cybersecurity · intermediate · ~15 min · safe pentest lab
Write a tiny static-analysis pass for high-risk APIs.
Write a tiny static-analysis pass that counts calls to high-risk C functions in a snippet of source text.
Implement int count_dangerous_calls(const char *source) that counts how many times any of these names appears as a function call in source: strcpy, strcat, sprintf, gets, system.
A call is the exact identifier immediately followed by (, with optional whitespace between the name and the (. The match must be on a whole identifier — mystrcpy( and strcpyx( do not count.
source: a NUL-terminated string of C source text. The grader passes a fixed snippet baked into the harness.Returns a non-negative int: the total number of matching calls (each occurrence counts once).
"strcpy(a, b);" -> 1
"mystrcpy(a, b);" -> 0 (substring, not a call)
"gets(buf); sprintf(out, \"hi\"); strcat(a, b);" -> 3
"strcpy (a,b);" -> 1 (whitespace before `(`)
(._ (otherwise it is part of a longer identifier).A NUL-terminated string source of C source text.
A non-negative int: the count of dangerous-function calls found.
Match whole identifiers followed by ( (whitespace allowed); operate on the buffer only.
#include <stdio.h>
#include <string.h>
#include <ctype.h>
int count_dangerous_calls(const char *source) {
/* TODO */
return 0;
}
Solve this exercise in the browser editor — compile and run against the test harness, no setup required.