You strcpy into a 64-byte stack buffer and return the dangling pointer like it's a gift. That thing survives the return statement by coincidence alone, and there's nothing stopping 65 happy characters from taking the whole program down with it.