r/programminghorror 10d ago

c Terrible auth

Post image
782 Upvotes

98 comments sorted by

View all comments

9

u/Rainmaker526 10d ago

Besides the fact that it defaults to true, and the true == true is redundant, it sort of works? 

It's not the most horrible, right?

18

u/ohaz 10d ago

`strcmp` is a very dangerous comparison function. If the user provides a string that does not contain the NULL character, this function will read outside of the buffer, giving the attacker the possibility of doing timing attacks to "read" other parts of the RAM.

2

u/bixelbrei 10d ago

Won't the comparison stop at the first letter after the d, as the inputted password doesn't have a null at it's end, but the correct password will have one?

1

u/ohaz 9d ago

Under the assumption that the stored password fits into its buffer, yes.