It doesn't take the length/amount of characters to compare as an argument relying on the null terminator, meaning it's susceptible to a buffer overflow attack.
Moral of the story, if you're going to use C strings, use the strn* variants.
Moral of the story, if you're going to use C strings, use the strn* variants.
If passed an unterminated string, the function will fail at least. How much you could exploit from that, I guess I exaggerated.
This whole subthread of picking on the guy's implementation because of "strcmp" is pretty silly. There are times where strcpy() is safe to use, but most of the time it's a red flag. There are conceivably times when strcmp() is unsafe to use, but to a professional reviewer, it is very rarely a red flag.
I should have just come right out and said that, rather than begging for the rationale for picking on strcmp().