases[i].longName ||
@@ -266,27 +294,34 @@ static int handleAlias(poptContext con, const char * longName, char shortName,
     con->os->nextArg = NULL;
     con->os->nextCharArg = NULL;
     con->os->currAlias = con->aliases + i;
-    poptDupArgv(con->os->currAlias->argc, con->os->currAlias->argv,
+    rc = poptDupArgv(con->os->currAlias->argc, con->os->currAlias->argv,
 		&con->os->argc, &con->os->argv);
     con->os->argb = NULL;
 
-    return 1;
+    return (rc ? rc : 1);
 }
 
-static void execCommand(poptContext con) {
+static int execCommand(poptContext con)
+    /*@modifies fileSystem @*/
+{
     const char ** argv;
     int argc = 0;
     const char ** sargv;
     int sargc = 0;
+    int rc;
 
-    poptParseArgvString(con->doExec->script, &sargc, &sargv);
+    if (con->doExec == NULL || con->doExec->script == NULL) /*XXX can't happen*/
+	return POPT_ERROR_NOARG;
+    rc = poptParseArgvString(con->doExec->script, &sargc, &sargv);
+    if (rc) return rc;
 
     if (sargv == NULL || sargc < 1 ||
 	(!con->execAbsolute && strchr(sargv[0], '/')))
-	    return;
+	    return POPT_ERROR_NOARG;
 
     argv = malloc(sizeof(*argv) *
 			(6 + sargc + con->numLeftovers + con->finalArgvCount));
+    if (argv == NULL) return POPT_ERROR_MALLOC;	/* XXX can't happen */
 
     if (!strchr(sargv[0], '/') && con->execPath) {
 	char *s = alloca(strlen(con->execPath) + strlen(sargv[0]) + sizeof("/"));
@@ -295,17 +330,20 @@ static void execCommand(poptContext con) {
     } else {
 	argv[argc] = findProgramPath(sargv[0]);
     }
-    if (argv[argc++] == NULL) return;
+    if (argv[argc++] == NULL) return POPT_ERROR_NOARG;
 
     if (sargc > 1) {
 	memcpy(argv + argc, sargv + 1, sizeof(*argv) * (sargc - 1));
 	argc += (sargc - 1);
     }
 
-    memcpy(argv + argc, con->finalArgv, sizeof(*argv) * con->finalArgvCount);
-    argc += con->finalArgvCount;
+    if (con->finalArgv != NULL && con->finalArgvCount > 0) {
+	memcpy(argv + argc, con->finalArgv,
+		sizeof(*argv) * con->finalArgvCount);
+	argc += con->finalArgvCount;
+    }
 
-    if (con->numLeftovers) {
+    if (con->leftovers != NULL && con->numLeftovers > 0) {
 	argv[argc++] = "--";
 	memcpy(argv + argc, con->leftovers, sizeof(*argv) * con->numLeftovers);
 	argc += con->numLeftovers;
@@ -314,7 +352,7 @@ static void execCommand(poptContext con) {
     argv[argc++] = NULL;
 
 #ifdef __hpux
-    setresuid(getuid(), getuid(),-1);
+    (void) setresuid(getuid(), getuid(),-1);
 #else
 /*
  * XXX " ... on BSD systems setuid() should be preferred over setreuid()"
@@ -322,16 +360,16 @@ static void execCommand(poptContext con) {
  * XXX	from Norbert Warmuth <nwarmuth@privat.circular.de>
  */
 #if defined(HAVE_SETUID)
-    setuid(getuid());
+    (void) setuid(getuid());
 #elif defined (HAVE_SETREUID)
-    setreuid(getuid(), getuid()); /*hlauer: not portable to hpux9.01 */
+    (void) setreuid(getuid(), getuid()); /*hlauer: not portable to hpux9.01 */
 #else
     ; /* Can't drop privileges */
 #endif
 #endif
 
     if (argv[0] == NULL)
-	return;
+	return POPT_ERROR_NOARG;
 #ifdef MYDEBUG
     {	const char ** arg;
 	fprintf(stderr, "==> execvp(%s):", argv[0]);
@@ -341,19 +379,22 @@ static void execCommand(poptContext con) {
     }
 #endif
 
-    execvp(argv[0], (char *const *)argv);
+    (void) execvp(argv[0], (char *const *)argv);
+    return POPT_ERROR_ERRNO;
 }
 
-/*@observer@*/ static const struct poptOption *
-findOption(const struct poptOption * opt, const char * longName,
-    char shortName,
-    /*@out@*/ poptCallbackType * callback, /*@out@*/ const void ** callbackData,
-    int singleDash)
+/*@observer@*/ /*@null@*/ static const struct poptOption *
+findOption(const struct poptOption * opt, /*@null@*/ const char * longName,
+		char shortName,
+		/*@null@*/ /*@out@*/ poptCallbackType * callback,
+		/*@null@*/ /*@out@*/ const void ** callbackData,
+		int singleDash)
+	/*@modifies *callback, *callbackData */
 {
     const struct poptOption * cb = NULL;
 
     /* This happens when a single - is given */
-    if (singleDash && !shortName && !*longName)
+    if (singleDash && !shortName && (longName && *longName == '\0'))
 	shortName = '-';
 
     for (; opt->longName || opt->shortName || opt->arg; opt++) {
@@ -361,19 +402,28 @@ findOption(const struct poptOption * opt, const char * longName,
 	if ((opt->argInfo & POPT_ARG_MASK) == POPT_ARG_INCLUDE_TABLE) {
 	    const struct poptOption * opt2;
 	    /* Recurse on included sub-tables. */
+	    if (opt->arg == NULL) continue;	/* XXX program error */
 	    opt2 = findOption(opt->arg, longName, shortName, callback,
 			      callbackData, singleDash);
 	    if (opt2) {
 		/* Sub-table data will be inheirited if no data yet. */
-		if (*callback && *callbackData == NULL)
+		/*@-nullderef@*/	/* LCL: *callback != NULL */
+		if (callback && *callback &&
+			callbackData && *callbackData == NULL)
+		    /*@-observertrans -dependenttrans @*/
 		    *callbackData = opt->descrip;
+		    /*@=observertrans =dependenttrans @*/
+		/*@=nullderef@*/
 		return opt2;
 	    }
 	} else if ((opt->argInfo & POPT_ARG_MASK) == POPT_ARG_CALLBACK) {
 	    cb = opt;
 	} else if (longName && opt->longName &&
 		   (!singleDash || (opt->argInfo & POPT_ARGFLAG_ONEDASH)) &&
-		   !strcmp(longName, opt->longName)) {
+		/*@-nullpass@*/		/* LCL: opt->longName != NULL */
+		   !strcmp(longName, opt->longName))
+		/*@=nullpass@*/
+	{
 	    break;
 	} else if (shortName && shortName == opt->shortName) {
 	    break;
@@ -382,18 +432,28 @@ findOption(const struct poptOption * opt, const char * longName,
 
     if (!opt->longName && !opt->shortName)
 	return NULL;
-    *callbackData = NULL;
-    *callback = NULL;
+    /*@-modobserver -mods @*/
+    if (callback) *callback = NULL;
+    if (callbackData) *callbackData = NULL;
     if (cb) {
-	*callback = (poptCallbackType)cb->arg;
-	if (!(cb->argInfo & POPT_CBFLAG_INC_DATA))
-	    *callbackData = cb->descrip;
+	if (callback)
+	/*@-castfcnptr@*/
+	    *callback = (poptCallbackType)cb->arg;
+	/*@=castfcnptr@*/
+	if (!(cb->argInfo & POPT_CBFLAG_INC_DATA)) {
+	    if (callbackData)
+		/*@-observertrans@*/	/* FIX: typedef double indirection. */
+		*callbackData = cb->descrip;
+		/*@=observertrans@*/
+	}
     }
+    /*@=modobserver =mods @*/
 
