Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/Candidate.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/Candidate.h
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/CandidateRepository.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/CandidateRepository.h
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/Character.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/Character.h
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/CharacterRepository.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/CharacterRepository.h
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/ClangCompleter/ClangCompleter.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/ClangCompleter/ClangCompleter.h
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/ClangCompleter/ClangHelpers.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/ClangCompleter/ClangHelpers.h
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/ClangCompleter/ClangUtils.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/ClangCompleter/ClangUtils.h
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/ClangCompleter/CompilationDatabase.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/ClangCompleter/CompilationDatabase.h
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/ClangCompleter/CompletionData.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/ClangCompleter/CompletionData.h
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/ClangCompleter/Diagnostic.h
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/ClangCompleter/Documentation.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/ClangCompleter/Documentation.h
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/ClangCompleter/FixIt.h
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/ClangCompleter/Location.h
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/ClangCompleter/Range.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/ClangCompleter/Range.h
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/ClangCompleter/TranslationUnit.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/ClangCompleter/TranslationUnit.h
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/ClangCompleter/TranslationUnitStore.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/ClangCompleter/TranslationUnitStore.h
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/ClangCompleter/UnsavedFile.h
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/CodePoint.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/CodePoint.h
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/CodePointRepository.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/CodePointRepository.h
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/IdentifierCompleter.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/IdentifierCompleter.h
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/IdentifierDatabase.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/IdentifierDatabase.h
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/IdentifierUtils.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/IdentifierUtils.h
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/PythonSupport.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/PythonSupport.h
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/Result.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/Result.h
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/Utils.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/Utils.h
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/Word.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/Word.h
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/benchmarks/BenchUtils.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/benchmarks/BenchUtils.h
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/benchmarks/IdentifierCompleter_bench.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/benchmarks/PythonSupport_bench.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/benchmarks/main.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/tests/CandidateRepository_test.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/tests/Candidate_test.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/tests/CharacterRepository_test.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/tests/Character_test.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/tests/ClangCompleter/ClangCompleter_test.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/tests/ClangCompleter/TranslationUnit_test.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/tests/CodePointRepository_test.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/tests/CodePoint_test.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/tests/IdentifierCompleter_test.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/tests/IdentifierUtils_test.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/tests/Normalization_test.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/tests/TestUtils.h
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/tests/Utils_test.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/tests/Word_test.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/tests/main.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/tests/testdata/SWObject.h
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/tests/testdata/basic.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/tests/testdata/goto.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/tests/TestUtils.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/versioning.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/versioning.h
Examining data/ycmd-0+20201028+git1d415c5+ds/cpp/ycm/ycm_core.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/examples/samples/some_cpp.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/bindings/testdata/foo.c
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clang/testdata/FixIt_Clang_cpp11.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clang/testdata/GetDoc_Clang.cc
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clang/testdata/GetParent_Clang_test.cc
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clang/testdata/GetType_Clang_test.cc
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clang/testdata/GoTo_Clang_ZeroBasedLineAndColumn_test.cc
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clang/testdata/GoTo_all_Clang_test.cc
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clang/testdata/basic.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clang/testdata/cache_test/foo.h
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clang/testdata/client_data/include.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clang/testdata/client_data/include.hpp
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clang/testdata/client_data/macro.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clang/testdata/client_data/main.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clang/testdata/completion_availability.cc
