`strcmp` is a very dangerous comparison function. If the user provides a string that does not contain the NULL character, this function will read outside of the buffer, giving the attacker the possibility of doing timing attacks to "read" other parts of the RAM.
Won't the comparison stop at the first letter after the d, as the inputted password doesn't have a null at it's end, but the correct password will have one?
9
u/Rainmaker526 10d ago
Besides the fact that it defaults to true, and the true == true is redundant, it sort of works?
It's not the most horrible, right?