diff options
Diffstat (limited to 'src')
| -rw-r--r-- | src/lang/english.txt | 1 | ||||
| -rw-r--r-- | src/newgrf.cpp | 624 |
2 files changed, 272 insertions, 353 deletions
diff --git a/src/lang/english.txt b/src/lang/english.txt index adb4f3008..1e1ad8021 100644 --- a/src/lang/english.txt +++ b/src/lang/english.txt @@ -2370,6 +2370,7 @@ STR_NEWGRF_ERROR_UNKNOWN_PROPERTY :Unknown Action STR_NEWGRF_ERROR_INVALID_ID :Attempt to use invalid ID. STR_NEWGRF_ERROR_CORRUPT_SPRITE :{YELLOW}{RAW_STRING} contains a corrupt sprite. All corrupt sprites will be shown as a red question mark (?). STR_NEWGRF_ERROR_MULTIPLE_ACTION_8 :Contains multiple Action 8 entries. +STR_NEWGRF_ERROR_READ_BOUNDS :Read past end of pseudo-sprite. # NewGRF related 'general' warnings STR_NEWGRF_POPUP_CAUTION_CAPTION :{WHITE}Caution! diff --git a/src/newgrf.cpp b/src/newgrf.cpp index 83e4d3f6c..bbfbc6091 100644 --- a/src/newgrf.cpp +++ b/src/newgrf.cpp @@ -87,8 +87,47 @@ enum GrfDataType { static byte _grf_data_blocks; static GrfDataType _grf_data_type; +class OTTDByteReaderSignal { }; -typedef void (*SpecialSpriteHandler)(byte *buf, size_t len); +class ByteReader { +protected: + byte *data; + byte *end; + +public: + ByteReader(byte *data, byte *end) : data(data), end(end) { } + + FORCEINLINE byte ReadByte() + { + if (data < end) return *(data)++; + throw OTTDByteReaderSignal(); + } + + FORCEINLINE size_t Remaining() const + { + return (int)(end - data); + } + + FORCEINLINE bool HasData() const + { + return data < end; + } + + FORCEINLINE byte *Data() + { + return data; + } + + FORCEINLINE void Skip(size_t len) + { + data += len; + /* It is valid to move the buffer to exactly the end of the data, + * as there may not be any more data read. */ + if (data > end) throw OTTDByteReaderSignal(); + } +}; + +typedef void (*SpecialSpriteHandler)(ByteReader *buf); enum { MAX_STATIONS = 256, @@ -153,25 +192,18 @@ void CDECL grfmsg(int severity, const char *str, ...) DEBUG(grf, severity, "[%s:%d] %s", _cur_grfconfig->filename, _nfo_line, buf); } -static inline bool check_length(size_t real, size_t wanted, const char *str) -{ - if (real >= wanted) return true; - grfmsg(0, "%s: Invalid pseudo sprite length " PRINTF_SIZE " (expected " PRINTF_SIZE ")!", str, real, wanted); - return false; -} - -static inline byte grf_load_byte(byte **buf) +static inline byte grf_load_byte(ByteReader **buf) { - return *(*buf)++; + return (*buf)->ReadByte(); } -static uint16 grf_load_word(byte **buf) +static uint16 grf_load_word(ByteReader **buf) { uint16 val = grf_load_byte(buf); return val | (grf_load_byte(buf) << 8); } -static uint16 grf_load_extended(byte** buf) +static uint16 grf_load_extended(ByteReader **buf) { uint16 val; val = grf_load_byte(buf); @@ -179,13 +211,13 @@ static uint16 grf_load_extended(byte** buf) return val; } -static uint32 grf_load_dword(byte **buf) +static uint32 grf_load_dword(ByteReader **buf) { uint32 val = grf_load_word(buf); return val | (grf_load_word(buf) << 16); } -static uint32 grf_load_var(byte size, byte **buf) +static uint32 grf_load_var(byte size, ByteReader **buf) { switch (size) { case 1: return grf_load_byte(buf); @@ -197,20 +229,21 @@ static uint32 grf_load_var(byte size, byte **buf) } } -static const char *grf_load_string(byte **buf, size_t max_len) +static const char *grf_load_string(ByteReader **bufp) { - const char *string = *(const char **)buf; - size_t string_length = ttd_strnlen(string, max_len); + ByteReader *buf = *bufp; + char *string = reinterpret_cast<char *>(buf->Data()); + size_t string_length = ttd_strnlen(string, buf->Remaining()); - if (string_length == max_len) { + if (string_length == buf->Remaining()) { /* String was not NUL terminated, so make sure it is now. */ - (*buf)[string_length - 1] = '\0'; + string[string_length - 1] = '\0'; grfmsg(7, "String was not terminated with a zero byte."); } else { /* Increase the string length to include the NUL byte. */ string_length++; } - *buf += string_length; + buf->Skip(string_length); return string; } @@ -447,9 +480,9 @@ enum ChangeInfoResult { CIR_INVALID_ID, ///< Attempt to modify an invalid ID }; -typedef ChangeInfoResult (*VCI_Handler)(uint engine, int numinfo, int prop, byte **buf, int len); +typedef ChangeInfoResult (*VCI_Handler)(uint engine, int numinfo, int prop, ByteReader *buf); -static ChangeInfoResult CommonVehicleChangeInfo(EngineInfo *ei, int prop, byte **buf) +static ChangeInfoResult CommonVehicleChangeInfo(EngineInfo *ei, int prop, ByteReader **buf) { switch (prop) { case 0x00: // Introduction date @@ -487,9 +520,8 @@ static ChangeInfoResult CommonVehicleChangeInfo(EngineInfo *ei, int prop, byte * return CIR_SUCCESS; } -static ChangeInfoResult RailVehicleChangeInfo(uint engine, int numinfo, int prop, byte **bufp, int len) +static ChangeInfoResult RailVehicleChangeInfo(uint engine, int numinfo, int prop, ByteReader *buf) { - byte *buf = *bufp; ChangeInfoResult ret = CIR_SUCCESS; for (int i = 0; i < numinfo; i++) { @@ -730,13 +762,11 @@ static ChangeInfoResult RailVehicleChangeInfo(uint engine, int numinfo, int prop } } - *bufp = buf; return ret; } -static ChangeInfoResult RoadVehicleChangeInfo(uint engine, int numinfo, int prop, byte **bufp, int len) +static ChangeInfoResult RoadVehicleChangeInfo(uint engine, int numinfo, int prop, ByteReader *buf) { - byte *buf = *bufp; ChangeInfoResult ret = CIR_SUCCESS; for (int i = 0; i < numinfo; i++) { @@ -859,13 +889,11 @@ static ChangeInfoResult RoadVehicleChangeInfo(uint engine, int numinfo, int prop } } - *bufp = buf; return ret; } -static ChangeInfoResult ShipVehicleChangeInfo(uint engine, int numinfo, int prop, byte **bufp, int len) +static ChangeInfoResult ShipVehicleChangeInfo(uint engine, int numinfo, int prop, ByteReader *buf) { - byte *buf = *bufp; ChangeInfoResult ret = CIR_SUCCESS; for (int i = 0; i < numinfo; i++) { @@ -975,13 +1003,11 @@ static ChangeInfoResult ShipVehicleChangeInfo(uint engine, int numinfo, int prop } } - *bufp = buf; return ret; } -static ChangeInfoResult AircraftVehicleChangeInfo(uint engine, int numinfo, int prop, byte **bufp, int len) +static ChangeInfoResult AircraftVehicleChangeInfo(uint engine, int numinfo, int prop, ByteReader *buf) { - byte *buf = *bufp; ChangeInfoResult ret = CIR_SUCCESS; for (int i = 0; i < numinfo; i++) { @@ -1087,13 +1113,11 @@ static ChangeInfoResult AircraftVehicleChangeInfo(uint engine, int numinfo, int } } - *bufp = buf; return ret; } -static ChangeInfoResult StationChangeInfo(uint stid, int numinfo, int prop, byte **bufp, int len) +static ChangeInfoResult StationChangeInfo(uint stid, int numinfo, int prop, ByteReader *buf) { - byte *buf = *bufp; ChangeInfoResult ret = CIR_SUCCESS; if (stid + numinfo > MAX_STATIONS) { @@ -1146,7 +1170,7 @@ static ChangeInfoResult StationChangeInfo(uint stid, int numinfo, int prop, byte MapSpriteMappingRecolour(&dts->ground); - while (buf < *bufp + len) { + while (buf->HasData()) { /* no relative bounding box support */ dts->seq = ReallocT(const_cast<DrawTileSeqStruct *>(dts->seq), ++seq_count); DrawTileSeqStruct *dtss = const_cast<DrawTileSeqStruct *>(&dts->seq[seq_count - 1]); @@ -1197,7 +1221,7 @@ static ChangeInfoResult StationChangeInfo(uint stid, int numinfo, int prop, byte case 0x0E: // Define custom layout statspec->copied_layouts = false; - while (buf < *bufp + len) { + while (buf->HasData()) { byte length = grf_load_byte(&buf); byte number = grf_load_byte(&buf); StationLayout layout; @@ -1228,10 +1252,15 @@ static ChangeInfoResult StationChangeInfo(uint stid, int numinfo, int prop, byte p = 0; layout = MallocT<byte>(length * number); - for (l = 0; l < length; l++) { - for (p = 0; p < number; p++) { - layout[l * number + p] = grf_load_byte(&buf); + try { + for (l = 0; l < length; l++) { + for (p = 0; p < number; p++) { + layout[l * number + p] = grf_load_byte(&buf); + } } + } catch (...) { + free(layout); + throw; } l--; @@ -1294,13 +1323,11 @@ static ChangeInfoResult StationChangeInfo(uint stid, int numinfo, int prop, byte } } - *bufp = buf; return ret; } -static ChangeInfoResult CanalChangeInfo(uint id, int numinfo, int prop, byte **bufp, int len) +static ChangeInfoResult CanalChangeInfo(uint id, int numinfo, int prop, ByteReader *buf) { - byte *buf = *bufp; ChangeInfoResult ret = CIR_SUCCESS; if (id + numinfo > CF_END) { @@ -1326,13 +1353,11 @@ static ChangeInfoResult CanalChangeInfo(uint id, int numinfo, int prop, byte **b } } - *bufp = buf; return ret; } -static ChangeInfoResult BridgeChangeInfo(uint brid, int numinfo, int prop, byte **bufp, int len) +static ChangeInfoResult BridgeChangeInfo(uint brid, int numinfo, int prop, ByteReader *buf) { - byte *buf = *bufp; ChangeInfoResult ret = CIR_SUCCESS; if (brid + numinfo > MAX_BRIDGES) { @@ -1428,13 +1453,11 @@ static ChangeInfoResult BridgeChangeInfo(uint brid, int numinfo, int prop, byte } } - *bufp = buf; return ret; } -static ChangeInfoResult TownHouseChangeInfo(uint hid, int numinfo, int prop, byte **bufp, int len) +static ChangeInfoResult TownHouseChangeInfo(uint hid, int numinfo, int prop, ByteReader *buf) { - byte *buf = *bufp; ChangeInfoResult ret = CIR_SUCCESS; if (hid + numinfo > HOUSE_MAX) { @@ -1652,13 +1675,11 @@ static ChangeInfoResult TownHouseChangeInfo(uint hid, int numinfo, int prop, byt } } - *bufp = buf; return ret; } -static ChangeInfoResult