I've learned the hard way that the functions to focus on in a C code review are:

malloc, calloc, realloc, memcpy, memset, memcmp, strcpy, strncpy, and a few others. They're a rich source bugs, usually:

1. an off-by-one error due to the terminating 0

2. an overflow vulnerability (particularly with malloc/calloc/realloc)