Check password without the use of strcmp (C)

Question

Point is to write a program that lets the user type in a password and checks it without the use of strcmp. I actually managed to do it using a different method, but I wanna know why the one I'll give here doesn't work.

int main()
{
    char pass[7] = { "alpine" };
    char str[20];
    int i;
    printf("Enter the password (6 letters).\n");
    gets(str);
    for (i = 0; i <= 7; i++) if (pass[i] != str[i]) {
        printf("Access denied.\n");
        goto label;
    }
    else
        break;
        printf("Acess granted.\n");
        printf("Code:1234\n");
    label: return 0;
}

ps. im aware its horrendous, most likely could be rewritten without the use of goto

FYI: https://stackoverflow.com/questions/1694036/why-is-the-gets-function-so-dangerous-that-it-should-not-be-used — kfx, Feb 04 '18 at 18:46

user2736738 · Accepted Answer · 2018-02-04T19:01:09.013

Because this has undefined behavior accessing array index out of bound. Array indexing starts from 0. And here you can't access the 7th index of a 7 element array.

It is strictly prohibited to use gets - it is even marked deprecated. Complier complained and you ignored it.

Also the initialization would be (here also again compiler threw error when I used your version)

char pass[7] = "alpine" ;// char pass[]="alpine";

You can use fgets to get input from user.And also there is a function called strcmp to make the job of comparing strings easy for us. Instead of looping, use that.

if(fgets(str,20,stdin)!=NULL){
   str[strcspn(str,"\n")]=0;
   if(strcmp(str,pass)==0){
      // they matched.
   }
}

You can use formatting to make clear interpretation of your program. Saves you from lots of unwanted problems. (Without using strcmp).

#define LEN 7
...
for (i = 0; i < LEN; i++) 
   if (pass[i] != str[i]) {
        printf("Access denied.\n");
        goto label;
   } // no else needed
..

Think of what you wrote earlier - in case of mismatch you showed that "Access denied" but when a single character matched then you used break and it prints "Access granted" - which is not how it should work. You should loop over all the characters available in the password.

But again there is one thing you missed in here - the thing is suppose the password is "alpine" and you inputted "alpinesssss" - do you want to give him/her access? No. But your program gives - what is the solution here? First whenever you get input password - check whether their lengths match - if not then deny them that moment right away.

So as it turns out, you need to use the strlen function - but if you are reluctant not to use it you can write the function yourself. (same way you can write strcmp also).

size_t my_strlen(const char *s){
   size_t len = 0;
   while(*s++) len++;
   return len;
}

Compile the code with all warnings enabled - gcc -Wall -Werror progname.c.

score 1 · Answer 2 · answered Feb 04 '18 at 19:30

Off by 1

The following loop iterates 8 time. One passed array sizes

// Iterates too often
for (i = 0; i <= 7; i++) if (pass[i] != str[i]) {
  ...

Instead 1) do not iterate past the end of the string nor 2) the end of the arrays pass[], str[].

Code could also scrub the password from memory for security reasons. Making char str[20]; volatile would also insure scrub code it not optimized out.

bool match = true;
for (i = 0; i < sizeof str && pass[i]; i++) {
  if (pass[i] != str[i]) {
    match = false;
    break;
  }
} 
for (i = 0; i < sizeof str; i++) {  //  clear all of str[]
  str[i] = 0;
}
for (i = 0; i < sizeof pass; i++) {  //  clear all of pass[]
  pass[i] = 0;
}
if (match) {
  puts("Access granted.");
  puts("Code:1234");
} else {
  puts("Access denied.");
}

score 0 · Answer 3 · answered Feb 05 '18 at 12:07

int main(void) {
       char a[10];
       scanf("%s",a);
       char b[]="password";
       int i=0;
       if(strlen(a)==strlen(b)){
            for( i=0;i<8;){
                if(a[i]==b[i])
                    i++;
                else
                    break;
            }
            if(i<8)
                 printf("no access");
            else
                 printf("yes");
      }
      else
          printf("No access");
      return 0;
 }

The password entered should not be greater or smaller that the original password size . so first check that condition and then check whether the words match if the length of both string are same

Check password without the use of strcmp (C)

3 Answers3