Yeah, iirc it was exploitable because it doesn’t do any bounds checking or something like that, right?
It bounds checks just fine, as long as you pass it a null-terminated string. It just returns 0 on error, so there's no way to know if the string was for example, larger than would fit in an int, or even just totally invalid, or if the user actually entered 0.