cybersecurity · intermediate · ~12 min · safe pentest lab
Bounded text-token extraction with character allow-list.
Extract the method token from a SIP request, validating it strictly — SIP gateways live on the public internet, so rejecting malformed methods early is cheap insurance.
Implement int parse_sip_method(const char *msg, char *out, size_t cap) that copies the leading method token (everything up to the first space) into out, NUL-terminating, and returns the number of bytes written.
msg: a NUL-terminated SIP message the grader passes.out, cap: the output buffer and its capacity.Returns int: the number of bytes written (the method length) on success, or -1 on failure.
"INVITE sip:a@b SIP/2.0\r\n", cap 8 -> out = "INVITE", returns 6
"REGISTER sip:a", cap 8 -> -1 (8 chars + NUL exceeds cap)
"register sip:...", cap 32 -> -1 (lowercase)
msg, NULL out, or cap == 0 returns -1.A-Z returns -1 (this also rejects an embedded NUL).cap with room for the NUL.A-Z only for method characters.SIP gateways live on the public internet. Rejecting malformed methods at the door is cheap; missing the check is expensive.
A NUL-terminated SIP message, a bounded output buffer, and its capacity.
Bytes written (positive int) on success, -1 on any failure.
msg is SIP request line; out receives method token with capacity cap.
#include <stddef.h>
int parse_sip_method(const char *msg, char *out, size_t cap) {
/* TODO */
(void)msg; (void)out; (void)cap;
return -1;
}
Writing past cap or accepting non-uppercase tokens.
Missing space delimiter, lowercase letters in method, method length exceeding cap.
O(1) — bounded loop over at most 16 bytes.
Solve this exercise in the browser editor — compile and run against the test harness, no setup required.