Thank you for taking the time to explain. Also the fact that a total stranger to this code (like me) can even reason about it, is incredible. My point was not

Thank you for taking the time to explain. Also the fact that a total stranger to this code (like me) can even reason about it, is incredible. My point was not so much that there is a bug, but more that the assumptions that this function makes are not obvious (to me at least) from its signature or the header comment. I could easily imagine someone using this function assuming that it does, you know, time insensitive string comparison, but this is only true in a very limited context. Even renaming vars to `a_unchangeable` and `b_user_controlled` (or a comment) would help. But again, this is just a very minor point from a passing stranger, so feel free to ignore it. :) And thanks for providing Redis!