GlobalVarChangeInfo(uint gvid, int numinfo, int prop, byte **bufp, int len) +static ChangeInfoResult GlobalVarChangeInfo(uint gvid, int numinfo, int prop, ByteReader *buf) { - byte *buf = *bufp; ChangeInfoResult ret = CIR_SUCCESS; for (int i = 0; i < numinfo; i++) { @@ -1677,7 +1698,7 @@ static ChangeInfoResult GlobalVarChangeInfo(uint gvid, int numinfo, int prop, by case 0x09: // Cargo translation table /* This is loaded during the reservation stage, so just skip it here. */ /* Each entry is 4 bytes. */ - buf += 4; + buf->Skip(4); break; case 0x0A: { // Currency display names @@ -1756,8 +1777,8 @@ static ChangeInfoResult GlobalVarChangeInfo(uint gvid, int numinfo, int prop, by case 0x10: // Snow line height table if (numinfo > 1 || IsSnowLineSet()) { grfmsg(1, "GlobalVarChangeInfo: The snowline can only be set once (%d)", numinfo); - } else if (len < SNOW_LINE_MONTHS * SNOW_LINE_DAYS) { - grfmsg(1, "GlobalVarChangeInfo: Not enough entries set in the snowline table (%d)", len); + } else if (buf->Remaining() < SNOW_LINE_MONTHS * SNOW_LINE_DAYS) { + grfmsg(1, "GlobalVarChangeInfo: Not enough entries set in the snowline table (" PRINTF_SIZE ")", buf->Remaining()); } else { byte table[SNOW_LINE_MONTHS][SNOW_LINE_DAYS]; @@ -1773,13 +1794,13 @@ static ChangeInfoResult GlobalVarChangeInfo(uint gvid, int numinfo, int prop, by case 0x11: // GRF match for engine allocation /* This is loaded during the reservation stage, so just skip it here. */ /* Each entry is 8 bytes. */ - buf += 8; + buf->Skip(8); break; case 0x12: // Rail type translation table /* This is loaded during the reservation stage, so just skip it here. */ /* Each entry is 4 bytes. */ - buf += 4; + buf->Skip(4); break; default: @@ -1788,13 +1809,11 @@ static ChangeInfoResult GlobalVarChangeInfo(uint gvid, int numinfo, int prop, by } } - *bufp = buf; return ret; } -static ChangeInfoResult GlobalVarReserveInfo(uint gvid, int numinfo, int prop, byte **bufp, int len) +static ChangeInfoResult GlobalVarReserveInfo(uint gvid, int numinfo, int prop, ByteReader *buf) { - byte *buf = *bufp; ChangeInfoResult ret = CIR_SUCCESS; for (int i = 0; i < numinfo; i++) { @@ -1833,7 +1852,7 @@ static ChangeInfoResult GlobalVarReserveInfo(uint gvid, int numinfo, int prop, b break; case 0x10: // Snow line height table - buf += SNOW_LINE_MONTHS * SNOW_LINE_DAYS; + buf->Skip(SNOW_LINE_MONTHS * SNOW_LINE_DAYS); break; case 0x11: { // GRF match for engine allocation @@ -1866,14 +1885,12 @@ static ChangeInfoResult GlobalVarReserveInfo(uint gvid, int numinfo, int prop, b } } - *bufp = buf; return ret; } -static ChangeInfoResult CargoChangeInfo(uint cid, int numinfo, int prop, byte **bufp, int len) +static ChangeInfoResult CargoChangeInfo(uint cid, int numinfo, int prop, ByteReader *buf) { - byte *buf = *bufp; ChangeInfoResult ret = CIR_SUCCESS; if (cid + numinfo > NUM_CARGO) { @@ -1992,14 +2009,12 @@ static ChangeInfoResult CargoChangeInfo(uint cid, int numinfo, int prop, byte ** } } - *bufp = buf; return ret; } -static ChangeInfoResult SoundEffectChangeInfo(uint sid, int numinfo, int prop, byte **bufp, int len) +static