title: Does strlen() in a strncmp() expression defeat the purpose of using strncmp() over strcmp()?
body: <p>By my understanding, <code>strcmp()</code> (no 'n'), upon seeing a null character in either argument, immediately stops processing and returns a result.<br>
  Therefore, if one of the arguments is known with 100% certainty to be null-terminated (e.g. it is a string literal), there is no security benefit whatsoever in using <code>strncmp()</code> (with 'n') with a call to <code>strlen()</code> as part of the third argument to limit the comparison to the known string length, because <code>strcmp()</code> will already never read more characters than are in that known-terminating string.</p>
  
  <p>In fact, it seems to me that a call to <code>strncmp()</code> whose length argument is a <code>strlen()</code> on one of the first two arguments is only different from the <code>strcmp()</code> case in that it wastes time linear in the size of the known-terminating string by evaluating the <code>strlen()</code> expression.</p>
  
  <p>Consider:</p>
  
  <p><strong>Sample code A:</strong></p>
  
  <pre class="lang-c prettyprint-override"><code>if (strcmp(user_input, "status") == 0)
      reply_with_status();
  </code></pre>
  
  <p><strong>Sample code B:</strong></p>
  
  <pre class="lang-c prettyprint-override"><code>if (strncmp(user_input, "status", strlen("status")+1) == 0)
      reply_with_status();
  </code></pre>
  
  <p>Is there any benefit to the former over the latter? Because I see it in other people's code a <em>lot</em>.</p>
  
  <p>Do I have a flawed understanding of how these functions work?</p>