V2635. MISRA. The function with the 'system' name should not be used.

This diagnostic rule is based on the MISRA (Motor Industry Software Reliability Association) software development guidelines.

This diagnostic rule is relevant only for C.

The system function should not be used, and no macro with a similar name should be expanded.

If the argument of the system function is not sanitized, it can cause exploitable vulnerabilities. An attacker can execute arbitrary commands or read and modify data anywhere on the system.

The code example where the analyzer issues the warning:

void PositiveTestFuncall() { system("mkdir tmp_dir"); system("chmod 777 ./myfile"); }

The analyzer will also issue warnings for using macros with this name:

#define system printf("msg\n"); void PositiveTestMacro() { system("gcc --version"); }

This diagnostic is classified as:

Was this page helpful?

Message submitted.

Your message has been sent. We will email you at

If you do not see the email in your inbox, please check if it is filtered to one of the following folders:

• Promotion
• Updates
• Spam