diff options
| author | PeterN <peter@fuzzle.org> | 2019-04-20 02:34:25 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2019-04-20 02:34:25 +0100 |
| commit | be073b46daa9b70102e6299588f43454a35e46cf (patch) | |
| tree | f09ee0b9a99f4af1c4078c6918cfec183402580a /src | |
| parent | d2b6176cdf9f37bea676972239471d950df4d531 (diff) | |
| download | openttd-be073b46daa9b70102e6299588f43454a35e46cf.tar.xz | |
Fix: Bounds check access to railtype_map. (#7529)
Diffstat (limited to 'src')
| -rw-r--r-- | src/newgrf.cpp | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/src/newgrf.cpp b/src/newgrf.cpp index 7e4ba801d..20408394e 100644 --- a/src/newgrf.cpp +++ b/src/newgrf.cpp @@ -5478,7 +5478,8 @@ static void RailTypeMapSpriteGroup(ByteReader *buf, uint8 idcount) { uint8 *railtypes = AllocaM(uint8, idcount); for (uint i = 0; i < idcount; i++) { - railtypes[i] = _cur.grffile->railtype_map[buf->ReadByte()]; + uint8 id = buf->ReadByte(); + railtypes[i] = id < RAILTYPE_END ? _cur.grffile->railtype_map[id] : INVALID_RAILTYPE; } uint8 cidcount = buf->ReadByte(); |