diff options
| author | smatz <smatz@openttd.org> | 2010-02-01 00:10:52 +0000 |
|---|---|---|
| committer | smatz <smatz@openttd.org> | 2010-02-01 00:10:52 +0000 |
| commit | d155794605fbec6678969b4df814a3641295e8d0 (patch) | |
| tree | c1d0c10faacb3a56cbc9a59fe73a2ac65d059ce1 | |
| parent | 68fc39ea1d0bdb62eb5463326cecbb9c4825f149 (diff) | |
| download | openttd-d155794605fbec6678969b4df814a3641295e8d0.tar.xz | |
(svn r18978) -Fix [FS#3584](r14753): possible invalid memory access when merging companies
| -rw-r--r-- | src/vehicle.cpp | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/src/vehicle.cpp b/src/vehicle.cpp index a62cac987..4cf0af4d9 100644 --- a/src/vehicle.cpp +++ b/src/vehicle.cpp @@ -1209,10 +1209,10 @@ FreeUnitIDGenerator::FreeUnitIDGenerator(VehicleType type, CompanyID owner) : ca if (this->maxid == 0) return; - this->maxid++; // so there is space for last item (with v->unitnumber == maxid) - this->maxid++; // this one will always be free (well, it will fail when there are 65535 units, so this overflows) - - this->cache = CallocT<bool>(this->maxid); + /* Reserving 'maxid + 2' because we need: + * - space for the last item (with v->unitnumber == maxid) + * - one free slot working as loop terminator in FreeUnitIDGenerator::NextID() */ + this->cache = CallocT<bool>(this->maxid + 2); /* Fill the cache */ FOR_ALL_VEHICLES(v) { |