     return opt;
 }
 
-static const char *findNextArg(poptContext con, unsigned argx, int delete)
+static const char * findNextArg(poptContext con, unsigned argx, int delete)
+	/*@modifies con @*/
 {
     struct optionStackEntry * os = con->os;
     const char * arg;
@@ -403,6 +463,7 @@ static const char *findNextArg(poptContext con, unsigned argx, int delete)
 	arg = NULL;
 	while (os->next == os->argc && os > con->optionStack) os--;
 	if (os->next == os->argc && os == con->optionStack) break;
+	if (os->argv != NULL)
 	for (i = os->next; i < os->argc; i++) {
 	    if (os->argb && PBM_ISSET(i, os->argb)) continue;
 	    if (*os->argv[i] == '-') continue;
@@ -410,16 +471,21 @@ static const char *findNextArg(poptContext con, unsigned argx, int delete)
 	    arg = os->argv[i];
 	    if (delete) {
 		if (os->argb == NULL) os->argb = PBM_ALLOC(os->argc);
+		if (os->argb != NULL)	/* XXX can't happen */
 		PBM_SET(i, os->argb);
 	    }
 	    break;
 	}
 	if (os > con->optionStack) os--;
     } while (arg == NULL);
+    /*@-compdef@*/	/* FIX: con->os->argv undefined */
     return arg;
+    /*@=compdef@*/
 }
 
-static /*@only@*/ const char * expandNextArg(poptContext con, const char * s)
+static /*@only@*/ /*@null@*/ const char *
+expandNextArg(poptContext con, const char * s)
+	/*@modifies con @*/
 {
     const char *a;
     size_t alen;
@@ -428,6 +494,7 @@ static /*@only@*/ const char * expandNextArg(poptContext con, const char * s)
     char c;
 
     te = t = malloc(tn);;
+    if (t == NULL) return NULL;		/* XXX can't happen */
     while ((c = *s++) != '\0') {
 	switch (c) {
 #if 0	/* XXX can't do this */
@@ -456,7 +523,7 @@ static /*@only@*/ const char * expandNextArg(poptContext con, const char * s)
 	*te++ = c;
     }
     *te = '\0';
-    t = realloc(t, strlen(t)+1);	/* XXX memory leak, hard to plug */
+    t = realloc(t, strlen(t) + 1);	/* XXX memory leak, hard to plug */
     return t;
 }
 
@@ -464,10 +531,15 @@ static void poptStripArg(poptContext con, int which)
 {
     if (con->arg_strip == NULL)
 	con->arg_strip = PBM_ALLOC(con->optionStack[0].argc);
+    if (con->arg_strip != NULL)		/* XXX can't happen */
     PBM_SET(which, con->arg_strip);
 }
 
-static int poptSaveLong(const struct poptOption * opt, long aLong) {
+static int poptSaveLong(const struct poptOption * opt, long aLong)
+{
+    if (opt->arg == NULL)
+	return POPT_ERROR_NULLARG;
+
     if (opt->argInfo & POPT_ARGFLAG_NOT)
 	aLong = ~aLong;
     switch (opt->argInfo & POPT_ARGFLAG_LOGICALOPS) {
@@ -485,12 +557,16 @@ static int poptSaveLong(const struct poptOption * opt, long aLong) {
 	break;
     default:
 	return POPT_ERROR_BADOPERATION;
-	break;
+	/*@notreached@*/ break;
     }
     return 0;
 }
 
-static int poptSaveInt(const struct poptOption * opt, long aLong) {
+static int poptSaveInt(const struct poptOption * opt, long aLong)
+{
+    if (opt->arg == NULL)
+	return POPT_ERROR_NULLARG;
+
     if (opt->argInfo & POPT_ARGFLAG_NOT)
 	aLong = ~aLong;
     switch (opt->argInfo & POPT_ARGFLAG_LOGICALOPS) {
@@ -508,7 +584,7 @@ static int poptSaveInt(const struct poptOption * opt, long aLong) {
 	break;
     default:
 	return POPT_ERROR_BADOPERATION;
-	break;
+	/*@notreached@*/ break;
     }
     return 0;
 }
@@ -533,6 +609,8 @@ int poptGetNextOpt(poptContext con)
     const struct poptOption * opt = NULL;
     int done = 0;
 
+    if (con == NULL)
+	return -1;
     while (!done) {
 	const char * origOptString = NULL;
 	poptCallbackType cb = NULL;
@@ -547,7 +625,7 @@ int poptGetNextOpt(poptContext con)
 	}
 	if (!con->os->nextCharArg && con->os->next == con->os->argc) {
 	    invokeCallbacksPOST(con, con->options);
-	    if (con->doExec) execCommand(con);
+	    if (con->doExec) return execCommand(con);
 	    return -1;
 	}
 
@@ -561,9 +639,14 @@ int poptGetNextOpt(poptContext con)
 		continue;
 	    }
 	    thisopt = con->os->next;
+	    if (con->os->argv != NULL)	/* XXX can't happen */
 	    origOptString = con->os->argv[con->os->next++];
 
+	    if (origOptString == NULL)	/* XXX can't happen */
+		return POPT_ERROR_BADOPT;
+
 	    if (con->restLeftover || *origOptString != '-') {
+		if (con->leftovers != NULL)	/* XXX can't happen */
 		con->leftovers[con->numLeftovers++] = origOptString;
 		if (con->flags & POPT_CONTEXT_POSIXMEHARDER)
 		    con->restLeftover = 1;
@@ -572,10 +655,9 @@ int poptGetNextOpt(poptContext con)
 
 	    /* Make a copy we can hack at */
 	    localOptString = optString =
-			strcpy(alloca(strlen(origOptString) + 1),
-			origOptString);
+		strcpy(alloca(strlen(origOptString) + 1), origOptString);
 
-	    if (!optString[0])
+	    if (optString[0] == '\0')
 		return POPT_ERROR_BADOPT;
 
 	    if (optString[1] == '-' && !optString[2]) {
@@ -626,6 +708,7 @@ int poptGetNextOpt(poptContext con)
 
 	/* Process next short option */
 	if (con->os->nextCharArg) {
+	    /*@-branchstate@*/		/* FIX: W2DO? */
 	    origOptString = con->os->nextCharArg;
 
 	    con->os->nextCharArg = NULL;
@@ -637,7 +720,8 @@ int poptGetNextOpt(poptContext con)
 	    if (handleExec(con, NULL, *origOptString)) {
 		/* Restore rest of short options for further processing */
 		origOptString++;
-		if (*origOptString) con->os->nextCharArg = origOptString;
+		if (*origOptString != '\0')
+		    con->os->nextCharArg = origOptString;
 		continue;
 	    }
 
@@ -648,9 +732,12 @@ int poptGetNextOpt(poptContext con)
 	    shorty = 1;
 
 	    origOptString++;
-	    if (*origOptString) con->os->nextCharArg = origOptString;
+	    if (*origOptString != '\0')
+		con->os->nextCharArg = origOptString;
+	    /*@=branchstate@*/
 	}
 
+	if (opt == NULL) return POPT_ERROR_BADOPT;	/* XXX can't happen */
 	if (opt->arg && (opt->argInfo & POPT_ARG_MASK) == POPT_ARG_NONE) {
 	    if (poptSaveInt(opt, 1L))
 		return POPT_ERROR_BADOPERATION;
@@ -660,14 +747,17 @@ int poptGetNextOpt(poptContext con)
 		    return POPT_ERROR_BADOPERATION;
 	    }
 	} else if ((opt->argInfo & POPT_ARG_MASK) != POPT_ARG_NONE) {
-	    if (con->os->nextArg) {
-		free((void *)con->os->nextArg);
-		con->os->nextArg = NULL;
-	    }
+	    con->os->nextArg = _free(con->os->nextArg);
+	    /*@-usedef@*/	/* FIX: W2DO? */
 	    if (longArg) {
+	    /*@=usedef@*/
+		/*@-evalorder@*/	/* FIX: W2DO? */
 		con->os->nextArg = expandNextArg(con, longArg);
+		/*@=evalorder@*/
 	    } else if (con->os->nextCharArg) {
+		/*@-evalorder@*/	/* FIX: W2DO? */
 		con->os->nextArg = expandNextArg(con, con->os->nextCharArg);
+		/*@=evalorder@*/
 		con->os->nextCharArg = NULL;
 	    } else {
 		while (con->os->next == con->os->argc &&
@@ -689,7 +779,11 @@ int poptGetNextOpt(poptContext con)
 			poptStripArg(con, con->os->next);
 		    }
 		
