Amazing. The hashing thing is definitely on R*, but I wouldn't have expected an sscanf implementation to call strlen either. ("Ah, but of course they expect this kind of incremental parsing/tokenization to be done using the totally legit and un-problematic strtok instead!")
Well I gave up trying to understand C and C++ ages ago; they always felt like they sabotaged me for trying to get better at them. Moved on to many other programming languages.
In this case I believe they should have just vendored a small JSON parser in the game. It's a big blob of .exe and .dll files, why not? Found it weird but then again, we have all made mistakes that we later cringed at.
They could have just as easily vendored something with the same problem, and still not noticed. And if they cared on that level, they could also have switched to BSON, msgpack etc.
Yeah true, I don't deny it. My bigger point was that it was basically negligence. And it was in a very high-profile product making likely hundreds of millions (the shark cards).
Meanwhile I got fired because I could not keep up with impossible demands (which has been acknowledged by multiple people in the company but they did not want to burn political capital by going against the decision maker who was a petty tyrant who could not handle disagreement and fired me the first time I said what he was doing was not okay).
There were HN discussions at the time as well.