Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/fcitx-m17n-0.2.4/im/config.c
Examining data/fcitx-m17n-0.2.4/im/fcitx-m17n.c
Examining data/fcitx-m17n-0.2.4/im/fcitx-m17n.h
Examining data/fcitx-m17n-0.2.4/im/i18nname.c
Examining data/fcitx-m17n-0.2.4/im/keyname.h
Examining data/fcitx-m17n-0.2.4/im/keysymname.c
Examining data/fcitx-m17n-0.2.4/im/keysymname.h
Examining data/fcitx-m17n-0.2.4/im/minput_list.c
Examining data/fcitx-m17n-0.2.4/im/minput_list.h
Examining data/fcitx-m17n-0.2.4/im/overrideparser.c
Examining data/fcitx-m17n-0.2.4/im/overrideparser.h
Examining data/fcitx-m17n-0.2.4/testmim/testmim.cc
Examining data/fcitx-m17n-0.2.4/testmim/testoverride.c

FINAL RESULTS:

data/fcitx-m17n-0.2.4/im/fcitx-m17n.c:319:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char temp[2] = " ";
data/fcitx-m17n-0.2.4/im/fcitx-m17n.c:347:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char prefix[20] = "";
data/fcitx-m17n-0.2.4/im/fcitx-m17n.c:352:9:  [2] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused). Risk is low because the
  source is a constant string.
        strcat(prefix, "S-");
data/fcitx-m17n-0.2.4/im/fcitx-m17n.c:355:9:  [2] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused). Risk is low because the
  source is a constant string.
        strcat(prefix, "C-");
data/fcitx-m17n-0.2.4/im/fcitx-m17n.c:358:9:  [2] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused). Risk is low because the
  source is a constant string.
        strcat(prefix, "M-");
data/fcitx-m17n-0.2.4/im/fcitx-m17n.c:361:9:  [2] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused). Risk is low because the
  source is a constant string.
        strcat(prefix, "A-");
data/fcitx-m17n-0.2.4/im/fcitx-m17n.c:365:9:  [2] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused). Risk is low because the
  source is a constant string.
        strcat(prefix, "G-");
data/fcitx-m17n-0.2.4/im/fcitx-m17n.c:368:9:  [2] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused). Risk is low because the
  source is a constant string.
        strcat(prefix, "s-");
data/fcitx-m17n-0.2.4/im/fcitx-m17n.c:371:9:  [2] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused). Risk is low because the
  source is a constant string.
        strcat(prefix, "H-");
data/fcitx-m17n-0.2.4/im/keysymname.c:44:12:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    static char buf[100];
data/fcitx-m17n-0.2.4/im/keysymname.c:50:9:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
        sprintf (buf, "U+%.04X", (keyval & 0x00ffffff));
data/fcitx-m17n-0.2.4/im/keysymname.c:68:9:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
        sprintf (buf, "%#x", keyval);
data/fcitx-m17n-0.2.4/im/overrideparser.c:51:28:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
            int priority = atoi(sPriority);
data/fcitx-m17n-0.2.4/im/overrideparser.h:7:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char lang[LANGCODE_LENGTH + 1];
data/fcitx-m17n-0.2.4/testmim/testmim.cc:20:12:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    static char line[NLINE];
data/fcitx-m17n-0.2.4/testmim/testmim.cc:243:13:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
            char buf[2] = " ";
data/fcitx-m17n-0.2.4/testmim/testoverride.c:6:16:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    FILE* fp = fopen(argv[1], "r");
data/fcitx-m17n-0.2.4/im/fcitx-m17n.c:136:13:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        if (strlen(s) != 0) {
data/fcitx-m17n-0.2.4/im/fcitx-m17n.c:213:29:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        toShow = toShow || (strlen(preedit) != 0);
data/fcitx-m17n-0.2.4/im/fcitx-m17n.c:214:13:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        if (strlen(preedit) > 0) {
data/fcitx-m17n-0.2.4/im/fcitx-m17n.c:224:13:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        if (strlen(mstatus) != 0) {
data/fcitx-m17n-0.2.4/im/fcitx-m17n.c:339:29:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        if (base == NULL || strlen(base) == 0) {
data/fcitx-m17n-0.2.4/im/fcitx-m17n.c:710:25:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        size_t nbytes = strlen(text);
data/fcitx-m17n-0.2.4/im/overrideparser.c:49:17:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
            if (strlen(lang) > LANGCODE_LENGTH)
data/fcitx-m17n-0.2.4/im/overrideparser.c:55:13:  [1] (buffer) strncpy:
  Easily used incorrectly; doesn't always \0-terminate or check for invalid
  pointers [MS-banned] (CWE-120).
            strncpy(item->lang, lang, LANGCODE_LENGTH);
data/fcitx-m17n-0.2.4/testmim/testmim.cc:23:17:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        int n = strlen(line);
data/fcitx-m17n-0.2.4/testmim/testmim.cc:42:62:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    int re = fprintf(of, "%s(%lu/%lu)", buf, (unsigned long) strlen((char*)buf), (unsigned long) bufsize);

ANALYSIS SUMMARY:

Hits = 27
Lines analyzed = 5311 in approximately 0.17 seconds (31847 lines/second)
Physical Source Lines of Code (SLOC) = 4961
Hits@level = [0]  25 [1]  10 [2]  17 [3]   0 [4]   0 [5]   0
Hits@level+ = [0+]  52 [1+]  27 [2+]  17 [3+]   0 [4+]   0 [5+]   0
Hits/KSLOC@level+ = [0+] 10.4818 [1+] 5.44245 [2+] 3.42673 [3+]   0 [4+]   0 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.