summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorsmatz <smatz@openttd.org>2010-02-01 00:10:52 +0000
committersmatz <smatz@openttd.org>2010-02-01 00:10:52 +0000
commitd155794605fbec6678969b4df814a3641295e8d0 (patch)
treec1d0c10faacb3a56cbc9a59fe73a2ac65d059ce1
parent68fc39ea1d0bdb62eb5463326cecbb9c4825f149 (diff)
downloadopenttd-d155794605fbec6678969b4df814a3641295e8d0.tar.xz
(svn r18978) -Fix [FS#3584](r14753): possible invalid memory access when merging companies
-rw-r--r--src/vehicle.cpp8
1 files changed, 4 insertions, 4 deletions
diff --git a/src/vehicle.cpp b/src/vehicle.cpp
index a62cac987..4cf0af4d9 100644
--- a/src/vehicle.cpp
+++ b/src/vehicle.cpp
@@ -1209,10 +1209,10 @@ FreeUnitIDGenerator::FreeUnitIDGenerator(VehicleType type, CompanyID owner) : ca
if (this->maxid == 0) return;
- this->maxid++; // so there is space for last item (with v->unitnumber == maxid)
- this->maxid++; // this one will always be free (well, it will fail when there are 65535 units, so this overflows)
-
- this->cache = CallocT<bool>(this->maxid);
+ /* Reserving 'maxid + 2' because we need:
+ * - space for the last item (with v->unitnumber == maxid)
+ * - one free slot working as loop terminator in FreeUnitIDGenerator::NextID() */
+ this->cache = CallocT<bool>(this->maxid + 2);
/* Fill the cache */
FOR_ALL_VEHICLES(v) {