-		    con->os->nextArg = expandNextArg(con, con->os->argv[con->os->next++]);
+		    if (con->os->argv != NULL)	/* XXX can't happen */
+		    /*@-evalorder@*/	/* FIX: W2DO? */
+		    con->os->nextArg =
+			expandNextArg(con, con->os->argv[con->os->next++]);
+		    /*@=evalorder@*/
 		}
 	    }
 
@@ -732,24 +826,21 @@ int poptGetNextOpt(poptContext con)
 
 		    if (con->os->nextArg) {
 			aDouble = strtod(con->os->nextArg, &end);
-			if (*end)
+			if (*end != '\0')
 			    return POPT_ERROR_BADNUMBER;
 		    }
 
-		    if (aDouble == +HUGE_VAL || aDouble == -HUGE_VAL)
+		    if ((aDouble - HUGE_VAL) < DBL_EPSILON ||
+			(aDouble + HUGE_VAL) < DBL_EPSILON)
 			return POPT_ERROR_OVERFLOW;
-		    if (aDouble == 0.0 && errno == ERANGE)
+		    if ((aDouble - 0.0) < DBL_EPSILON && errno == ERANGE)
 			return POPT_ERROR_OVERFLOW;
 		    if ((opt->argInfo & POPT_ARG_MASK) == POPT_ARG_DOUBLE) {
 			*((double *) opt->arg) = aDouble;
 		    } else {
-#ifdef ABS
-#undef ABS
-#endif
-#define ABS(a) (((a) < 0) ? -(a) : (a))
-			if (ABS(aDouble) > FLT_MAX)
+			if ((aDouble - FLT_MAX) > DBL_EPSILON)
 			    return POPT_ERROR_OVERFLOW;
-			if (ABS(aDouble) < FLT_MIN)
+			if ((aDouble + FLT_MIN) > DBL_EPSILON)
 			    return POPT_ERROR_OVERFLOW;
 			*((float *) opt->arg) = aDouble;
 		    }
@@ -773,83 +864,107 @@ int poptGetNextOpt(poptContext con)
 			    sizeof(*con->finalArgv) * con->finalArgvAlloced);
 	}
 
+	if (con->finalArgv != NULL)
 	{   char *s = malloc((opt->longName ? strlen(opt->longName) : 0) + 3);
-	    if (opt->longName)
-		sprintf(s, "%s%s",
-		    ((opt->argInfo & POPT_ARGFLAG_ONEDASH) ? "-" : "--"),
-		    opt->longName);
-	    else
-		sprintf(s, "-%c", opt->shortName);
-	    con->finalArgv[con->finalArgvCount++] = s;
+	    if (s != NULL) {	/* XXX can't happen */
+		if (opt->longName)
+		    sprintf(s, "%s%s",
+			((opt->argInfo & POPT_ARGFLAG_ONEDASH) ? "-" : "--"),
+			opt->longName);
+		else
+		    sprintf(s, "-%c", opt->shortName);
+		con->finalArgv[con->finalArgvCount++] = s;
+	    } else
+		con->finalArgv[con->finalArgvCount++] = NULL;
 	}
 
 	if (opt->arg && (opt->argInfo & POPT_ARG_MASK) == POPT_ARG_NONE)
-	    /*@-ifempty@*/ ;
+	    /*@-ifempty@*/ ; /*@=ifempty@*/
 	else if ((opt->argInfo & POPT_ARG_MASK) == POPT_ARG_VAL)
-	    /*@-ifempty@*/ ;
+	    /*@-ifempty@*/ ; /*@=ifempty@*/
 	else if ((opt->argInfo & POPT_ARG_MASK) != POPT_ARG_NONE) {
-	    if (con->os->nextArg)
+	    if (con->finalArgv != NULL && con->os->nextArg)
 	        con->finalArgv[con->finalArgvCount++] =
+			/*@-nullpass@*/	/* LCL: con->os->nextArg != NULL */
 			xstrdup(con->os->nextArg);
+			/*@=nullpass@*/
 	}
     }
 
-    return opt->val;
+    return (opt ? opt->val : -1);	/* XXX can't happen */
 }
 
-const char * poptGetOptArg(poptContext con) {
-    const char * ret = con->os->nextArg;
-    con->os->nextArg = NULL;
+const char * poptGetOptArg(poptContext con)
+{
+    const char * ret = NULL;
+    if (con) {
+	ret = con->os->nextArg;
+	con->os->nextArg = NULL;
+    }
     return ret;
 }
 
-const char * poptGetArg(poptContext con) {
-    const char * ret = (con->nextLeftover < con->numLeftovers)
-	? con->leftovers[con->nextLeftover++] : NULL;
+const char * poptGetArg(poptContext con)
+{
+    const char * ret = NULL;
+    if (con && con->leftovers != NULL && con->nextLeftover < con->numLeftovers)
+	ret = con->leftovers[con->nextLeftover++];
     return ret;
 }
 
-const char * poptPeekArg(poptContext con) {
-    const char * ret = (con->nextLeftover < con->numLeftovers)
-	? con->leftovers[con->nextLeftover] : NULL;
+const char * poptPeekArg(poptContext con)
+{
+    const char * ret = NULL;
+    if (con && con->leftovers != NULL && con->nextLeftover < con->numLeftovers)
+	ret = con->leftovers[con->nextLeftover];
     return ret;
 }
 
-const char ** poptGetArgs(poptContext con) {
-    if (con->numLeftovers == con->nextLeftover) return NULL;
+const char ** poptGetArgs(poptContext con)
+{
+    if (con == NULL ||
+	con->leftovers == NULL || con->numLeftovers == con->nextLeftover)
+	return NULL;
 
     /* some apps like [like RPM ;-) ] need this NULL terminated */
     con->leftovers[con->numLeftovers] = NULL;
 
+    /*@-nullret -nullstate @*/	/* FIX: typedef double indirection. */
     return (con->leftovers + con->nextLeftover);
+    /*@=nullret =nullstate @*/
 }
 
-void poptFreeContext(poptContext con) {
+poptContext poptFreeContext(poptContext con)
+{
     int i;
 
+    if (con == NULL) return con;
     poptResetContext(con);
-    if (con->os->argb) free(con->os->argb);
+    con->os->argb = _free(con->os->argb);
 
+    if (con->aliases != NULL)
     for (i = 0; i < con->numAliases; i++) {
-	if (con->aliases[i].longName) free((void *)con->aliases[i].longName);
-	free(con->aliases[i].argv);
+	con->aliases[i].longName = _free(con->aliases[i].longName);
+	con->aliases[i].argv = _free(con->aliases[i].argv);
     }
 
+    if (con->execs != NULL)
     for (i = 0; i < con->numExecs; i++) {
-	if (con->execs[i].longName) free((void *)con->execs[i].longName);
-	free((void *)con->execs[i].script);
+	con->execs[i].longName = _free(con->execs[i].longName);
+	con->execs[i].script = _free(con->execs[i].script);
     }
-    if (con->execs) free((void *)con->execs);
-
-    free(con->leftovers);
-    free(con->finalArgv);
-    if (con->appName) free((void *)con->appName);
-    if (con->aliases) free(con->aliases);
-    if (con->otherHelp) free((void *)con->otherHelp);
-    if (con->execPath) free((void *)con->execPath);
-    if (con->arg_strip) PBM_FREE(con->arg_strip);
+    con->execs = _free(con->execs);
+
+    con->leftovers = _free(con->leftovers);
+    con->finalArgv = _free(con->finalArgv);
+    con->appName = _free(con->appName);
+    con->aliases = _free(con->aliases);
+    con->otherHelp = _free(con->otherHelp);
+    con->execPath = _free(con->execPath);
+    con->arg_strip = PBM_FREE(con->arg_strip);
     
