summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorPeterN <peter@fuzzle.org>2019-04-20 02:34:25 +0100
committerGitHub <noreply@github.com>2019-04-20 02:34:25 +0100
commitbe073b46daa9b70102e6299588f43454a35e46cf (patch)
treef09ee0b9a99f4af1c4078c6918cfec183402580a
parentd2b6176cdf9f37bea676972239471d950df4d531 (diff)
downloadopenttd-be073b46daa9b70102e6299588f43454a35e46cf.tar.xz
Fix: Bounds check access to railtype_map. (#7529)
-rw-r--r--src/newgrf.cpp3
1 files changed, 2 insertions, 1 deletions
diff --git a/src/newgrf.cpp b/src/newgrf.cpp
index 7e4ba801d..20408394e 100644
--- a/src/newgrf.cpp
+++ b/src/newgrf.cpp
@@ -5478,7 +5478,8 @@ static void RailTypeMapSpriteGroup(ByteReader *buf, uint8 idcount)
{
uint8 *railtypes = AllocaM(uint8, idcount);
for (uint i = 0; i < idcount; i++) {
- railtypes[i] = _cur.grffile->railtype_map[buf->ReadByte()];
+ uint8 id = buf->ReadByte();
+ railtypes[i] = id < RAILTYPE_END ? _cur.grffile->railtype_map[id] : INVALID_RAILTYPE;
}
uint8 cidcount = buf->ReadByte();