Remi Lazarini
--- a/cgc/challenges/chess_mimic/src/service.c

+ 15

− 5
+++ b/cgc/challenges/chess_mimic/src/service.c

+ 15

− 5
 @@ -136,7 +136,8 @@ int cgc_checkNoCollision(Move move)
 	Location dst = move.dst;

 	int squares[WIDTH][2]; // squares between src and dst
-	int square_cnt = 0; 
+    cgc_memset(squares, 0, WIDTH * 2 * sizeof(int)); // Fix : initialization
+	int square_cnt = 0;

 	char piece = cgc_getPiece(move.src);

 @@ -572,8 +573,17 @@ int cgc_parseUserInput(Move *movers)
 				tmp.dst.y = cgc_atoi(&buf[i]);
 		}
 	}
-	
-	if (tmp.src.x != 77 && tmp.src.y != 77 && tmp.dst.x != 77 && tmp.dst.y != 77)
+
+	// if (tmp.src.x != 77 && tmp.src.y != 77 && tmp.dst.x != 77 && tmp.dst.y != 77)
+	// FIX : src and dst (x and y) must be between 0 and 7,
+	//       otherwise there is a possible read outside the checkerboard.
+	//       The dst check also corrects the included vulnerability.
+	if (
+		0 <= tmp.src.x && tmp.src.x <= 7 &&
+		0 <= tmp.src.y && tmp.src.y <= 7 &&
+		0 <= tmp.dst.x && tmp.dst.x <= 7 &&
+		0 <= tmp.dst.y && tmp.dst.y <= 7
+		)
 	{
 		movers->src = tmp.src;
 		movers->dst = tmp.dst;
 @@ -598,8 +608,8 @@ int main(int cgc_argc, char *cgc_argv[])
 	cgc_initboard();
 	displayer();

-	Move move;
-	
+	Move move = {0,0,0,0}; // Fix : initialization
+
 	while(1)
 	{
 		// print prompt