-    free(con);
+    con = _free(con);
+    return con;
 }
 
 int poptAddAlias(poptContext con, struct poptAlias newAlias,
@@ -867,7 +982,9 @@ int poptAddAlias(poptContext con, struct poptAlias newAlias,
     alias = con->aliases + aliasNum;
 
     alias->longName = (newAlias.longName)
+	/*@-nullpass@*/		/* FIX: malloc can return NULL. */
 	? strcpy(malloc(strlen(newAlias.longName) + 1), newAlias.longName)
+	/*@=nullpass@*/
 	: NULL;
     alias->shortName = newAlias.shortName;
     alias->argc = newAlias.argc;
@@ -876,18 +993,20 @@ int poptAddAlias(poptContext con, struct poptAlias newAlias,
     return 0;
 }
 
-const char * poptBadOption(poptContext con, int flags) {
-    struct optionStackEntry * os;
+const char * poptBadOption(poptContext con, int flags)
+{
+    struct optionStackEntry * os = NULL;
 
-    if (flags & POPT_BADOPTION_NOALIAS)
-	os = con->optionStack;
-    else
-	os = con->os;
+    if (con != NULL)
+	os = (flags & POPT_BADOPTION_NOALIAS) ? con->optionStack : con->os;
 
-    return os->argv[os->next - 1];
+    /*@-nullderef@*/	/* LCL: os->argv != NULL */
+    return (os && os->argv ? os->argv[os->next - 1] : NULL);
+    /*@=nullderef@*/
 }
 
-const char *const poptStrerror(const int error) {
+const char *const poptStrerror(const int error)
+{
     switch (error) {
       case POPT_ERROR_NOARG:
 	return POPT_("missing argument");
@@ -895,6 +1014,8 @@ const char *const poptStrerror(const int error) {
 	return POPT_("unknown option");
       case POPT_ERROR_BADOPERATION:
 	return POPT_("mutually exclusive logical operations requested");
+      case POPT_ERROR_NULLARG:
+	return POPT_("opt->arg should not be NULL");
       case POPT_ERROR_OPTSTOODEEP:
 	return POPT_("aliases nested too deeply");
       case POPT_ERROR_BADQUOTE:
@@ -903,6 +1024,8 @@ const char *const poptStrerror(const int error) {
 	return POPT_("invalid numeric value");
       case POPT_ERROR_OVERFLOW:
 	return POPT_("number too large or too small");
+      case POPT_ERROR_MALLOC:
+	return POPT_("memory allocation failed");
       case POPT_ERROR_ERRNO:
 	return strerror(errno);
       default:
@@ -910,8 +1033,10 @@ const char *const poptStrerror(const int error) {
     }
 }
 
-int poptStuffArgs(poptContext con, const char ** argv) {
+int poptStuffArgs(poptContext con, const char ** argv)
+{
     int argc;
+    int rc;
 
     if ((con->os - con->optionStack) == POPT_OPTION_DEPTH)
 	return POPT_ERROR_OPTSTOODEEP;
@@ -924,30 +1049,34 @@ int poptStuffArgs(poptContext con, const char ** argv) {
     con->os->nextArg = NULL;
     con->os->nextCharArg = NULL;
     con->os->currAlias = NULL;
-    poptDupArgv(argc, argv, &con->os->argc, &con->os->argv);
+    rc = poptDupArgv(argc, argv, &con->os->argc, &con->os->argv);
     con->os->argb = NULL;
     con->os->stuffed = 1;
 
-    return 0;
+    return rc;
 }
 
-const char * poptGetInvocationName(poptContext con) {
-    return con->os->argv[0];
+const char * poptGetInvocationName(poptContext con)
+{
+    return (con->os->argv ? con->os->argv[0] : "");
 }
 
-int poptStrippedArgv(poptContext con, int argc, char **argv)
+int poptStrippedArgv(poptContext con, int argc, char ** argv)
 {
-    int i,j=1, numargs=argc;
+    int numargs = argc;
+    int j = 1;
+    int i;
     
+    if (con->arg_strip)
     for (i = 1; i < argc; i++) {
 	if (PBM_ISSET(i, con->arg_strip))
 	    numargs--;
     }
     
     for (i = 1; i < argc; i++) {
-	if (PBM_ISSET(i, con->arg_strip))
+	if (con->arg_strip && PBM_ISSET(i, con->arg_strip))
 	    continue;
-	argv[j] = (j < numargs) ? argv[i] : '\0';
+	argv[j] = (j < numargs) ? argv[i] : NULL;
 	j++;
     }
     
diff --git a/popt.h b/popt.h
index 70bb408..b74f7d8 100644
--- a/popt.h
+++ b/popt.h
@@ -84,6 +84,8 @@ extern "C" {
 #define POPT_ERROR_BADNUMBER	-17	/*!< invalid numeric value */
 #define POPT_ERROR_OVERFLOW	-18	/*!< number too large or too small */
 #define	POPT_ERROR_BADOPERATION	-19	/*!< mutually exclusive logical operations requested */
+#define	POPT_ERROR_NULLARG	-20	/*!< opt->arg should not be NULL */
+#define	POPT_ERROR_MALLOC	-21	/*!< memory allocation failed */
 /*@}*/
 
 /** \ingroup popt
@@ -110,8 +112,8 @@ struct poptOption {
     int argInfo;
 /*@shared@*/ /*@null@*/ void * arg;	/*!< depends on argInfo */
     int val;			/*!< 0 means don't return, just update flag */
-/*@shared@*/ /*@null@*/ const char * descrip;	/*!< description for autohelp -- may be NULL */
-/*@shared@*/ /*@null@*/ const char * argDescrip; /*!< argument description for autohelp */
+/*@observer@*/ /*@null@*/ const char * descrip;	/*!< description for autohelp -- may be NULL */
+/*@observer@*/ /*@null@*/ const char * argDescrip; /*!< argument description for autohelp */
 };
 
 /** \ingroup popt
@@ -135,7 +137,7 @@ extern struct poptOption poptHelpOptions[];
 
 /** \ingroup popt
  */
-typedef struct poptContext_s * poptContext;
+typedef /*@abstract@*/ struct poptContext_s * poptContext;
 
 /** \ingroup popt
  */
@@ -156,9 +158,10 @@ enum poptCallbackReason { POPT_CALLBACK_REASON_PRE,
  * @param data		@todo Document.
  */
 typedef void (*poptCallbackType) (poptContext con, 
-				 enum poptCallbackReason reason,
-			         const struct poptOption * opt,
-				 const char * arg, const void * data);
+		enum poptCallbackReason reason,
+		/*@null@*/ const struct poptOption * opt,
+		/*@null@*/ const char * arg,
+		/*@null@*/ const void * data);
 
 /** \ingroup popt
  * Initialize popt context.
@@ -169,7 +172,7 @@ typedef void (*poptCallbackType) (poptContext con,
  * @param flags		or'd POPT_CONTEXT_* bits
  * @return		initialized popt context
  */
-/*@only@*/ poptContext poptGetContext(
+/*@only@*/ /*@null@*/ poptContext poptGetContext(
 		/*@dependent@*/ /*@keep@*/ const char * name,
 		int argc, /*@dependent@*/ /*@keep@*/ const char ** argv,
 		/*@dependent@*/ /*@keep@*/ const struct poptOption * options,
@@ -179,54 +182,55 @@ typedef void (*poptCallbackType) (poptContext con,
  * Reinitialize popt context.
  * @param con		context
  */
-void poptResetContext(poptContext con);
+void poptResetContext(/*@null@*/poptContext con);
 
