4 ms·

https://buildsecurityin.us-cert.gov/bsi-rules/home/g1/847-BSI.html https://buildsecurityin.us-cert.gov/bsi-rules/home/g1/847-BS... If passed an unterminated st

https://buildsecurityin.us-cert.gov/bsi-rules/home/g1/847-BSI.html https://buildsecurityin.us-cert.gov/bsi-rules/home/g1/847-BS... If passed an unterminated string, the function will fail at least. How much you could exploit from that, I guess I exaggerated.

tptacek 14y ago
That's not a buffer overflow. This whole subthread of picking on the guy's implementation because of "strcmp" is pretty silly. There are times where strcpy() is safe to use, but most of the time it's a red flag. There are conceivably times when strcmp() is unsafe to use, but to a professional reviewer, it is very rarely a red flag. I should have just come right out and said that, rather than begging for the rationale for picking on strcmp().