diff options
author | bjarni <bjarni@openttd.org> | 2005-01-30 20:50:06 +0000 |
---|---|---|
committer | bjarni <bjarni@openttd.org> | 2005-01-30 20:50:06 +0000 |
commit | 73c0cc5203ee748b4b38046ae7a53e4aa138cdd2 (patch) | |
tree | 6ab6f68d95e021786de892781f4fafc5ad5a3faa /vehicle.c | |
parent | 94f6208bde203b8c39f0de43deaebdcf7efa4bb6 (diff) | |
download | openttd-73c0cc5203ee748b4b38046ae7a53e4aa138cdd2.tar.xz |
(svn r1741) - Fix: added IsVehicleIndex() so it's possible to protect GetVehicle() from reading an invalid vehicle index
- Fix: added check for v->type in some commands, which expects v to be a specific type
Checks like this is needed to protect network servers from people, who hack their clients to either cheat or crash the server
NOTE: if I made a mistake here it can make a function unreachable when it should be used. Here is one place to look if something weird happens
Diffstat (limited to 'vehicle.c')
-rw-r--r-- | vehicle.c | 12 |
1 files changed, 8 insertions, 4 deletions
@@ -1331,13 +1331,15 @@ int32 CmdReplaceVehicle(int x, int y, uint32 flags, uint32 p1, uint32 p2) the last 8 bit is the engine. The 8 bits in front of the engine is free so it have room for 16 bit engine entries */ uint16 new_engine_type = (uint16)(p2 & 0xFFFF); uint32 autorefit_money = (p2 >> 16) * 100000; - Vehicle *v = GetVehicle(p1); + Vehicle *v, *u; int cost, build_cost, rear_engine_cost = 0; - Vehicle *u = v; - byte old_engine_type = v->engine_type; + byte old_engine_type; - SET_EXPENSES_TYPE(EXPENSES_NEW_VEHICLES); + if (!IsVehicleIndex(p1)) return CMD_ERROR; + + v = u = GetVehicle(p1); + old_engine_type = v->engine_type; // first we make sure that it's a valid type the user requested // check that it's an engine that is in the engine array @@ -1636,6 +1638,8 @@ int32 CmdNameVehicle(int x, int y, uint32 flags, uint32 p1, uint32 p2) Vehicle *v; StringID str; + if (!IsVehicleIndex(p1)) return CMD_ERROR; + v = GetVehicle(p1); if (!CheckOwnership(v->owner)) |