diff --git a/ChangeLog b/ChangeLog
index 24334a5c..cf9ea9e2 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+2009-04-22  Nicolas François  <nicolas.francois@centraliens.net>
+
+	* lib/gshadow.c, lib/commonio.h: Added splint annotations.
+
 2009-04-22  Nicolas François  <nicolas.francois@centraliens.net>
 
 	* lib/get_gid.c: gidstr should not be NULL, but the check was
diff --git a/lib/commonio.h b/lib/commonio.h
index e468db58..668318ab 100644
--- a/lib/commonio.h
+++ b/lib/commonio.h
@@ -58,7 +58,7 @@ struct commonio_ops {
 	 * Make a copy of the object (for example, struct passwd)
 	 * and all strings pointed by it, in malloced memory.
 	 */
-	void *(*dup) (const void *);
+	/*@null@*/ /*@only@*/void *(*dup) (const void *);
 
 	/*
 	 * free() the object including any strings pointed by it.
@@ -87,7 +87,7 @@ struct commonio_ops {
 	 * fgets and fputs (can be replaced by versions that
 	 * understand line continuation conventions).
 	 */
-	char *(*fgets) (char *, int, FILE *);
+	/*@null@*/char *(*fgets) (/*@returned@*/ /*@out@*/char *s, int n, FILE *stream);
 	int (*fputs) (const char *, FILE *);
 
 	/*
diff --git a/lib/gshadow.c b/lib/gshadow.c
index 202cad3a..61d42815 100644
--- a/lib/gshadow.c
+++ b/lib/gshadow.c
@@ -40,11 +40,11 @@
 #include <stdio.h>
 #include "prototypes.h"
 #include "defines.h"
-static FILE *shadow;
+static /*@null@*/FILE *shadow;
 static char sgrbuf[BUFSIZ * 4];
-static char **members = NULL;
+static /*@null@*//*@only@*/char **members = NULL;
 static size_t nmembers = 0;
-static char **admins = NULL;
+static /*@null@*//*@only@*/char **admins = NULL;
 static size_t nadmins = 0;
 static struct sgrp sgroup;
 
@@ -79,7 +79,7 @@ static int bind_nis (void)
 }
 #endif
 
-static char **build_list (char *s, char **list[], size_t * nlist)
+static /*@null@*/char **build_list (char *s, char **list[], size_t * nlist)
 {
 	char **ptr = *list;
 	size_t nelem = *nlist, size;
@@ -129,7 +129,7 @@ void endsgent (void)
 	shadow = (FILE *) 0;
 }
 
-struct sgrp *sgetsgent (const char *string)
+/*@observer@*//*@null@*/struct sgrp *sgetsgent (const char *string)
 {
 	char *fields[FIELDS];
 	char *cp;
@@ -197,7 +197,7 @@ struct sgrp *sgetsgent (const char *string)
  * converts it to a (struct sgrp).  NULL is returned on EOF.
  */
 
-struct sgrp *fgetsgent (FILE * fp)
+/*@observer@*//*@null@*/struct sgrp *fgetsgent (/*@null@*/FILE * fp)
 {
 	char buf[sizeof sgrbuf];
 	char *cp;
@@ -230,7 +230,7 @@ struct sgrp *fgetsgent (FILE * fp)
  * getsgent - get a single shadow group entry
  */
 
-struct sgrp *getsgent (void)
+/*@observer@*//*@null@*/struct sgrp *getsgent (void)
 {
 #ifdef	USE_NIS
 	bool nis_1_group = false;
@@ -329,7 +329,7 @@ struct sgrp *getsgent (void)
  * getsgnam - get a shadow group entry by name
  */
 
-struct sgrp *getsgnam (const char *name)
+/*@observer@*//*@null@*/struct sgrp *getsgnam (const char *name)
 {
 	struct sgrp *sgrp;
 
@@ -452,7 +452,8 @@ int putsgent (const struct sgrp *sgrp, FILE * fp)
 		strcpy (cp, sgrp->sg_adm[i]);
 		cp += strlen (cp);
 	}
-	*cp++ = ':';
+	*cp = ':';
+	cp++;
 
 	/*
 	 * Now do likewise with the group members.