 /** \ingroup popt
  * Return value of next option found.
  * @param con		context
  * @return		next option val, -1 on last item, POPT_ERROR_* on error
  */
-int poptGetNextOpt(poptContext con);
+int poptGetNextOpt(/*@null@*/poptContext con);
 /* returns NULL if no argument is available */
 
 /** \ingroup popt
  * @param con		context
  */
-/*@observer@*/ /*@null@*/ const char * poptGetOptArg(poptContext con);
+/*@observer@*/ /*@null@*/ const char * poptGetOptArg(/*@null@*/poptContext con);
 
 /** \ingroup popt
  * Return current option's argument.
  * @param con		context
  * @return		option argument, NULL if no more options are available
  */
-/*@observer@*/ /*@null@*/ const char * poptGetArg(poptContext con);
+/*@observer@*/ /*@null@*/ const char * poptGetArg(/*@null@*/poptContext con);
 
 /** \ingroup popt
  * Peek at  current option's argument.
  * @param con		context
  * @return		option argument
  */
-/*@observer@*/ /*@null@*/ const char * poptPeekArg(poptContext con);
+/*@observer@*/ /*@null@*/ const char * poptPeekArg(/*@null@*/poptContext con);
 
 /** \ingroup popt
  * Return remaining arguments.
  * @param con		context
  * @return		argument array, terminated with NULL
  */
-/*@observer@*/ /*@null@*/ const char ** poptGetArgs(poptContext con);
+/*@observer@*/ /*@null@*/ const char ** poptGetArgs(/*@null@*/poptContext con);
 
 /** \ingroup popt
  * Return the option which caused the most recent error.
  * @param con		context
  * @return		offending option
  */
-/*@observer@*/ const char * poptBadOption(poptContext con, int flags);
+/*@observer@*/ const char * poptBadOption(/*@null@*/poptContext con, int flags);
 
 /** \ingroup popt
  * Destroy context.
  * @param con		context
+ * @return		NULL
  */
-void poptFreeContext( /*@only@*/ poptContext con);
+/*@null@*/ poptContext poptFreeContext( /*@only@*/ /*@null@*/ poptContext con);
 
 /** \ingroup popt
  * Add arguments to context.
@@ -252,7 +256,9 @@ int poptAddAlias(poptContext con, struct poptAlias alias, int flags);
  * @param fn		file name to read
  * @return		0 on success, POPT_ERROR_ERRNO on failure
  */
-int poptReadConfigFile(poptContext con, const char * fn);
+int poptReadConfigFile(poptContext con, const char * fn)
+	/*@modifies fileSystem,
+		con->execs, con->numExecs @*/;
 
 /** \ingroup popt
  * Read default configuration from /etc/popt and $HOME/.popt.
@@ -260,7 +266,9 @@ int poptReadConfigFile(poptContext con, const char * fn);
  * @param useEnv	(unused)
  * @return		0 on success, POPT_ERROR_ERRNO on failure
  */
-int poptReadDefaultConfig(poptContext con, /*@unused@*/ int useEnv);
+int poptReadDefaultConfig(poptContext con, /*@unused@*/ int useEnv)
+	/*@modifies fileSystem,
+		con->execs, con->numExecs @*/;
 
 /** \ingroup popt
  * Duplicate an argument array.
@@ -273,8 +281,10 @@ int poptReadDefaultConfig(poptContext con, /*@unused@*/ int useEnv);
  * @retval argvPtr	address of returned argument array
  * @return		0 on success, POPT_ERROR_NOARG on failure
  */
-int poptDupArgv(int argc, const char **argv,
-		/*@out@*/ int * argcPtr, /*@out@*/ const char *** argvPtr);
+int poptDupArgv(int argc, /*@null@*/ const char **argv,
+		/*@null@*/ /*@out@*/ int * argcPtr,
+		/*@null@*/ /*@out@*/ const char *** argvPtr)
+	/*@modifies *argcPtr, *argvPtr @*/;
 
 /** \ingroup popt
  * Parse a string into an argument array.
@@ -288,14 +298,16 @@ int poptDupArgv(int argc, const char **argv,
  * @retval argvPtr	address of returned argument array
  */
 int poptParseArgvString(const char * s,
-		/*@out@*/ int * argcPtr, /*@out@*/ const char *** argvPtr);
+		/*@out@*/ int * argcPtr, /*@out@*/ const char *** argvPtr)
+	/*@modifies *argcPtr, *argvPtr @*/;
 
 /** \ingroup popt
  * Return formatted error string for popt failure.
  * @param error		popt error
  * @return		error string
  */
-/*@observer@*/ const char *const poptStrerror(const int error);
+/*@observer@*/ const char *const poptStrerror(const int error)
+	/*@*/;
 
 /** \ingroup popt
  * Limit search for executables.
@@ -339,7 +351,7 @@ void poptSetOtherOptionHelp(poptContext con, const char * text);
  * @param con		context
  * @return		new argc
  */
-int poptStrippedArgv(poptContext con, int argc, char **argv);
+int poptStrippedArgv(poptContext con, int argc, char ** argv);
 
 #ifdef  __cplusplus
 }
diff --git a/poptconfig.c b/poptconfig.c
index 0cfd1a1..d518646 100644
--- a/poptconfig.c
+++ b/poptconfig.c
@@ -9,30 +9,33 @@
 #include "system.h"
 #include "poptint.h"
 
-static void configLine(poptContext con, char * line) {
+static void configLine(poptContext con, char * line)
+	/*@modifies *line,
+		con->execs, con->numExecs @*/
+{
     int nameLength = strlen(con->appName);
-    char * opt;
+    const char * opt;
     struct poptAlias alias;
-    char * entryType;
-    char * longName = NULL;
+    const char * entryType;
+    const char * longName = NULL;
     char shortName = '\0';
     
     if (strncmp(line, con->appName, nameLength)) return;
     line += nameLength;
-    if (!*line || !isspace(*line)) return;
-    while (*line && isspace(*line)) line++;
+    if (*line == '\0' || !isspace(*line)) return;
+    while (*line != '\0' && isspace(*line)) line++;
     entryType = line;
 
-    while (!*line || !isspace(*line)) line++;
+    while (*line == '\0' || !isspace(*line)) line++;
     *line++ = '\0';
-    while (*line && isspace(*line)) line++;
-    if (!*line) return;
+    while (*line != '\0' && isspace(*line)) line++;
+    if (*line == '\0') return;
     opt = line;
 
-    while (!*line || !isspace(*line)) line++;
+    while (*line == '\0' || !isspace(*line)) line++;
     *line++ = '\0';
-    while (*line && isspace(*line)) line++;
-    if (!*line) return;
+    while (*line != '\0' && isspace(*line)) line++;
+    if (*line == '\0') return;
 
     if (opt[0] == '-' && opt[1] == '-')
 	longName = opt + 2;
@@ -42,10 +45,11 @@ static void configLine(poptContext con, char * line) {
     if (!strcmp(entryType, "alias")) {
 	if (poptParseArgvString(line, &alias.argc, &alias.argv)) return;
 	alias.longName = longName, alias.shortName = shortName;
-	poptAddAlias(con, alias, 0);
+	(void) poptAddAlias(con, alias, 0);
     } else if (!strcmp(entryType, "exec")) {
 	con->execs = realloc(con->execs,
 				sizeof(*con->execs) * (con->numExecs + 1));
+	if (con->execs == NULL) return;	/* XXX can't happen */
 	if (longName)
 	    con->execs[con->numExecs].longName = xstrdup(longName);
 	else
@@ -54,13 +58,17 @@ static void configLine(poptContext con, char * line) {
 	con->execs[con->numExecs].shortName = shortName;
 	con->execs[con->numExecs].script = xstrdup(line);
 	
