Fix a toy buffer overflow

Challenge

You're given a vulnerable function that copies a string into a fixed-size buffer with no bounds check:

void render(const char *user_input, char *banner) {
    strcpy(banner, "Welcome, ");
    strcat(banner, user_input);
}

Rewrite as int render_safe(const char *user_input, char *banner, size_t banner_sz) that produces "Welcome, <input>", returning 0 on success or -1 on overflow (caller's buffer untouched on overflow except for guaranteed NUL termination).

Why this matters

Patching a deliberately vulnerable function teaches the diagnostic mindset: spot the unbounded write, audit the destination size, replace with a bounded equivalent. This is the daily work of security auditors.

Starter code

#include <stdio.h>
#include <string.h>

int render_safe(const char *user_input, char *banner, size_t banner_sz) {
    /* TODO */
    return -1;
}

Common mistakes

Replacing only the symptom (the obvious strcpy) without checking the rest of the function — overflows often come in pairs. Using strncpy (gotcha — doesn't NUL-terminate when source fits exactly).

Edge cases to handle

Maximum-length input. Empty input. Input containing NUL bytes (rare in text, common in binary).

Complexity

O(input length).

Background lessons

• Buffer overflow basics
• String safety and bounded operations

Up next

• Detect a buffer overflow with a canary
• Fix the sprintf overflow