Old-style C string manipulation seems to be a bugaboo for a lot of people.
I've got two right here in my emacs buffer. Example 1:
strcpy(label, "\0");
strcpy(comm1, "\0");   //!!!20060818 Added protective code for missing nulls
strcpy(comm2, "\0");
strcpy(dir, "\0");
This is basically calling a routine with all the associated overhead just to do:
label[0] = '\0';
Here's an even more fancy variant later on in the code:
strncpy(inq.szComment, "\0", 1);
Again, this is just a really elaborate and slow way to assign the nul character '\0' to the first element of inq.szComment.
Example 2:
// This is always good for string operations, but may not be necessary.
strcat(RpRecPrefix, "\0");
strcat(RpCircPrefix, "\0");
strcat(RpEventPrefix, "\0");
strcat(RpFdk, "\0");
strcat(RpAic, "\0");
strcat(RpDcl, "\0");
strcat(RpVis, "\0");
strcat(RpSnd, "\0");
strcat(RpL3Fsi, "\0");
strcat(RpStartState, "\0");
strcat(RpContRun, "\0");
These find the null at the end of the first string parameter, and then do nothing. I can't tell if the author thought he was protecting against not having a terminating nul, or if he thought this would somehow tack an extra nul at the end. Either way, he was wrong.
OK. Here's my personal favorite.
  if ( *pnFrequency == 1 ) {
      sprintf(szLogMsg, "Write to disk speed = %d bytes/sec at 1 Hz",
              *pliWriteRate);
  }
  else if ( *pnFrequency == 2 ) {
      sprintf(szLogMsg, "Write to disk speed = %d bytes/sec at 2 Hz", 
              *pliWriteRate);
  }
  else if ( *pnFrequency == 4 ) {
      sprintf(szLogMsg, "Write to disk speed = %d bytes/sec at 4 Hz", 
              *pliWriteRate);
  }
  else if ( *pnFrequency == 10 ) {
      sprintf(szLogMsg, "Write to disk speed = %d bytes/sec at 10 Hz", 
              *pliWriteRate);
  }
  else if ( *pnFrequency == 20 ) {
      sprintf(szLogMsg, "Write to disk speed = %d bytes/sec at 20 Hz", 
              *pliWriteRate);
  }
  else if ( *pnFrequency == 40 ) {
      sprintf(szLogMsg, "Write to disk speed = %d bytes/sec at 40 Hz", 
              *pliWriteRate);
  }
  else if ( *pnFrequency == 60 ) {
      sprintf(szLogMsg, "Write to disk speed = %d bytes/sec at 60 Hz", 
              *pliWriteRate);
  }
  else { // above frequencies used for analysis
      sprintf(szLogMsg, "Write to disk speed = %d bytes/sec", *pliWriteRate);
  }
Note that the value of *pnFrequency we check for in every branch is identical to the value hard-coded into its sprintf, and that is the only difference in any and every branch. The whole thing should have been:
sprintf(szLogMsg, "Write to disk speed = %d bytes/sec at %d Hz", *pliWriteRate,
        *pnFrequency);
I just simply can't imagine how this file got to be 12,000 lines long...