yeap, strange; I'd have thought the obvious natural code would have been:

    return 0 == memcmp(hash_stage2, hash_stage2_reassured, SHA1_HASH_SIZE)

As in, return a bool on whether it matched.

I mean, as I read it, the function returns true if they don't match?