Hi all,
On Tue, Dec 24, 2013 at 1:35 PM, Thomas Hruska <thruska@cubiclesoft.com>wrote:
> On 12/23/2013 8:59 PM, Jake A. Smith wrote:
>
>> Hi all,
>>
>> "strcmp_secure()" or something like this would be good, as it could be
>>>
>>
>> used any security sensitive string comparison.
>>
>> I like that. It makes sense for the function to be named for what it
>> does, not how one hopes or expects it will be used.
>>
>> JS
>>
>
> Perhaps this could be implemented by adding an optional parameter to the
> existing str...cmp() series of functions instead of adding more functions.
We may do this.
However, strcmp() returns 0 for equal strings while strcmp_secure() will
return TRUE for equal strings. We could make strcmp_secure() returns
FALSE/0 for equal strings, but it does not make much sense.
Perhaps, we need different function name rather than strcmp_secure().
I would like to have dedicated functions for security related features, so
that more users aware of issues.
Regards,
--
Yasuo Ohgaki
yohgaki@ohgaki.net