What I learned from my first C coding challenge

Re:What I learned from my first C coding challenge by tptacek on Tuesday September 04, 2012 @03:29PM (#4476121)

No, strcmp is not susceptible to buffer overflow attacks.

[ Parent | on HN ]

Re:What I learned from my first C coding challenge by jparishy on Tuesday September 04, 2012 @03:35PM (#4476153)

https://buildsecurityin.us-cert.gov/bsi-rules/home/g1/847-BS...

If passed an unterminated string, the function will fail at least. How much you could exploit from that, I guess I exaggerated.

[ Parent | on HN ]

Re:What I learned from my first C coding challenge by tptacek on Tuesday September 04, 2012 @03:39PM (#4476176)

That's not a buffer overflow.

This whole subthread of picking on the guy's implementation because of "strcmp" is pretty silly. There are times where strcpy() is safe to use, but most of the time it's a red flag. There are conceivably times when strcmp() is unsafe to use, but to a professional reviewer, it is very rarely a red flag.

I should have just come right out and said that, rather than begging for the rationale for picking on strcmp().

[ Parent | on HN ]