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clang/testdata/completion_docstring.cc
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clang/testdata/completion_fixit.cc
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clang/testdata/cuda/cuda.h
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clang/testdata/driver_mode_cl/executable/driver_mode_cl.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clang/testdata/driver_mode_cl/executable/driver_mode_cl_include/driver_mode_cl_include.h
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clang/testdata/driver_mode_cl/flag/driver_mode_cl.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clang/testdata/driver_mode_cl/flag/driver_mode_cl_include/driver_mode_cl_include.h
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clang/testdata/general_fallback/lang_c.c
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clang/testdata/general_fallback/lang_cpp.cc
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clang/testdata/get_doc/include/test.hpp
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clang/testdata/get_doc/test.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clang/testdata/location_extent.cc
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clang/testdata/max_diagnostics.cc
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clang/testdata/multiple_missing_includes.cc
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clang/testdata/noflags/basic.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clang/testdata/test-include/Frameworks/OpenGL.framework/Headers/gl.h
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clang/testdata/test-include/Frameworks/common.framework/Headers/dummy.h
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clang/testdata/test-include/a.hpp
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clang/testdata/test-include/dir with spaces/d.hpp
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clang/testdata/test-include/main.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clang/testdata/test-include/quote/b.hpp
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clang/testdata/test-include/system/a.hpp
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clang/testdata/test-include/system/c.hpp
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clang/testdata/unicode.cc
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clang/testdata/unity.cc
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clang/testdata/unity.h
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clang/testdata/unitya.cc
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clangd/testdata/FixIt_Clang_cpp11.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clangd/testdata/GetDoc_Clang_test.cc
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clangd/testdata/GetType_Clang_test.cc
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clangd/testdata/GoTo_Clang_ZeroBasedLineAndColumn_test.cc
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clangd/testdata/basic.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clangd/testdata/cuda/cuda.h
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clangd/testdata/docstring.h
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clangd/testdata/driver_mode_cl/executable/driver_mode_cl.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clangd/testdata/driver_mode_cl/executable/driver_mode_cl_include/driver_mode_cl_include.h
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clangd/testdata/driver_mode_cl/flag/driver_mode_cl.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clangd/testdata/driver_mode_cl/flag/driver_mode_cl_include/driver_mode_cl_include.h
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clangd/testdata/extra_conf/bar.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clangd/testdata/extra_conf/foo.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clangd/testdata/extra_conf/include/foo.h
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clangd/testdata/extra_conf/subdir/include/bar.h
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clangd/testdata/general_fallback/lang_c.c
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clangd/testdata/general_fallback/lang_cpp.cc
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clangd/testdata/general_fallback/make_drink.cc
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clangd/testdata/general_fallback/make_drink.h
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clangd/testdata/goto.cc
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clangd/testdata/location_extent.cc
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clangd/testdata/max_diagnostics.cc
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clangd/testdata/multiple_missing_includes.cc
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clangd/testdata/template.cc
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clangd/testdata/test-include/a.hpp
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clangd/testdata/test-include/dir with spaces/d.hpp
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clangd/testdata/test-include/main.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clangd/testdata/test-include/quote/b.hpp
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clangd/testdata/test-include/system/a.hpp
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clangd/testdata/test-include/system/c.hpp
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clangd/testdata/unicode.cc
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/testdata/filename_completer/inner_dir/test.cpp
Examining data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/testdata/filename_completer/inner_dir/test.hpp

FINAL RESULTS:

data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clang/testdata/test-include/main.cpp:12:11:  [4] (shell) system:
  This causes a new program to execute and is difficult to use safely
  (CWE-78). try using a library call that implements the same functionality
  if available.
#include <system/
data/ycmd-0+20201028+git1d415c5+ds/ycmd/tests/clangd/testdata/test-include/main.cpp:10:11:  [4] (shell) system:
  This causes a new program to execute and is difficult to use safely
  (CWE-78). try using a library call that implements the same functionality
  if available.
#include <system/

ANALYSIS SUMMARY:

Hits = 2
Lines analyzed = 10205 in approximately 0.25 seconds (40629 lines/second)
Physical Source Lines of Code (SLOC) = 6230
Hits@level = [0]   0 [1]   0 [2]   0 [3]   0 [4]   2 [5]   0
Hits@level+ = [0+]   2 [1+]   2 [2+]   2 [3+]   2 [4+]   2 [5+]   0
Hits/KSLOC@level+ = [0+] 0.321027 [1+] 0.321027 [2+] 0.321027 [3+] 0.321027 [4+] 0.321027 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.