(svn r2066) - Fix: [ 1164248 ] game crash while AI builds bridge. Also protect bridge building against invalid bridges and some safeguards when drawing.

3 files changed, 10 insertions, 7 deletions

diff --git a/ai.c b/ai.c
index 1bbc88af2..18bdc162f 100644
--- a/ai.c
+++ b/ai.c
@@ -1976,7 +1976,7 @@ static inline void AiCheckBuildRailBridgeHere(AiRailFinder *arf, TileIndex tile,
 		}
 
 		// Is building a (rail)bridge possible at this place (type doesn't matter)?
-		if (DoCommandByTile(tile_new, tile, arf->player->ai.railtype_to_use<<8,
+		if (DoCommandByTile(tile_new, tile, 0 | arf->player->ai.railtype_to_use << 8,
 			DC_AUTO, CMD_BUILD_BRIDGE) == CMD_ERROR)
 				return;
 		AiBuildRailRecursive(arf, tile_new, dir2);
@@ -2139,16 +2139,16 @@ static void AiBuildRailConstruct(Player *p)
 				unnecessary to check for worse bridge (i=0), since AI will always build that.
 				AI is so fucked up that fixing this small thing will probably not solve a thing
 		*/
-		for(i = 10 + (p->ai.railtype_to_use << 8); i != 0; i--) {
+		for (i = MAX_BRIDGES - 1; i != 0; i--) {
 			if (CheckBridge_Stuff(i, bridge_len)) {
-				int32 cost = DoCommandByTile(arf.bridge_end_tile, p->ai.cur_tile_a, i, DC_AUTO, CMD_BUILD_BRIDGE);
+				int32 cost = DoCommandByTile(arf.bridge_end_tile, p->ai.cur_tile_a, i | (p->ai.railtype_to_use << 8), DC_AUTO, CMD_BUILD_BRIDGE);
 				if (cost != CMD_ERROR && cost < (p->player_money >> 5))
 					break;
 			}
 		}
 
 		// Build it
-		DoCommandByTile(arf.bridge_end_tile, p->ai.cur_tile_a, i, DC_AUTO | DC_EXEC, CMD_BUILD_BRIDGE);
+		DoCommandByTile(arf.bridge_end_tile, p->ai.cur_tile_a, i | (p->ai.railtype_to_use << 8), DC_AUTO | DC_EXEC, CMD_BUILD_BRIDGE);
 
 		p->ai.cur_tile_a = arf.bridge_end_tile;
 		p->ai.state_counter = 0;
diff --git a/table/bridge_land.h b/table/bridge_land.h
index f72578b59..c22d8e25b 100644
--- a/table/bridge_land.h
+++ b/table/bridge_land.h
@@ -724,7 +724,7 @@ static const uint32 * const _bridge_sprite_table_12[] = {
 	_bridge_sprite_table_3_6,
 };
 
-static const uint32 * const * const _bridge_sprite_table[] = {
+static const uint32 * const * const _bridge_sprite_table[MAX_BRIDGES] = {
 	_bridge_sprite_table_0,
 	_bridge_sprite_table_1,
 	_bridge_sprite_table_2,
diff --git a/tunnelbridge_cmd.c b/tunnelbridge_cmd.c
index 4b98be103..df2191dec 100644
--- a/tunnelbridge_cmd.c
+++ b/tunnelbridge_cmd.c
@@ -197,6 +197,9 @@ int32 CmdBuildBridge(int x, int y, uint32 flags, uint32 p1, uint32 p2)
 
 	direction = 0;
 
+	if (bridge_type >= MAX_BRIDGES) // out of bounds bridge
+		return_cmd_error(STR_5015_CAN_T_BUILD_BRIDGE_HERE);
+
 	/* check if valid, and make sure that (x,y) are smaller than (sx,sy) */
 	if (x == sx) {
 		if (y == sy)
@@ -1046,7 +1049,7 @@ static void DrawTile_TunnelBridge(TileInfo *ti)
 			}
 
 			// bridge ending.
-			b = _bridge_sprite_table[_map2[ti->tile]>>4][6];
+			b = _bridge_sprite_table[(_map2[ti->tile] >> 4) & 0xF][6];
 			b += (tmp&(3<<1))*4; /* actually ((tmp>>2)&3)*8 */
 			b += (tmp&1); // direction
 			if (ti->tileh == 0) b += 4; // sloped "entrance" ?
@@ -1106,7 +1109,7 @@ static void DrawTile_TunnelBridge(TileInfo *ti)
 				DrawGroundSprite(image);
 			}
 			// get bridge sprites
-			b = _bridge_sprite_table[_map2[ti->tile]>>4][_map2[ti->tile]&0xF] + tmp * 4;
+			b = _bridge_sprite_table[(_map2[ti->tile] >> 4) & 0xF][_map2[ti->tile]&0xF] + tmp * 4;
 
 			z = GetBridgeHeight(ti) + 5;