cb-multios icon indicating copy to clipboard operation
cb-multios copied to clipboard

WhackJack unitialized structure leads to POLL failure

Open icemonster opened this issue 5 years ago • 1 comments

Hello.

In the WhackJack challenge, in the service.c file we can see it is declared a playerInfoType players[MAX_PLAYERS] but this vector (and consequently the player_name attribute of each player) is not initialized.

The cgc_show_players function in player.c assumes it is. When a user inputs 4 in the main menu to ask for the statistics, some of the players may be printed because the first byte of their player_name string is not '\0'. This behavior is not predicted by the POLL state machine.

This leads to a POL failure in my system. The fix is easy: playerInfoType players[MAX_PLAYERS] = {0}; and I think it won't affect the intended vulnerabilities.

I didn't make a pull request because I don't know if assuming that the memory is always initialized to zero is an assumption here and maybe I'll have this same problem in other challenges too... Please let me know if that's the case.

icemonster avatar Apr 13 '20 16:04 icemonster

This is a bit weird since global variables should always be initialized to zero... EDIT: Now that I had a good night sleep I realize that the players variable is inside main, it just doesn't look like it due to the identation. It really should be initialized then.

icemonster avatar Apr 13 '20 17:04 icemonster