Mfcttrf

I'm making a simple program that generate some random password of some lenght with or without special characters, just for the sake of learning the C language. Finally I've got this working very well based on the outputs below:

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <time.h>


char *generate_random_password(int password_lenght, int has_special_characters)

 const char *letters = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
 const char *digits = "0123456789";
 const char *special_characters = "!"#$%&'()*+,-./:;<=>?@[\]^_`~";

 char *random_password = malloc(sizeof(char) * (password_lenght+1));

 srandom(time(NULL));

 if(has_special_characters)
 
 char to_be_used[95] = "";

 strcat(to_be_used, letters);
 strcat(to_be_used, digits);
 strcat(to_be_used, special_characters);

 for(int i = 0; i < password_lenght; i++)
 
 const int random_index = random() % strlen(to_be_used);
 const char random_character = to_be_used[random_index];

 random_password[i] = random_character;
 
 
 else
 
 char to_be_used[63] = "";

 strcat(to_be_used, letters);
 strcat(to_be_used, digits);

 for(int i = 0; i < password_lenght; i++)
 
 const int random_index = random() % strlen(to_be_used);
 const char random_character = to_be_used[random_index];

 random_password[i] = random_character;
 
 

 return random_password;

 free(random_password);



int main(void)

 printf("%sn", generate_random_password(17, 1));
 printf("%sn", generate_random_password(17, 0));

 return 0;

The output is:

|ZzN>^5}8:i-P8197

vPrbfzBEGzmSdaPPP

It's working!

But I'm completely in doubt about this strings, pointers, char arrays, etc. I have no idea if this is written "the right way" or how it should be better. I'm concerned if I allocated the right amount for each string/char array, and if it can break or crash in some future.

PS: I'm new at C programming, that's why I don't know much about pointers and memory management yet.

If can anyone give me some feedback about it I will be very grateful!

Typo

lenght is spelled length.

Magic numbers

What does 95 signify? You'll want to put this in a named #define or a const.

Allocation failure

After calling malloc, always check that you've been given a non-null pointer. Allocation failure does happen in real life.

Indentation

You'll want to run this through an autoformatter, because your if block has wonky indentation and needs more columns to the right.

Inaccessible statement

 return random_password;

 free(random_password);

This free will never be called; delete it.

Random

The larger conceptual problem with this program is that it uses a very cryptographically weak pseudorandom number generator. This is a large and fairly complex topic, so you'll need to do some reading, but asking for random data from an entropy-controlled system source will already be better than using C rand.

That aside: you aren't calling rand, you're calling random:

The random() function uses a nonlinear additive feedback random number generator employing a default table of size 31 long integers to return successive pseudo-random numbers in the range from 0 to RAND_MAX. The period of this random number generator is very large, approximately 16 * ((2^31) - 1).

It's probably not appropriate for cryptographic purposes. Have a read through this:

https://stackoverflow.com/questions/822323/how-to-generate-a-random-int-in-c/39475626#39475626

Whilst your code works, there are a number of simplifications that you might try.

1) As Reinderien says, get rid of "magic" numbers

2) Having done that, declare a single string containing all 95 characters with the special ones last. This does away with all the strcat code.

3) It's good practice to declare has_special_characters as type bool. Depending on the flavour of C you are using, you may have to include stdbool.h.

4) You can then test it to set an integer variable, modulus_divider, to the correct const or #define value as in 1)

5) You can then take the modulus of the random number with modulus_divider That way you don't need to keep using strlen(to_be_used)and you only need one generating loop.

6) You don't really need all the intermediate variables in your for loop. Assuming you have set up char_set as you full 94 character array as in 2), your entire for loop could become

for(int i = 0; i < password_lenght; i++)

 random_password[i] = char_set[random() % modulus_divider];