Safer C.
No rewrite required.

char *buf = malloc(n);
if (buf == NULL) {
    log_error("OOM");
    return -1;
}
// ... 20 more lines

char *buf = malloc(n)
    orelse return -1;

char *src = read_file(path);
if (!src) return -1;

Token *tok = tokenize(src);
if (!tok) {
    free(src);
    return -1;
}

Node *ast = parse(tok);
if (!ast) {
    token_free(tok);
    free(src);
    return -1;
}

int r = emit(ast);
node_free(ast);
token_free(tok);
free(src);
return r;

char *src = read_file(path)
    orelse return -1;
defer free(src);

Token *tok = tokenize(src)
    orelse return -1;
defer token_free(tok);

Node *ast = parse(tok)
    orelse return -1;
defer node_free(ast);

return emit(ast);

const char *get_name(User *u) {
    if (!u) return "unknown";
    if (!u->profile) return "unknown";
    if (!u->profile->name) return "unknown";
    return u->profile->name;
}

const char *get_name(User *u) {
    Profile *p = (u orelse return "unknown")->profile
        orelse return "unknown";
    return p->name orelse "unknown";
}

orelse

Inline error handling without the noise.

Checks any falsy scalar (null pointer, zero integer, zero return code) inline. No nested if-blocks, no repeated cleanup calls, no diverging error paths. Works with return, break, continue, goto, or a fallback value.

int process(const char *path) {
    FILE *f = fopen(path, "r");
    if (!f) goto done;
    defer fclose(f); // skipped!
    do_work(f);
done:
    return 0; // f never closed
}

int process(const char *path) {
    FILE *f = fopen(path, "r");
    if (!f) goto done;
    defer fclose(f);
    do_work(f);
done:
    // error: goto 'done' skips over
    // defer fclose(f)
    return 0;
}

switch (cmd) {
    case CMD_INIT:
        db = db_open(path);
        // forgot break: falls through
    case CMD_RUN:
        // db may not be open here
        db_exec(db, query);
        break;
}

switch (cmd) {
    case CMD_INIT:
        db = db_open(path);
        defer db_close(db);
        db_init(db);
    case CMD_RUN: // error: case CMD_RUN
        // skips over defer db_close(db)
        db_exec(db, query);
        break;
}

// somewhere in your codebase:
jmp_buf g_recover;

int parse_file(const char *path) {
    char *buf = read_file(path);
    if (!buf) return -1;
    // if inner longjmp fires: buf leaks
    int r = parse(buf); // may longjmp
    free(buf);
    return r;
}

int parse_file(const char *path) {
    char *buf = read_file(path)
        orelse return -1;
    defer free(buf);
    // error: defer forbidden: 
    // function calls setjmp.
    // longjmp would bypass cleanup.
    return parse(buf);
}

safety

Control flow Prism catches.
C doesn't.

CFG analysis runs before any output is emitted. goto jumping over declarations, switch fallthrough skipping active defers, defer in setjmp/vfork/asm functions: all compile errors, not silent bugs.

check

Static analysis that
sees your cleanup.

Prepend prism check to the analyzer you already run. Source arguments are transpiled to standard C behind the scenes, every other flag passes through untouched, the tool's exit code is preserved, and #line directives map each finding back to your original line numbers.

Analyzing the expansion beats analyzing the source: the analyzer sees the real control flow, cleanup included. A manual fclose(f) before an early return alongside defer fclose(f); comes back as doubleFree. No source-level C analyzer catches that, because none of them parse defer.

prism check cppcheck --enable=all src.c

// src.c:12:4: error: Array 'arr[8]' accessed
//            at index 8, out of bounds

// The finding cites src.c line 12, not a line
// in the generated artifact.

FILE *f = fopen(path, "r")
    orelse return -1;
defer fclose(f);

if (bad) {
    fclose(f);  // then defer runs too
    return -1;
}

// src.c:14:9: error: doubleFree: Resource
//            handle 'f' freed twice

// Anything after the tool name is verbatim
prism check clang-tidy src.c -- -I include

// Prism flags before `check` still apply
prism -fno-zeroinit check cppcheck src.c

// Artifact is shaped for analysis: headers stay
// unflattened, subscripts stay bare, so the tool
// sees arr[8] and not a bounds-check wrapper.
// Your shipping build keeps both features on.

Prism is built and maintained by one person, in the open, for free.

If it saves you time or makes your C safer, sponsoring is how you keep that going. Every sponsor directly funds time on new features, bug fixes, and keeping the test suite green.