cybersecurity · intermediate · ~15 min · safe pentest lab

Count unsafe calls

Tally several dangerous patterns.

Challenge

Tally the classic unbounded-copy calls in a source snippet.

Task

Implement int count_unsafe(const char *code) that returns the total number of occurrences of "strcpy(", "strcat(", "sprintf(", and "gets(" (summed across all four).

Input

  • code: a NUL-terminated string of C source text the grader passes.

Output

Returns int: the combined count of all four unsafe-call substrings.

Example

count_unsafe("strcpy(a,b); x; sprintf(c,\"%d\",n);")   ->   2
count_unsafe("snprintf(c,n,fmt);")                     ->   0

Edge cases

  • No unsafe calls returns 0.
  • snprintf( does not contain sprintf(, so a safe snprintf call is not counted.

Rules

  • Detection only — scan the string the grader passes, advancing past each match.

Input format

A NUL-terminated string code of C source text.

Output format

An int: the summed count of the four unsafe-call substrings.

Constraints

Count strcpy(, strcat(, sprintf(, gets(; advance past each hit.

Starter code

#include <string.h>

int count_unsafe(const char *code) {
    /* TODO */
    return 0;
}

Solve this exercise in the browser editor — compile and run against the test harness, no setup required.