Developer Audits Student C Project, Finds 13 Bugs Including Auth Bypass and Buffer Overflow
A developer audited a C-based campus tour guide system — a second-year data structures project — and uncovered 13 bugs before publishing it. The most critical flaw was an authentication bypass: the Login() function correctly validated credentials and returned a success code, but the calling code ignored the return value and always launched the admin panel regardless of login outcome. A second bug in the same function used recursion instead of a loop on failed attempts, meaning repeated wrong passwords could cause a stack overflow. A separate buffer overflow was traced to a GBK-to-UTF-8 encoding change, where a location name grew from 16 to 24 bytes and silently overwrote an adjacent struct field. The audit highlights how even simple, coursework-level code can harbor serious security and memory safety issues when return values go unchecked and buffer sizes are not updated alongside data changes.
