diff options
| author | rubidium <rubidium@openttd.org> | 2008-04-09 14:05:50 +0000 |
|---|---|---|
| committer | rubidium <rubidium@openttd.org> | 2008-04-09 14:05:50 +0000 |
| commit | ab7b05da505bd746f4b5c24179b27d379ade638f (patch) | |
| tree | be89cec2d8d7a3c23aad474d71ecca0e128dcbe0 /src/network/core/udp.cpp | |
| parent | c41624bb94d97fa6393e361dbe09fca2d53f0239 (diff) | |
| download | openttd-ab7b05da505bd746f4b5c24179b27d379ade638f.tar.xz | |
(svn r12637) -Fix [FS#1913]: possible NULL pointer dereference when reading some NewGRF data.
Diffstat (limited to 'src/network/core/udp.cpp')
| -rw-r--r-- | src/network/core/udp.cpp | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/src/network/core/udp.cpp b/src/network/core/udp.cpp index 6c8b56a53..77a4c81ae 100644 --- a/src/network/core/udp.cpp +++ b/src/network/core/udp.cpp @@ -221,6 +221,9 @@ void NetworkUDPSocketHandler::Recv_NetworkGameInfo(Packet *p, NetworkGameInfo *i uint i; uint num_grfs = p->Recv_uint8(); + /* Broken/bad data. It cannot have that many NewGRFs. */ + if (num_grfs > NETWORK_MAX_GRF_COUNT) return; + for (i = 0; i < num_grfs; i++) { GRFConfig *c = CallocT<GRFConfig>(1); this->Recv_GRFIdentifier(p, c); |