cybersecurity · beginner · ~15 min · safe pentest lab

Does the code call strcpy?

Grep source for an unsafe call.

Challenge

Grep a snippet of source for an unbounded strcpy( call — the simplest static audit.

Task

Implement int uses_strcpy(const char *code) that returns 1 if code contains the substring "strcpy(", else 0.

Input

  • code: a NUL-terminated string of C source text the grader passes.

Output

Returns int: 1 if "strcpy(" appears anywhere in code, else 0.

Example

uses_strcpy("strcpy(dst, src);")       ->   1
uses_strcpy("strncpy(dst, src, n);")   ->   0

Edge cases

  • The ( is part of the match, so strncpy( and strcpy_s( do not trigger.

Rules

  • Detection only — operate on the string the grader passes.

Input format

A NUL-terminated string code of C source text.

Output format

An int: 1 if code contains "strcpy(", else 0.

Constraints

Match strcpy( with the paren to avoid strncpy/strcpy_s.

Starter code

#include <string.h>

int uses_strcpy(const char *code) {
    /* TODO */
    return 0;
}

Solve this exercise in the browser editor — compile and run against the test harness, no setup required.