+	/*@-noeffect@*/		/* LCL: broken? */
 	con->numExecs++;
+	/*@=noeffect@*/
     }
 }
 
-int poptReadConfigFile(poptContext con, const char * fn) {
-    char * file, * chptr, * end;
-    char * buf, * dst;
+int poptReadConfigFile(poptContext con, const char * fn)
+{
+    const char * file, * chptr, * end;
+    char * buf;
+/*@dependent@*/ char * dst;
     int fd, rc;
     int fileLength;
 
@@ -76,27 +84,27 @@ int poptReadConfigFile(poptContext con, const char * fn) {
     (void) lseek(fd, 0, 0);
 
     file = alloca(fileLength + 1);
-    if (read(fd, file, fileLength) != fileLength) {
+    if (read(fd, (char *)file, fileLength) != fileLength) {
 	rc = errno;
-	close(fd);
+	(void) close(fd);
 	errno = rc;
 	return POPT_ERROR_ERRNO;
     }
-    close(fd);
+    (void) close(fd);
 
     dst = buf = alloca(fileLength + 1);
 
     chptr = file;
     end = (file + fileLength);
+    /*@-infloops@*/	/* LCL: can't detect chptr++ */
     while (chptr < end) {
 	switch (*chptr) {
 	  case '\n':
 	    *dst = '\0';
 	    dst = buf;
 	    while (*dst && isspace(*dst)) dst++;
-	    if (*dst && *dst != '#') {
+	    if (*dst && *dst != '#')
 		configLine(con, dst);
-	    }
 	    chptr++;
 	    break;
 	  case '\\':
@@ -114,6 +122,7 @@ int poptReadConfigFile(poptContext con, const char * fn) {
 	    break;
 	}
     }
+    /*@=infloops@*/
 
     return 0;
 }
@@ -138,4 +147,3 @@ int poptReadDefaultConfig(poptContext con, /*@unused@*/ int useEnv) {
 
     return 0;
 }
-
diff --git a/popthelp.c b/popthelp.c
index a76b03c..086cd43 100644
--- a/popthelp.c
+++ b/popthelp.c
@@ -23,31 +23,33 @@ static void displayArgs(poptContext con,
     exit(0);
 }
 
+/*@-castfcnptr@*/
 struct poptOption poptHelpOptions[] = {
     { NULL, '\0', POPT_ARG_CALLBACK, (void *)&displayArgs, '\0', NULL, NULL },
     { "help", '?', 0, NULL, '?', N_("Show this help message"), NULL },
     { "usage", '\0', 0, NULL, 'u', N_("Display brief usage message"), NULL },
     POPT_TABLEEND
 } ;
-
+/*@=castfcnptr@*/
 
 /*@observer@*/ /*@null@*/ static const char *const
-getTableTranslationDomain(const struct poptOption *table)
+getTableTranslationDomain(/*@null@*/ const struct poptOption *table)
 {
-  const struct poptOption *opt;
-
-  for(opt = table;
-      opt->longName || opt->shortName || opt->arg;
-      opt++) {
-    if(opt->argInfo == POPT_ARG_INTL_DOMAIN)
-      return opt->arg;
-  }
+    const struct poptOption *opt;
 
-  return NULL;
+    if (table != NULL)
+    for (opt = table; opt->longName || opt->shortName || opt->arg; opt++) {
+	if (opt->argInfo == POPT_ARG_INTL_DOMAIN)
+	    return opt->arg;
+    }
+    return NULL;
 }
 
 /*@observer@*/ /*@null@*/ static const char *const
-getArgDescrip(const struct poptOption * opt, const char *translation_domain)
+getArgDescrip(const struct poptOption * opt,
+		/*@-paramuse@*/		/* FIX: wazzup? */
+		/*@null@*/ const char * translation_domain)
+		/*@=paramuse@*/
 {
     if (!(opt->argInfo & POPT_ARG_MASK)) return NULL;
 
@@ -69,8 +71,8 @@ getArgDescrip(const struct poptOption * opt, const char *translation_domain)
 }
 
 static void singleOptionHelp(FILE * f, int maxLeftCol, 
-			     const struct poptOption * opt,
-			     const char *translation_domain)
+		const struct poptOption * opt,
+		/*@null@*/ const char *translation_domain)
 {
     int indentLength = maxLeftCol + 5;
     int lineLength = 79 - indentLength;
@@ -85,13 +87,15 @@ static void singleOptionHelp(FILE * f, int maxLeftCol,
     if (argDescrip)	nb += strlen(argDescrip);
 
     left = malloc(nb);
-    left[0] = left[maxLeftCol] = '\0';
+    if (left == NULL) return;	/* XXX can't happen */
+    left[0] = '\0';
+    left[maxLeftCol] = '\0';
 
     if (opt->longName && opt->shortName)
 	sprintf(left, "-%c, %s%s", opt->shortName,
 		((opt->argInfo & POPT_ARGFLAG_ONEDASH) ? "-" : "--"),
 		opt->longName);
-    else if (opt->shortName) 
+    else if (opt->shortName != '\0') 
 	sprintf(left, "-%c", opt->shortName);
     else if (opt->longName)
 	sprintf(left, "%s%s",
@@ -113,11 +117,11 @@ static void singleOptionHelp(FILE * f, int maxLeftCol,
 		if (opt->argInfo & POPT_ARGFLAG_NOT) aLong = ~aLong;
 		switch (opt->argInfo & POPT_ARGFLAG_LOGICALOPS) {
 		case POPT_ARGFLAG_OR:
-		    sprintf(le, "[|=0x%lx]", aLong);	break;
+		    sprintf(le, "[|=0x%lx]", (unsigned long)aLong);	break;
 		case POPT_ARGFLAG_AND:
-		    sprintf(le, "[&=0x%lx]", aLong);	break;
+		    sprintf(le, "[&=0x%lx]", (unsigned long)aLong);	break;
 		case POPT_ARGFLAG_XOR:
-		    sprintf(le, "[^=0x%lx]", aLong);	break;
+		    sprintf(le, "[^=0x%lx]", (unsigned long)aLong);	break;
 		default:
 		    if (!(aLong == 0L || aLong == 1L || aLong == -1L))
 			sprintf(le, "[=%ld]", aLong);
@@ -173,20 +177,22 @@ out:
 }
 
 static int maxArgWidth(const struct poptOption * opt,
-		       const char * translation_domain)
+		       /*@null@*/ const char * translation_domain)
 {
     int max = 0;
-    int this;
+    int this = 0;
     const char * s;
     
+    if (opt != NULL)
     while (opt->longName || opt->shortName || opt->arg) {
 	if ((opt->argInfo & POPT_ARG_MASK) == POPT_ARG_INCLUDE_TABLE) {
+	    if (opt->arg)	/* XXX program error */
 	    this = maxArgWidth(opt->arg, translation_domain);
 	    if (this > max) max = this;
 	} else if (!(opt->argInfo & POPT_ARGFLAG_DOC_HIDDEN)) {
 	    this = sizeof("  ")-1;
-	    if (opt->shortName) this += sizeof("-X")-1;
-	    if (opt->shortName && opt->longName) this += sizeof(", ")-1;
+	    if (opt->shortName != '\0') this += sizeof("-X")-1;
+	    if (opt->shortName != '\0' && opt->longName) this += sizeof(", ")-1;
 	    if (opt->longName) {
 		this += ((opt->argInfo & POPT_ARGFLAG_ONEDASH)
 			? sizeof("-")-1 : sizeof("--")-1);
@@ -206,23 +212,25 @@ static int maxArgWidth(const struct poptOption * opt,
     return max;
 }
 
