(svn r4510) - NewGRF bounds checking:

  - check Engine ID is within range
  - don't try setting a vehicle name if the string id is not a valid Engine ID

2 files changed, 6 insertions, 2 deletions

diff --git a/newgrf.c b/newgrf.c
index 7269c5d6e..6d373d6cd 100644
--- a/newgrf.c
+++ b/newgrf.c
@@ -1761,9 +1761,11 @@ static void VehicleNewName(byte *buf, int len)
 				case GSF_TRAIN:
 				case GSF_ROAD:
 				case GSF_SHIP:
-				case GSF_AIRCRAFT:
-					SetCustomEngineName(id, AddGRFString(_cur_grffile->grfid, id, lang, name));
+				case GSF_AIRCRAFT: {
+					StringID string = AddGRFString(_cur_grffile->grfid, id, lang, name);
+					if (id < TOTAL_NUM_ENGINES) SetCustomEngineName(id, string);
 					break;
+				}
 
 #if 0
 				case GSF_STATION:
diff --git a/newgrf_engine.c b/newgrf_engine.c
index 679a88cbd..841cba1a9 100644
--- a/newgrf_engine.c
+++ b/newgrf_engine.c
@@ -102,6 +102,7 @@ static SpriteGroup *engine_custom_sprites[TOTAL_NUM_ENGINES][NUM_GLOBAL_CID];
 
 void SetCustomEngineSprites(EngineID engine, byte cargo, SpriteGroup *group)
 {
+	assert(engine < TOTAL_NUM_ENGINES);
 	if (engine_custom_sprites[engine][cargo] != NULL) {
 		DEBUG(grf, 6)("SetCustomEngineSprites: engine `%d' cargo `%d' already has group -- replacing.", engine, cargo);
 	}
@@ -610,6 +611,7 @@ StringID _engine_custom_names[TOTAL_NUM_ENGINES];
 
 void SetCustomEngineName(EngineID engine, StringID name)
 {
+	assert(engine < lengthof(_engine_custom_names));
 	_engine_custom_names[engine] = name;
 }