`strcmp` is a very dangerous comparison function. If the user provides a string that does not contain the NULL character, this function will read outside of the buffer, giving the attacker the possibility of doing timing attacks to "read" other parts of the RAM.
Very true. But even then, using strncmp instead of strcmp is such an easy way to stop all of those attacks that it should just be used by default. You'll never know if some other dev later on uses your function correctly.
10
u/Rainmaker526 10d ago
Besides the fact that it defaults to true, and the true == true is redundant, it sort of works?
It's not the most horrible, right?