-static void singleTableHelp(FILE * f, const struct poptOption * table, 
-			    int left,
-			    const char *translation_domain)
+static void singleTableHelp(FILE * f,
+		/*@null@*/ const struct poptOption * table, int left,
+		/*@null@*/ const char * translation_domain)
 {
     const struct poptOption * opt;
     const char *sub_transdom;
 
+    if (table != NULL)
     for (opt = table; (opt->longName || opt->shortName || opt->arg); opt++) {
 	if ((opt->longName || opt->shortName) && 
 	    !(opt->argInfo & POPT_ARGFLAG_DOC_HIDDEN))
 	    singleOptionHelp(f, left, opt, translation_domain);
     }
 
+    if (table != NULL)
     for (opt = table; (opt->longName || opt->shortName || opt->arg); opt++) {
 	if ((opt->argInfo & POPT_ARG_MASK) == POPT_ARG_INCLUDE_TABLE) {
 	    sub_transdom = getTableTranslationDomain(opt->arg);
-	    if(!sub_transdom)
+	    if (sub_transdom == NULL)
 		sub_transdom = translation_domain;
 	    
 	    if (opt->descrip)
@@ -240,7 +248,10 @@ static int showHelpIntro(poptContext con, FILE * f)
 
     fprintf(f, POPT_("Usage:"));
     if (!(con->flags & POPT_CONTEXT_KEEP_FIRST)) {
+	/*@-nullderef@*/	/* LCL: wazzup? */
 	fn = con->optionStack->argv[0];
+	/*@=nullderef@*/
+	if (fn == NULL) return len;
 	if (strchr(fn, '/')) fn = strrchr(fn, '/') + 1;
 	fprintf(f, " %s", fn);
 	len += strlen(fn) + 1;
@@ -253,7 +264,7 @@ void poptPrintHelp(poptContext con, FILE * f, /*@unused@*/ int flags)
 {
     int leftColWidth;
 
-    showHelpIntro(con, f);
+    (void) showHelpIntro(con, f);
     if (con->otherHelp)
 	fprintf(f, " %s\n", con->otherHelp);
     else
@@ -264,15 +275,15 @@ void poptPrintHelp(poptContext con, FILE * f, /*@unused@*/ int flags)
 }
 
 static int singleOptionUsage(FILE * f, int cursor, 
-			     const struct poptOption * opt,
-			     const char *translation_domain)
+		const struct poptOption * opt,
+		/*@null@*/ const char *translation_domain)
 {
     int len = 3;
     char shortStr[2] = { '\0', '\0' };
     const char * item = shortStr;
     const char * argDescrip = getArgDescrip(opt, translation_domain);
 
-    if (opt->shortName) {
+    if (opt->shortName!= '\0' ) {
 	if (!(opt->argInfo & POPT_ARG_MASK)) 
 	    return cursor;	/* we did these already */
 	len++;
@@ -296,47 +307,57 @@ static int singleOptionUsage(FILE * f, int cursor,
     fprintf(f, " [-%s%s%s%s]",
 	((opt->shortName || (opt->argInfo & POPT_ARGFLAG_ONEDASH)) ? "" : "-"),
 	item,
-	(argDescrip ? (opt->shortName ? " " : "=") : ""),
+	(argDescrip ? (opt->shortName != '\0' ? " " : "=") : ""),
 	(argDescrip ? argDescrip : ""));
 
     return cursor + len + 1;
 }
 
-static int singleTableUsage(FILE * f, int cursor,
-	const struct poptOption * opt, const char * translation_domain)
+static int singleTableUsage(FILE * f,
+		int cursor, const struct poptOption * opt,
+		/*@null@*/ const char * translation_domain)
 {
+    /*@-branchstate@*/		/* FIX: W2DO? */
+    if (opt != NULL)
     for (; (opt->longName || opt->shortName || opt->arg) ; opt++) {
-        if ((opt->argInfo & POPT_ARG_MASK) == POPT_ARG_INTL_DOMAIN)
+        if ((opt->argInfo & POPT_ARG_MASK) == POPT_ARG_INTL_DOMAIN) {
 	    translation_domain = (const char *)opt->arg;
-	else if ((opt->argInfo & POPT_ARG_MASK) == POPT_ARG_INCLUDE_TABLE) 
+	} else if ((opt->argInfo & POPT_ARG_MASK) == POPT_ARG_INCLUDE_TABLE) {
+	    if (opt->arg)	/* XXX program error */
 	    cursor = singleTableUsage(f, cursor, opt->arg, translation_domain);
-	else if ((opt->longName || opt->shortName) && 
-		 !(opt->argInfo & POPT_ARGFLAG_DOC_HIDDEN))
+	} else if ((opt->longName || opt->shortName) &&
+		 !(opt->argInfo & POPT_ARGFLAG_DOC_HIDDEN)) {
 	    cursor = singleOptionUsage(f, cursor, opt, translation_domain);
+	}
     }
+    /*@=branchstate@*/
 
     return cursor;
 }
 
-static int showShortOptions(const struct poptOption * opt, FILE * f, char * str)
+static int showShortOptions(const struct poptOption * opt, FILE * f,
+		/*@null@*/ char * str)
 {
-    char s[300];		/* this is larger then the ascii set, so
-				   it should do just fine */
+    char * s = alloca(300);	/* larger then the ascii set */
 
     s[0] = '\0';
+    /*@-branchstate@*/		/* FIX: W2DO? */
     if (str == NULL) {
 	memset(s, 0, sizeof(s));
 	str = s;
     }
+    /*@=branchstate@*/
 
+    if (opt != NULL)
     for (; (opt->longName || opt->shortName || opt->arg); opt++) {
 	if (opt->shortName && !(opt->argInfo & POPT_ARG_MASK))
 	    str[strlen(str)] = opt->shortName;
 	else if ((opt->argInfo & POPT_ARG_MASK) == POPT_ARG_INCLUDE_TABLE)
-	    showShortOptions(opt->arg, f, str);
+	    if (opt->arg)	/* XXX program error */
+		(void) showShortOptions(opt->arg, f, str);
     } 
 
-    if (s != str || !*s)
+    if (s != str || *s != '\0')
 	return 0;
 
     fprintf(f, " [-%s]", s);
@@ -349,7 +370,7 @@ void poptPrintUsage(poptContext con, FILE * f, /*@unused@*/ int flags)
 
     cursor = showHelpIntro(con, f);
     cursor += showShortOptions(con->options, f, NULL);
-    singleTableUsage(f, cursor, con->options, NULL);
+    (void) singleTableUsage(f, cursor, con->options, NULL);
 
     if (con->otherHelp) {
 	cursor += strlen(con->otherHelp) + 1;
diff --git a/poptint.h b/poptint.h
index 066e143..3a3ee9b 100644
--- a/poptint.h
+++ b/poptint.h
@@ -9,6 +9,16 @@
 #ifndef H_POPTINT
 #define H_POPTINT
 
+/**
+ * Wrapper to free(3), hides const compilation noise, permit NULL, return NULL.
+ * @param this		memory to free
+ * @retval		NULL always
+ */
+/*@unused@*/ static inline /*@null@*/ void * _free(/*@only@*/ /*@null@*/ const void * this) {
+    if (this != NULL)	free((void *)this);
+    return NULL;
+}
+
 /* Bit mask macros. */
 typedef	unsigned int __pbm_bits;
 #define	__PBM_NBITS		(8 * sizeof (__pbm_bits))
@@ -20,50 +30,50 @@ typedef struct {
 #define	__PBM_BITS(set)	((set)->bits)
 
