diff options
| author | peter1138 <peter1138@openttd.org> | 2010-02-03 08:02:07 +0000 |
|---|---|---|
| committer | peter1138 <peter1138@openttd.org> | 2010-02-03 08:02:07 +0000 |
| commit | f1458df1caed833434303de9ae59f864404e4d07 (patch) | |
| tree | 50b7b6d574fb450f6da09024c547e3b92c63fd44 /src | |
| parent | 9950fc1edefbbf8744648a9fecd0d951b30b728d (diff) | |
| download | openttd-f1458df1caed833434303de9ae59f864404e4d07.tar.xz | |
(svn r18990) -Codechange: [NewGRF] Add rail type map bounds checking to RailType[Change|Reserve]Info().
Diffstat (limited to 'src')
| -rw-r--r-- | src/newgrf.cpp | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/src/newgrf.cpp b/src/newgrf.cpp index ef8ec93ac..786c5f373 100644 --- a/src/newgrf.cpp +++ b/src/newgrf.cpp @@ -2494,6 +2494,11 @@ static ChangeInfoResult RailTypeChangeInfo(uint id, int numinfo, int prop, ByteR extern RailtypeInfo _railtypes[RAILTYPE_END]; + if (id + numinfo > RAILTYPE_END) { + grfmsg(1, "RailTypeChangeInfo: Rail type %u is invalid, max %u, ignoring", id + numinfo, RAILTYPE_END); + return CIR_INVALID_ID; + } + for (int i = 0; i < numinfo; i++) { RailType rt = _cur_grffile->railtype_map[id + i]; if (rt == INVALID_RAILTYPE) return CIR_INVALID_ID; @@ -2589,6 +2594,11 @@ static ChangeInfoResult RailTypeReserveInfo(uint id, int numinfo, int prop, Byte { ChangeInfoResult ret = CIR_SUCCESS; + if (id + numinfo > RAILTYPE_END) { + grfmsg(1, "RailTypeReserveInfo: Rail type %u is invalid, max %u, ignoring", id + numinfo, RAILTYPE_END); + return CIR_INVALID_ID; + } + for (int i = 0; i < numinfo; i++) { switch (prop) { case 0x08: // Label of rail type |