cppLogic errorMedium

C-style string buffer overflow with sprintf

Time: 0:00

BugFind the bug and fix the code

What it should do

Format ID prefix and number into string. Example: formatIdString("USER", 12345) -> "USER-12345"

What happens instead

Buffer overflow / stack smashing detected when formatting long string

#include <iostream>
#include <cstdio>
#include <string>

std::string formatIdString(std::string prefix, int id) {
    char buffer[8];
    // sprintf does not check bounds; overflows buffer[8]
    sprintf(buffer, "%s-%d", prefix.c_str(), id);
    return std::string(buffer);
}

int main() {
    std::cout << formatIdString("USER", 12345) << std::endl;
    return 0;
}

Test a custom input to verify an edge case (e.g. empty lists, negative numbers, duplicates).

⏱️0:00

Hints

🏆 0 hints = Flawless Solve

Think & Test Cooldown

2:00 remaining

Take a moment to read the bug symptom and trace the code with Run & Check before unlocking Hint 1.

Hint 2

Unlocks after Hint 1

Hint 3

Unlocks after Hint 2

This bug belongs to the logic errors pattern

The wrong operator, an inverted condition, a formula the right way round but backwards.

Learn the logic errors pattern Step through your own code

<iframe src="https://trybughunt.com/embed/c85f2c66-543d-4c28-9990-fbc492ecc816" title="Debugging challenge: C-style string buffer overflow with sprintf" width="100%" height="580" loading="lazy" style="border:1px solid #d4d4d8;border-radius:12px;max-width:760px"></iframe> <p style="font-size:14px">Debugging challenge from <a href="https://trybughunt.com/challenges/c85f2c66-543d-4c28-9990-fbc492ecc816">TryBugHunt</a></p>

#include <iostream> #include <cstdio> #include <string> std::string formatIdString(std::string prefix, int id) { char buffer[8]; // sprintf does not check bounds; overflows buffer[8] sprintf(buffer, "%s-%d", prefix.c_str(), id); return std::string(buffer); } int main() { std::cout << formatIdString("USER", 12345) << std::endl; return 0; }

C-style string buffer overflow with sprintf

What it should do

What happens instead

More logic errors to practise

C-style string buffer overflow with sprintf

What it should do

What happens instead

More logic errors to practise