Hacker News Reader

Comment by willvarfar | Hacker News Reader

I'd love to see the code; quite how they are not comparing a memcmp to 0 would be interesting to see...

There is a check_scramble function which returns a my_bool, presumably a char typedef. That function itself directly returns the result of memcmp. If your memcmp implementation returns the full range of int values (allowed), 1/256 of them will have a 0 low order byte, which will then compare equal to zero when the check_scramble call is tested.

This is why real C programmers use int as their bool type. :)

> This is why real C programmers use int as their bool type. :)

It has the same problem if a wider type (e.g. long) is assigned to it. Use _Bool instead.

I was at first tempted to complain about useless pedantry, but you're right. Even if some of us still like to party like it's 1989. I should have said the real lesson is don't reimplement standard C types, poorly.

Here is the fixed version of the MySQL code: https://bazaar.launchpad.net/~mysql/mysql-server/5.1/view/35... (line 534 didn't have the test()) previously)

yeap, strange; I'd have thought the obvious natural code would have been:

    return 0 == memcmp(hash_stage2, hash_stage2_reassured, SHA1_HASH_SIZE)

As in, return a bool on whether it matched.

I mean, as I read it, the function returns true if they don't match?

Here you can see a copy of the MariaDB source code and the file in question https://github.com/atcurtis/mariadb/blob/master/sql/password...

Reply on news.ycombinator.com