It returns the result r, which is a temporary, stack allocated array that becomes undefined by the time your return from the function. That’s the worst violation.

Furthermore, r is a fixed 100 bytes. There is no overflow checking whatsoever.