(svn r26685) -Fix: Tighten parameter bound checks on GSCargoMonitor functions, and return -1 on out-of-bound parameters.

3 files changed, 47 insertions, 16 deletions

diff --git a/src/script/api/game_changelog.hpp b/src/script/api/game_changelog.hpp
index a6a80f9b3..6f1a93b52 100644
--- a/src/script/api/game_changelog.hpp
+++ b/src/script/api/game_changelog.hpp
@@ -22,6 +22,10 @@
  * API additions:
  * \li GSStation::GetCargoWaitingFromVia
  *
+ * Other changes:
+ * \li GSCargoMonitor delivery and pickup monitor functions have improved boundary checking for
+ *     their parameters, and return \c -1 if they are found out of bounds.
+ *
  * \b 1.4.0
  *
  * API additions:
diff --git a/src/script/api/script_cargomonitor.cpp b/src/script/api/script_cargomonitor.cpp
index 4b5b85ed6..3cb9b4a8e 100644
--- a/src/script/api/script_cargomonitor.cpp
+++ b/src/script/api/script_cargomonitor.cpp
@@ -10,31 +10,54 @@
 /** @file script_cargomonitor.cpp Code to monitor cargo pickup and deliveries by companies. */
 
 #include "../../stdafx.h"
+#include "script_cargo.hpp"
 #include "script_cargomonitor.hpp"
+#include "../../town.h"
+#include "../../industry.h"
 
 #include "../../safeguards.h"
 
-/* static */ uint32 ScriptCargoMonitor::GetTownDeliveryAmount(ScriptCompany::CompanyID company, CargoID cargo, TownID town_id, bool keep_monitoring)
+/* static */ int32 ScriptCargoMonitor::GetTownDeliveryAmount(ScriptCompany::CompanyID company, CargoID cargo, TownID town_id, bool keep_monitoring)
 {
-	CargoMonitorID monitor = EncodeCargoTownMonitor(static_cast<CompanyID>(company), cargo, town_id);
+	CompanyID cid = static_cast<CompanyID>(company);
+	if (cid < OWNER_BEGIN || cid >= MAX_COMPANIES) return -1;
+	if (!ScriptCargo::IsValidCargo(cargo)) return -1;
+	if (!::Town::IsValidID(town_id)) return -1;
+
+	CargoMonitorID monitor = EncodeCargoTownMonitor(cid, cargo, town_id);
 	return GetDeliveryAmount(monitor, keep_monitoring);
 }
 
-/* static */ uint32 ScriptCargoMonitor::GetIndustryDeliveryAmount(ScriptCompany::CompanyID company, CargoID cargo, IndustryID industry_id, bool keep_monitoring)
+/* static */ int32 ScriptCargoMonitor::GetIndustryDeliveryAmount(ScriptCompany::CompanyID company, CargoID cargo, IndustryID industry_id, bool keep_monitoring)
 {
-	CargoMonitorID monitor = EncodeCargoIndustryMonitor(static_cast<CompanyID>(company), cargo, industry_id);
+	CompanyID cid = static_cast<CompanyID>(company);
+	if (cid < OWNER_BEGIN || cid >= MAX_COMPANIES) return -1;
+	if (!ScriptCargo::IsValidCargo(cargo)) return -1;
+	if (!::Industry::IsValidID(industry_id)) return -1;
+
+	CargoMonitorID monitor = EncodeCargoIndustryMonitor(cid, cargo, industry_id);
 	return GetDeliveryAmount(monitor, keep_monitoring);
 }
 
-/* static */ uint32 ScriptCargoMonitor::GetTownPickupAmount(ScriptCompany::CompanyID company, CargoID cargo, TownID town_id, bool keep_monitoring)
+/* static */ int32 ScriptCargoMonitor::GetTownPickupAmount(ScriptCompany::CompanyID company, CargoID cargo, TownID town_id, bool keep_monitoring)
 {
-	CargoMonitorID monitor = EncodeCargoTownMonitor(static_cast<CompanyID>(company), cargo, town_id);
+	CompanyID cid = static_cast<CompanyID>(company);
+	if (cid < OWNER_BEGIN || cid >= MAX_COMPANIES) return -1;
+	if (!ScriptCargo::IsValidCargo(cargo)) return -1;
+	if (!::Town::IsValidID(town_id)) return -1;
+
+	CargoMonitorID monitor = EncodeCargoTownMonitor(cid, cargo, town_id);
 	return GetPickupAmount(monitor, keep_monitoring);
 }
 
