title: What's wrong with strcmp?
body: <p>In the responses to the question <em><a href="https://stackoverflow.com/questions/2576398/reading-in-a-string-and-comparing-it-c">Reading In A String and comparing it C</a></em>, more than one person discouraged the use of <code>strcmp()</code>, saying things like</p>
  
  <blockquote>
    <p>I also strongly, strongly advise you to get used to using strncmp()
    now, ... to avoid many problems down the road.</p>
  </blockquote>
  
  <p>or (in <a href="https://stackoverflow.com/questions/4069925/using-if-statement-to-compare-strings/4070043#4070043">Why does my string comparison fail?</a> )</p>
  
  <blockquote>
    <p>Make certain you use strncmp and not strcmp. strcmp is profoundly
    unsafe.</p>
  </blockquote>
  
  <p>What problems are they alluding to?</p>
  
  <p>The reason <a href="http://en.wikipedia.org/wiki/scanf#Security" rel="noreferrer"><code>scanf()</code> with string specifiers</a> and <a href="http://en.wikibooks.org/wiki/C_Programming/C_Reference/stdio.h/gets" rel="noreferrer"><code>gets()</code> are strongly discouraged</a> is because they almost inevitably lead to buffer overflow vulnerabilities. However, it's not possible to overflow a buffer with <code>strcmp()</code>, right?</p>
  
  <blockquote>
    <p>"A buffer overflow, or buffer overrun, is an anomaly where a program, while writing data to a buffer, overruns the buffer's boundary and overwrites adjacent memory."</p>
  </blockquote>
  
  <p>( -- <a href="http://en.wikipedia.org/wiki/buffer_overflow" rel="noreferrer">Wikipedia: buffer overflow</a>).</p>
  
  <p>Since the strcmp() function never writes to any buffer, the strcmp() function cannot cause a buffer overflow, right?</p>
  
  <p>What is the reason people discourage the use of <code>strcmp()</code>, and recommend <code>strncmp()</code> instead?</p>