ChangeInfoResult SoundEffectChangeInfo(uint sid, int numinfo, int prop, ByteReader *buf) { - byte *buf = *bufp; ChangeInfoResult ret = CIR_SUCCESS; if (_cur_grffile->sound_offset == 0) { @@ -2044,13 +2059,11 @@ static ChangeInfoResult SoundEffectChangeInfo(uint sid, int numinfo, int prop, b } } - *bufp = buf; return ret; } -static ChangeInfoResult IndustrytilesChangeInfo(uint indtid, int numinfo, int prop, byte **bufp, int len) +static ChangeInfoResult IndustrytilesChangeInfo(uint indtid, int numinfo, int prop, ByteReader *buf) { - byte *buf = *bufp; ChangeInfoResult ret = CIR_SUCCESS; if (indtid + numinfo > NUM_INDUSTRYTILES) { @@ -2154,7 +2167,6 @@ static ChangeInfoResult IndustrytilesChangeInfo(uint indtid, int numinfo, int pr } } - *bufp = buf; return ret; } @@ -2177,9 +2189,8 @@ static bool ValidateIndustryLayout(const IndustryTileTable *layout, int size) return true; } -static ChangeInfoResult IndustriesChangeInfo(uint indid, int numinfo, int prop, byte **bufp, int len) +static ChangeInfoResult IndustriesChangeInfo(uint indid, int numinfo, int prop, ByteReader *buf) { - byte *buf = *bufp; ChangeInfoResult ret = CIR_SUCCESS; if (indid + numinfo > NUM_INDUSTRYTYPES) { @@ -2261,76 +2272,83 @@ static ChangeInfoResult IndustriesChangeInfo(uint indid, int numinfo, int prop, uint size; const IndustryTileTable *copy_from; - for (byte j = 0; j < indsp->num_table; j++) { - for (uint k = 0;; k++) { - if (k >= def_num_tiles) { - grfmsg(3, "IndustriesChangeInfo: Incorrect size for industry tile layout definition for industry %u.", indid); - /* Size reported by newgrf was not big enough so enlarge the array. */ - def_num_tiles *= 2; - itt = ReallocT<IndustryTileTable>(itt, def_num_tiles); - } + try { + for (byte j = 0; j < indsp->num_table; j++) { + for (uint k = 0;; k++) { + if (k >= def_num_tiles) { + grfmsg(3, "IndustriesChangeInfo: Incorrect size for industry tile layout definition for industry %u.", indid); + /* Size reported by newgrf was not big enough so enlarge the array. */ + def_num_tiles *= 2; + itt = ReallocT<IndustryTileTable>(itt, def_num_tiles); + } - itt[k].ti.x = grf_load_byte(&buf); // Offsets from northermost tile + itt[k].ti.x = grf_load_byte(&buf); // Offsets from northermost tile - if (itt[k].ti.x == 0xFE && k == 0) { - /* This means we have to borrow the layout from an old industry */ - IndustryType type = grf_load_byte(&buf); // industry holding required layout - byte laynbr = grf_load_byte(&buf); // layout number to borrow + if (itt[k].ti.x == 0xFE && k == 0) { + /* This means we have to borrow the layout from an old industry */ + IndustryType type = grf_load_byte(&buf); // industry holding required layout + byte laynbr = grf_load_byte(&buf); // layout number to borrow - copy_from = _origin_industry_specs[type].table[laynbr]; - for (size = 1;; size++) { - if (copy_from[size - 1].ti.x == -0x80 && copy_from[size - 1].ti.y == 0) break; + copy_from = _origin_industry_specs[type].table[laynbr]; + for (size = 1;; size++) { + if (copy_from[size - 1].ti.x == -0x80 && copy_from[size - 1].ti.y == 0) break; + } + break; } - break; - } - itt[k].ti.y = grf_load_byte(&buf); // Or table definition finalisation + itt[k].ti.y = grf_load_byte(&buf); // Or table definition finalisation - if (itt[k].ti.x == 0 && itt[k].ti.y == 0x80) { - /* Not the same terminator. The one we are using is rather - x = -80, y = x . So, adjust it. */ - itt[k].ti.x = -0x80; - itt[k].ti.y = 0; - itt[k].gfx = 0; + if (itt[k].ti.x == 0 && itt[k].ti.y == 0x80) { + /* Not the same terminator. The one we are using is rather + x = -80, y = x . So, adjust it. */ + itt[k].ti.x = -0x80; + itt[k].ti.y = 0; + itt[k].gfx = 0; - size = k + 1; - copy_from = itt; - break; - } + size = k + 1; + copy_from = itt; + break; + } - itt[k].gfx = grf_load_byte(&buf); + itt[k].gfx = grf_load_byte(&buf); - if (itt[k].gfx == 0xFE) { - /* Use a new tile from this GRF */ - int local_tile_id = grf_load_word(&buf); + if (itt[k].gfx == 0xFE) { + /* Use a new tile from this GRF */ + int local_tile_id = grf_load_word(&buf); - /* Read the ID from the _industile_mngr. */ - int tempid = _industile_mngr.GetID(local_tile_id, _cur_grffile->grfid); + /* Read the ID from the _industile_mngr. */ + int tempid = _industile_mngr.GetID(local_tile_id, _cur_grffile->grfid); - if (tempid == INVALID_INDUSTRYTILE) { - grfmsg(2, "IndustriesChangeInfo: Attempt to use industry tile %u with industry id %u, not yet defined. Ignoring.", local_tile_id, indid); - } else { - /* Declared as been valid, can be used */ - itt[k].gfx = tempid; - size = k + 1; - copy_from = itt; + if (tempid == INVALID_INDUSTRYTILE) { + grfmsg(2, "IndustriesChangeInfo: Attempt to use industry tile %u with industry id %u, not yet defined. Ignoring.", local_tile_id, indid); + } else { + /* Declared as been valid, can be used */ + itt[k].gfx = tempid; + size = k + 1; + copy_from = itt; + } + } else if (itt[k].gfx == 0xFF) { + itt[k].ti.x = (int8)GB(itt[k].ti.x, 0, 8); + itt[k].ti.y = (int8)GB(itt[k].ti.y, 0, 8); } - } else if (itt[k].gfx == 0xFF) { - itt[k].ti.x = (int8)GB(itt[k].ti.x, 0, 8); - itt[k].ti.y = (int8)GB(itt[k].ti.y, 0, 8); } - } - if (!ValidateIndustryLayout(copy_from, size)) { - /* The industry layout was not valid, so skip this one. */ - grfmsg(1, "IndustriesChangeInfo: Invalid industry layout for industry id %u. Ignoring", indid); - indsp->num_table--; - j--; - } else { - tile_table[j] = CallocT<IndustryTileTable>(size); - memcpy(tile_table[j], copy_from, sizeof(*copy_from) * size); + if (!ValidateIndustryLayout(copy_from, size)) { + /* The industry layout was not valid, so skip this one. */ + grfmsg(1, "IndustriesChangeInfo: Invalid industry layout for industry id %u. Ignoring", indid); + indsp->num_table--; + j--; + } else { + tile_table[j] = CallocT<IndustryTileTable>(size); + memcpy(tile_table[j], copy_from, sizeof(*copy_from) * size); + } } + } catch (...) { + free(tile_table); + free(itt); + throw; } + /* Install final layout construction in the industry spec */ indsp->table = tile_table; SetBit(indsp->cleanup_flag, 1); @@ -2386,7 +2404,15 @@ static ChangeInfoResult IndustriesChangeInfo(uint indid, int numinfo, int prop, indsp->number_of_sounds = grf_load_byte(&buf); uint8 *sounds = MallocT<uint8>(indsp->number_of_sounds); - for (uint8 j = 0; j < indsp->number_of_sounds; j++) sounds[j] = grf_load_byte(&buf); + try { + for (uint8 j = 0; j < indsp->number_of_sounds; j++) { + sounds[j] = grf_load_byte(&buf); + } + } catch (...) { + free(sounds); + throw; + } + indsp->random_sounds = sounds; SetBit(indsp->cleanup_flag, 0); } break; @@ -2454,7 +2480,6 @@ static ChangeInfoResult IndustriesChangeInfo(uint indid, int numinfo, int prop, } } - *bufp = buf; return ret; } @@ -2486,10 +2511,8 @@ static bool HandleChangeInfoResult(const char *caller, ChangeInfoResult cir, uin } /* Action 0x00 */ -static void FeatureChangeInfo(byte *buf, size_t len) +static void FeatureChangeInfo(ByteReader *buf) { - byte *bufend = buf + len; - /* <00> <feature> <num-props> <num-info> <id> (<property <new-info>)... * * B feature @@ -2517,8 +2540,6 @@ static void FeatureChangeInfo(byte *buf, size_t len) /* GSF_SOUNDFX */ SoundEffectChangeInfo, }; - if (!check_length(len, 6, "FeatureChangeInfo")) return; - buf++; uint8 feature = grf_load_byte(&buf); uint8 numprops = grf_load_byte(&buf); uint numinfo = grf_load_byte(&buf); @@ -2535,19 +2556,17 @@ static void FeatureChangeInfo(byte *buf, size_t len) /* Mark the feature as used by the grf */ SetBit(_cur_grffile->grf_features, feature); - while (numprops-- && buf < bufend) { + while (numprops-- && buf->HasData()) { uint8 prop = grf_load_byte(&buf); - ChangeInfoResult cir = handler[feature](engine, numinfo, prop, &buf, bufend - buf); + ChangeInfoResult cir = handler[feature](engine, numinfo, prop, buf); if (HandleChangeInfoResult("FeatureChangeInfo", cir, feature, prop)) return; } } /* Action 0x00 (GLS_SAFETYSCAN) */ -static void SafeChangeInfo(byte *buf, size_t len) +static void SafeChangeInfo(ByteReader *buf) { - if (!check_length(len, 6, "SafeChangeInfo")) return; - buf++; uint8 feature = grf_load_byte(&buf); uint8 numprops = grf_load_byte(&buf); uint numinfo = grf_load_byte(&buf); @@ -2583,12 +2602,8 @@ static void SafeChangeInfo(byte *buf, size_t len) } /* Action 0x00 (GLS_RESERVE) */ -static void ReserveChangeInfo(byte *buf, size_t len) +static void ReserveChangeInfo(ByteReader *buf) { - byte *bufend = buf + len; - - if (!check_length(len, 6, "ReserveChangeInfo")) return; - buf++; uint8 feature = grf_load_byte(&buf); if (feature != GSF_CARGOS && feature != GSF_GLOBALVAR) return; @@ -2597,18 +2612,18 @@ static void ReserveChangeInfo(byte *buf, size_t len) uint8 numinfo = grf_load_byte(&buf); uint8 index = grf_load_extended(&buf); - while (numprops-- && buf < bufend) { + while (numprops-- && buf->HasData()) { uint8 prop = grf_load_byte(&buf); ChangeInfoResult cir = CIR_SUCCESS; switch (feature) { default: NOT_REACHED(); case GSF_CARGOS: - cir = CargoChangeInfo(index, numinfo, prop, &buf, bufend - buf); + cir = CargoChangeInfo(index, numinfo, prop, buf); break; case GSF_GLOBALVAR: - cir = GlobalVarReserveInfo(index, numinfo, prop, &buf, bufend - buf); + cir = GlobalVarReserveInfo(index, numinfo, prop, buf); break; } @@ -2617,7 +2632,7 @@ static void ReserveChangeInfo(byte *buf, size_t len) } /* Action 