(svn r1741) - Fix: added IsVehicleIndex() so it's possible to protect GetVehicle() from reading an invalid vehicle index

- Fix: added check for v->type in some commands, which expects v to be a specific type

Checks like this is needed to protect network servers from people, who hack their clients to either cheat or crash the server

NOTE: if I made a mistake here it can make a function unreachable when it should be used. Here is one place to look if something weird happens

1 files changed, 14 insertions, 2 deletions

diff --git a/roadveh_cmd.c b/roadveh_cmd.c
index 1ad6d7104..21b28c41a 100644
--- a/roadveh_cmd.c
+++ b/roadveh_cmd.c
@@ -209,6 +209,8 @@ int32 CmdStartStopRoadVeh(int x, int y, uint32 flags, uint32 p1, uint32 p2)
 {
 	Vehicle *v;
 
+	if (!IsVehicleIndex(p1)) return CMD_ERROR;
+
 	v = GetVehicle(p1);
 
 	if (v->type != VEH_Road || !CheckOwnership(v->owner))
@@ -229,13 +231,15 @@ int32 CmdSellRoadVeh(int x, int y, uint32 flags, uint32 p1, uint32 p2)
 {
 	Vehicle *v;
 
-	SET_EXPENSES_TYPE(EXPENSES_NEW_VEHICLES);
+	if (!IsVehicleIndex(p1)) return CMD_ERROR;
 
 	v = GetVehicle(p1);
 
 	if (v->type != VEH_Road || !CheckOwnership(v->owner))
 		return CMD_ERROR;
 
+	SET_EXPENSES_TYPE(EXPENSES_NEW_VEHICLES);
+
 	if (!IsRoadDepotTile(v->tile) || v->u.road.state != 254 || !(v->vehstatus&VS_STOPPED))
 		return_cmd_error(STR_9013_MUST_BE_STOPPED_INSIDE);
 
@@ -307,9 +311,13 @@ static int FindClosestRoadDepot(Vehicle *v)
 		 bit 2 = clear v->set_for_replacement */
 int32 CmdSendRoadVehToDepot(int x, int y, uint32 flags, uint32 p1, uint32 p2)
 {
-	Vehicle *v = GetVehicle(p1);
+	Vehicle *v;
 	int depot;
 
+	if (!IsVehicleIndex(p1)) return CMD_ERROR;
+
+	v = GetVehicle(p1);
+
 	if (v->type != VEH_Road || !CheckOwnership(v->owner))
 		return CMD_ERROR;
 
@@ -348,6 +356,8 @@ int32 CmdTurnRoadVeh(int x, int y, uint32 flags, uint32 p1, uint32 p2)
 {
 	Vehicle *v;
 
+	if (!IsVehicleIndex(p1)) return CMD_ERROR;
+
 	v = GetVehicle(p1);
 
 	if (v->type != VEH_Road || !CheckOwnership(v->owner))
@@ -373,6 +383,8 @@ int32 CmdChangeRoadVehServiceInt(int x, int y, uint32 flags, uint32 p1, uint32 p
 {
 	Vehicle *v;
 
+	if (!IsVehicleIndex(p1)) return CMD_ERROR;
+
 	v = GetVehicle(p1);
 
 	if (v->type != VEH_Road || !CheckOwnership(v->owner))