The Usual Suspects (Unbounded Copies)

• gets(buf) — reads a line with no size limit. Never safe.
• strcpy(dst, src) — copies until a NUL byte, ignores dst size.
• sprintf(buf, fmt, ...) — formats with no length bound.
• strcat / memcpy with an attacker-controlled length.
• read(fd, buf, n) with the wrong n (bigger than buf).
• scanf("%s", buf) — %s with no field width.