-/* static */ uint32 ScriptCargoMonitor::GetIndustryPickupAmount(ScriptCompany::CompanyID company, CargoID cargo, IndustryID industry_id, bool keep_monitoring)
+/* static */ int32 ScriptCargoMonitor::GetIndustryPickupAmount(ScriptCompany::CompanyID company, CargoID cargo, IndustryID industry_id, bool keep_monitoring)
 {
-	CargoMonitorID monitor = EncodeCargoIndustryMonitor(static_cast<CompanyID>(company), cargo, industry_id);
+	CompanyID cid = static_cast<CompanyID>(company);
+	if (cid < OWNER_BEGIN || cid >= MAX_COMPANIES) return -1;
+	if (!ScriptCargo::IsValidCargo(cargo)) return -1;
+	if (!::Industry::IsValidID(industry_id)) return -1;
+
+	CargoMonitorID monitor = EncodeCargoIndustryMonitor(cid, cargo, industry_id);
 	return GetPickupAmount(monitor, keep_monitoring);
 }
 
diff --git a/src/script/api/script_cargomonitor.hpp b/src/script/api/script_cargomonitor.hpp
index f0fa56be9..175936db2 100644
--- a/src/script/api/script_cargomonitor.hpp
+++ b/src/script/api/script_cargomonitor.hpp
@@ -50,9 +50,10 @@ public:
 	 * @param cargo Cargo type to query.
 	 * @param town_id %Town to query.
 	 * @param keep_monitoring If \c true, the given combination continues to be monitored for the next call. If \c false, monitoring ends.
-	 * @return Amount of delivered cargo of the given cargo type to the given town by the given company since the last call.
+	 * @return Amount of delivered cargo of the given cargo type to the given town by the given company since the last call, or
+	 * \c -1 if a parameter is out-of-bound.
 	 */
-	static uint32 GetTownDeliveryAmount(ScriptCompany::CompanyID company, CargoID cargo, TownID town_id, bool keep_monitoring);
+	static int32 GetTownDeliveryAmount(ScriptCompany::CompanyID company, CargoID cargo, TownID town_id, bool keep_monitoring);
 
 	/**
 	 * Get the amount of cargo delivered to an industry by a company since the last query, and update the monitoring state.
@@ -60,9 +61,10 @@ public:
 	 * @param cargo Cargo type to query.
 	 * @param industry_id %Industry to query.
 	 * @param keep_monitoring If \c true, the given combination continues to be monitored for the next call. If \c false, monitoring ends.
-	 * @return Amount of delivered cargo of the given cargo type to the given industry by the given company since the last call.
+	 * @return Amount of delivered cargo of the given cargo type to the given industry by the given company since the last call, or
+	 * \c -1 if a parameter is out-of-bound.
 	 */
-	static uint32 GetIndustryDeliveryAmount(ScriptCompany::CompanyID company, CargoID cargo, IndustryID industry_id, bool keep_monitoring);
+	static int32 GetIndustryDeliveryAmount(ScriptCompany::CompanyID company, CargoID cargo, IndustryID industry_id, bool keep_monitoring);
 
 	/**
 	 * Get the amount of cargo picked up (and delivered) from a town by a company since the last query, and update the monitoring state.
@@ -70,10 +72,11 @@ public:
 	 * @param cargo Cargo type to query.
 	 * @param town_id %Town to query.
 	 * @param keep_monitoring If \c true, the given combination continues to be monitored for the next call. If \c false, monitoring ends.
-	 * @return Amount of picked up cargo of the given cargo type to the given town by the given company since the last call.
+	 * @return Amount of picked up cargo of the given cargo type to the given town by the given company since the last call, or
+	 * \c -1 if a parameter is out-of-bound.
 	 * @note Amounts of picked-up cargo are added during final delivery of it, to prevent users from getting credit for picking up without delivering it.
 	 */
-	static uint32 GetTownPickupAmount(ScriptCompany::CompanyID company, CargoID cargo, TownID town_id, bool keep_monitoring);
+	static int32 GetTownPickupAmount(ScriptCompany::CompanyID company, CargoID cargo, TownID town_id, bool keep_monitoring);
 
 	/**
 	 * Get the amount of cargo picked up (and delivered) from an industry by a company since the last query, and update the monitoring state.
@@ -81,10 +84,11 @@ public:
 	 * @param cargo Cargo type to query.
 	 * @param industry_id %Industry to query.
 	 * @param keep_monitoring If \c true, the given combination continues to be monitored for the next call. If \c false, monitoring ends.
-	 * @return Amount of picked up cargo of the given cargo type to the given industry by the given company since the last call.
+	 * @return Amount of picked up cargo of the given cargo type to the given industry by the given company since the last call, or
+	 * \c -1 if a parameter is out-of-bound.
 	 * @note Amounts of picked-up cargo are added during final delivery of it, to prevent users from getting credit for picking up without delivering it.
 	 */
-	static uint32 GetIndustryPickupAmount(ScriptCompany::CompanyID company, CargoID cargo, IndustryID industry_id, bool keep_monitoring);
+	static int32 GetIndustryPickupAmount(ScriptCompany::CompanyID company, CargoID cargo, IndustryID industry_id, bool keep_monitoring);
 
 	/** Stop monitoring everything. */
 	static void StopAllMonitoring();