security - Constant-time string comparison function -
to compare 2 strings, use strcmp or 1 of variants. however, because strcmp take longer if more characters match, vulnerable timing attacks. there constant-time string comparison function in standard library on windows? i don't think windows nor visual studio has such functions. at least simple strcmp can whip yourself. if care equality: int strctcmp(const char*a, const char*b) { int r = 0; (; *a && *b; ++a, ++b) { r |= *a != *b; } return r; } if need sortable results and need process of longest string: int strctcmp(const char*a, const char*b) { int r = 0, c; (;;) { c = *a - *b; if (!r) r = c; if (!*a && !*b) break; if (*a) ++a; if (*b) ++b; } return r; } these not perfect timing wise should more enough network based.
