// gt-0005: Recursive function with sink // Expected: REACHABLE (tier: executed) // Vulnerability: CWE-134 (Format String) #include #include char result[1024]; void process_recursive(const char *input, int depth) { if (depth <= 0 || strlen(input) == 0) { return; } // Vulnerable: format string in recursive context sprintf(result + strlen(result), input); // SINK: CWE-134 // Recurse with modified input process_recursive(input + 1, depth - 1); } int main(int argc, char *argv[]) { result[0] = '\0'; if (argc > 1) { process_recursive(argv[1], 5); printf("Result: %s\n", result); } return 0; }