(svn r26239) -Fix: Check that there is space left in the string parameter array, before pushing NewGRF parameters to it.

3 files changed, 36 insertions, 3 deletions

diff --git a/src/newgrf_text.cpp b/src/newgrf_text.cpp
index 7083680a9..81dd1654b 100644
--- a/src/newgrf_text.cpp
+++ b/src/newgrf_text.cpp
@@ -1022,11 +1022,44 @@ void RewindTextRefStack()
  * @param buff  the buffer we're writing to
  * @param str   the string that we need to write
  * @param argv  the OpenTTD stack of values
+ * @param argv_size space on the stack \a argv
  * @param modify_argv When true, modify the OpenTTD stack.
  * @return the string control code to "execute" now
  */
-uint RemapNewGRFStringControlCode(uint scc, char *buf_start, char **buff, const char **str, int64 *argv, bool modify_argv)
+uint RemapNewGRFStringControlCode(uint scc, char *buf_start, char **buff, const char **str, int64 *argv, uint argv_size, bool modify_argv)
 {
+	switch (scc) {
+		default: break;
+
+		case SCC_NEWGRF_PRINT_DWORD_SIGNED:
+		case SCC_NEWGRF_PRINT_WORD_SIGNED:
+		case SCC_NEWGRF_PRINT_BYTE_SIGNED:
+		case SCC_NEWGRF_PRINT_WORD_UNSIGNED:
+		case SCC_NEWGRF_PRINT_BYTE_HEX:
+		case SCC_NEWGRF_PRINT_WORD_HEX:
+		case SCC_NEWGRF_PRINT_DWORD_HEX:
+		case SCC_NEWGRF_PRINT_QWORD_HEX:
+		case SCC_NEWGRF_PRINT_DWORD_CURRENCY:
+		case SCC_NEWGRF_PRINT_QWORD_CURRENCY:
+		case SCC_NEWGRF_PRINT_WORD_STRING_ID:
+		case SCC_NEWGRF_PRINT_WORD_DATE_LONG:
+		case SCC_NEWGRF_PRINT_DWORD_DATE_LONG:
+		case SCC_NEWGRF_PRINT_WORD_DATE_SHORT:
+		case SCC_NEWGRF_PRINT_DWORD_DATE_SHORT:
+		case SCC_NEWGRF_PRINT_WORD_SPEED:
+		case SCC_NEWGRF_PRINT_WORD_VOLUME_LONG:
+		case SCC_NEWGRF_PRINT_WORD_VOLUME_SHORT:
+		case SCC_NEWGRF_PRINT_WORD_WEIGHT_LONG:
+		case SCC_NEWGRF_PRINT_WORD_WEIGHT_SHORT:
+		case SCC_NEWGRF_PRINT_WORD_POWER:
+		case SCC_NEWGRF_PRINT_WORD_STATION_NAME:
+			if (argv_size < 1) {
+				DEBUG(misc, 0, "Too many NewGRF string parameters.");
+				return 0;
+			}
+			break;
+	}
+
 	if (_newgrf_textrefstack.used && modify_argv) {
 		switch (scc) {
 			default: NOT_REACHED();
diff --git a/src/newgrf_text.h b/src/newgrf_text.h
index 081e7e36c..4b7f4e2df 100644
--- a/src/newgrf_text.h
+++ b/src/newgrf_text.h
@@ -41,7 +41,7 @@ void RewindTextRefStack();
 bool UsingNewGRFTextStack();
 struct TextRefStack *CreateTextRefStackBackup();
 void RestoreTextRefStackBackup(struct TextRefStack *backup);
-uint RemapNewGRFStringControlCode(uint scc, char *buf_start, char **buff, const char **str, int64 *argv, bool modify_argv);
+uint RemapNewGRFStringControlCode(uint scc, char *buf_start, char **buff, const char **str, int64 *argv, uint argv_size, bool modify_argv);
 
 StringID TTDPStringIDToOTTDStringIDMapping(StringID string);
 
diff --git a/src/strings.cpp b/src/strings.cpp
index 97398194a..37f57954f 100644
--- a/src/strings.cpp
+++ b/src/strings.cpp
@@ -809,7 +809,7 @@ static char *FormatString(char *buff, const char *str_arg, StringParameters *arg
 		if (SCC_NEWGRF_FIRST <= b && b <= SCC_NEWGRF_LAST) {
 			/* We need to pass some stuff as it might be modified; oh boy. */
 			//todo: should argve be passed here too?
-			b = RemapNewGRFStringControlCode(b, buf_start, &buff, &str, (int64 *)args->GetDataPointer(), dry_run);
+			b = RemapNewGRFStringControlCode(b, buf_start, &buff, &str, (int64 *)args->GetDataPointer(), args->GetDataLeft(), dry_run);
 			if (b == 0) continue;
 		}