 #define	PBM_ALLOC(d)	calloc(__PBM_IX (d) + 1, sizeof(__pbm_bits))
-#define	PBM_FREE(s)	free(s);
+#define	PBM_FREE(s)	_free(s);
 #define PBM_SET(d, s)   (__PBM_BITS (s)[__PBM_IX (d)] |= __PBM_MASK (d))
 #define PBM_CLR(d, s)   (__PBM_BITS (s)[__PBM_IX (d)] &= ~__PBM_MASK (d))
 #define PBM_ISSET(d, s) ((__PBM_BITS (s)[__PBM_IX (d)] & __PBM_MASK (d)) != 0)
 
 struct optionStackEntry {
     int argc;
-/*@only@*/ const char ** argv;
-/*@only@*/ pbm_set * argb;
+/*@only@*/ /*@null@*/ const char ** argv;
+/*@only@*/ /*@null@*/ pbm_set * argb;
     int next;
-/*@only@*/ const char * nextArg;
-/*@keep@*/ const char * nextCharArg;
-/*@dependent@*/ struct poptAlias * currAlias;
+/*@only@*/ /*@null@*/ const char * nextArg;
+/*@keep@*/ /*@null@*/ const char * nextCharArg;
+/*@dependent@*/ /*@null@*/ struct poptAlias * currAlias;
     int stuffed;
 };
 
 struct execEntry {
-    const char * longName;
+/*@owned@*/ /*@null@*/ const char * longName;
     char shortName;
-    const char * script;
+/*@only@*/ /*@null@*/ const char * script;
 };
 
 struct poptContext_s {
     struct optionStackEntry optionStack[POPT_OPTION_DEPTH];
 /*@dependent@*/ struct optionStackEntry * os;
-/*@owned@*/ const char ** leftovers;
+/*@owned@*/ /*@null@*/ const char ** leftovers;
     int numLeftovers;
     int nextLeftover;
 /*@keep@*/ const struct poptOption * options;
     int restLeftover;
-/*@only@*/ const char * appName;
-/*@only@*/ struct poptAlias * aliases;
+/*@only@*/ /*@null@*/ const char * appName;
+/*@only@*/ /*@null@*/ struct poptAlias * aliases;
     int numAliases;
     int flags;
-    struct execEntry * execs;
+/*@owned@*/ /*@null@*/ struct execEntry * execs;
     int numExecs;
-/*@only@*/ const char ** finalArgv;
+/*@only@*/ /*@null@*/ const char ** finalArgv;
     int finalArgvCount;
     int finalArgvAlloced;
-/*@dependent@*/ struct execEntry * doExec;
+/*@dependent@*/ /*@null@*/ struct execEntry * doExec;
 /*@only@*/ const char * execPath;
     int execAbsolute;
 /*@only@*/ const char * otherHelp;
-    pbm_set * arg_strip;
+/*@null@*/ pbm_set * arg_strip;
 };
 
 #ifdef HAVE_LIBINTL_H
diff --git a/poptparse.c b/poptparse.c
index 9133c36..fdce572 100644
--- a/poptparse.c
+++ b/poptparse.c
@@ -18,6 +18,8 @@ int poptDupArgv(int argc, const char **argv,
     char * dst;
     int i;
 
+    if (argc <= 0 || argv == NULL)	/* XXX can't happen */
+	return POPT_ERROR_NOARG;
     for (i = 0; i < argc; i++) {
 	if (argv[i] == NULL)
 	    return POPT_ERROR_NOARG;
@@ -25,6 +27,8 @@ int poptDupArgv(int argc, const char **argv,
     }
 	
     dst = malloc(nb);
+    if (dst == NULL)			/* XXX can't happen */
+	return POPT_ERROR_MALLOC;
     argv2 = (void *) dst;
     dst += (argc + 1) * sizeof(*argv);
 
@@ -34,8 +38,14 @@ int poptDupArgv(int argc, const char **argv,
     }
     argv2[argc] = NULL;
 
-    *argvPtr = argv2;
-    *argcPtr = argc;
+    if (argvPtr) {
+	*argvPtr = argv2;
+    } else {
+	free(argv2);
+	argv2 = NULL;
+    }
+    if (argcPtr)
+	*argcPtr = argc;
     return 0;
 }
 
@@ -48,28 +58,31 @@ int poptParseArgvString(const char * s, int * argcPtr, const char *** argvPtr)
     int argc = 0;
     int buflen = strlen(s) + 1;
     char * buf = memset(alloca(buflen), 0, buflen);
+    int rc = POPT_ERROR_MALLOC;
 
+    if (argv == NULL) return rc;
     argv[argc] = buf;
 
-    for (src = s; *src; src++) {
+    for (src = s; *src != '\0'; src++) {
 	if (quote == *src) {
 	    quote = '\0';
-	} else if (quote) {
+	} else if (quote != '\0') {
 	    if (*src == '\\') {
 		src++;
 		if (!*src) {
-		    free(argv);
-		    return POPT_ERROR_BADQUOTE;
+		    rc = POPT_ERROR_BADQUOTE;
+		    goto exit;
 		}
 		if (*src != quote) *buf++ = '\\';
 	    }
 	    *buf++ = *src;
 	} else if (isspace(*src)) {
-	    if (*argv[argc]) {
+	    if (*argv[argc] != '\0') {
 		buf++, argc++;
 		if (argc == argvAlloced) {
 		    argvAlloced += POPT_ARGV_ARRAY_GROW_DELTA;
 		    argv = realloc(argv, sizeof(*argv) * argvAlloced);
+		    if (argv == NULL) goto exit;
 		}
 		argv[argc] = buf;
 	    }
@@ -81,8 +94,8 @@ int poptParseArgvString(const char * s, int * argcPtr, const char *** argvPtr)
 	  case '\\':
 	    src++;
 	    if (!*src) {
-		free(argv);
-		return POPT_ERROR_BADQUOTE;
+		rc = POPT_ERROR_BADQUOTE;
+		goto exit;
 	    }
 	    /*@fallthrough@*/
 	  default:
@@ -95,9 +108,9 @@ int poptParseArgvString(const char * s, int * argcPtr, const char *** argvPtr)
 	argc++, buf++;
     }
 
-    (void) poptDupArgv(argc, argv, argcPtr, argvPtr);
-
-    free(argv);
+    rc = poptDupArgv(argc, argv, argcPtr, argvPtr);
 
-    return 0;
+exit:
+    if (argv) free(argv);
+    return rc;
 }
diff --git a/system.h b/system.h
index 43ad70f..8015c64 100644
--- a/system.h
+++ b/system.h
@@ -44,12 +44,14 @@ char *alloca ();
 
 /*@only@*/ char * xstrdup (const char *str);
 
+#if !defined(__LCLINT__)
 #if HAVE_MCHECK_H && defined(__GNUC__)
 #define	vmefail()	(fprintf(stderr, "virtual memory exhausted.\n"), exit(EXIT_FAILURE), NULL)
 #define xstrdup(_str)   (strcpy((malloc(strlen(_str)+1) ? : vmefail()), (_str)))
 #else
 #define	xstrdup(_str)	strdup(_str)
 #endif  /* HAVE_MCHECK_H && defined(__GNUC__) */
+#endif /* !__LCLINT__ */
 
 
 #include "popt.h"
diff --git a/test1.c b/test1.c
index 7b7f55f..919ea7c 100644
--- a/test1.c
+++ b/test1.c
@@ -149,7 +149,7 @@ int main(int argc, const char ** argv) {
     fprintf(stdout, "\n");
 
 exit:
-    poptFreeContext(optCon);
+    optCon = poptFreeContext(optCon);
 #if HAVE_MCHECK_H && HAVE_MTRACE
     muntrace();   /* Trace malloc only if MALLOC_TRACE=mtrace-output-file. */
 #endif
diff --git a/test2.c b/test2.c
index 3181c0f..afac1c6 100644
--- a/test2.c
+++ b/test2.c
@@ -133,7 +133,7 @@ main(int argc, const char ** argv) {
     /* although there are no options to be parsed, check for --help */
     poptGetNextOpt(optCon);
 
-    poptFreeContext(optCon);
+    optCon = poptFreeContext(optCon);
 
     printf( "dbusername %s\tdbpassword %s\n"
             "txhost %s\ttxsslport %d\ttxstoreid %d\tpathofkeyfile %s\n"