As others have suggested, talk to the original developer, document the problems and keep your boss informed. If you are a contractor being supplied by one firm to another, keep the appropriate people at both companies informed.
Also, look for ways to measure the problems. First, can you run the code through lint(1) or crank the compiler options up to reveal problems? Then can you add runtime error checking or data validation code? This may help you fix things and/or be useful as documentation.
Once, when working as a tech writer, I wrote a half a dozen little scripts to inspect 600,000 lines of C from a dozen programmers. Hmmm. Less than 5% of switch() statements had a default: case for error-checking. Less than 20 uses of the assert() macro in the whole code base. And so on.
The programmers mostly came from a Pascal-like environment so almost none were using C idioms like if( (p = fopen(...)) == NULL) for error checking. That is OK but I found dozens of cases where they were allocating memory, starting processes or opening files, sockets or pipes with no error checking at all.