0x01 */ -static void NewSpriteSet(byte *buf, size_t len) +static void NewSpriteSet(ByteReader *buf) { /* <01> <feature> <num-sets> <num-ent> * @@ -2631,8 +2646,6 @@ static void NewSpriteSet(byte *buf, size_t len) * In that case, use num-dirs=4. */ - if (!check_length(len, 4, "NewSpriteSet")) return; - buf++; uint8 feature = grf_load_byte(&buf); uint8 num_sets = grf_load_byte(&buf); uint16 num_ents = grf_load_extended(&buf); @@ -2653,10 +2666,8 @@ static void NewSpriteSet(byte *buf, size_t len) } /* Action 0x01 (SKIP) */ -static void SkipAct1(byte *buf, size_t len) +static void SkipAct1(ByteReader *buf) { - if (!check_length(len, 4, "SkipAct1")) return; - buf++; grf_load_byte(&buf); uint8 num_sets = grf_load_byte(&buf); uint16 num_ents = grf_load_extended(&buf); @@ -2712,7 +2723,7 @@ static const SpriteGroup *CreateGroupFromGroupID(byte feature, byte setid, byte } /* Action 0x02 */ -static void NewSpriteGroup(byte *buf, size_t len) +static void NewSpriteGroup(ByteReader *buf) { /* <02> <feature> <set-id> <type/num-entries> <feature-specific-data...> * @@ -2725,10 +2736,6 @@ static void NewSpriteGroup(byte *buf, size_t len) * meaning depends on the feature * V feature-specific-data (huge mess, don't even look it up --pasky) */ SpriteGroup *act_group = NULL; - byte *bufend = buf + len; - - if (!check_length(len, 5, "NewSpriteGroup")) return; - buf++; uint8 feature = grf_load_byte(&buf); uint8 setid = grf_load_byte(&buf); @@ -2743,6 +2750,10 @@ static void NewSpriteGroup(byte *buf, size_t len) } } + /* Sprite Groups are created here but they are allocated from a pool, so + * we do not need to delete anything if there is an exception from the + * ByteReader. */ + switch (type) { /* Deterministic Sprite Group */ case 0x81: // Self scope, byte @@ -2755,9 +2766,6 @@ static void NewSpriteGroup(byte *buf, size_t len) byte varadjust; byte varsize; - /* Check we can load the var size parameter */ - if (!check_length(bufend - buf, 1, "NewSpriteGroup (Deterministic) (1)")) return; - DeterministicSpriteGroup *group = new DeterministicSpriteGroup(); act_group = group; group->var_scope = HasBit(type, 1) ? VSG_SCOPE_PARENT : VSG_SCOPE_SELF; @@ -2769,17 +2777,11 @@ static void NewSpriteGroup(byte *buf, size_t len) case 2: group->size = DSG_SIZE_DWORD; varsize = 4; break; } - if (!check_length(bufend - buf, 5 + varsize, "NewSpriteGroup (Deterministic) (2)")) return; - /* Loop through the var adjusts. Unfortunately we don't know how many we have * from the outset, so we shall have to keep reallocing. */ do { DeterministicSpriteGroupAdjust *adjust; - if (group->num_adjusts > 0) { - if (!check_length(bufend - buf, 2 + varsize + 3, "NewSpriteGroup (Deterministic) (3)")) return; - } - group->num_adjusts++; group->adjusts = ReallocT(group->adjusts, group->num_adjusts); @@ -2814,8 +2816,6 @@ static void NewSpriteGroup(byte *buf, size_t len) group->num_ranges = grf_load_byte(&buf); if (group->num_ranges > 0) group->ranges = CallocT<DeterministicSpriteGroupRange>(group->num_ranges); - if (!check_length(bufend - buf, 2 + (2 + 2 * varsize) * group->num_ranges, "NewSpriteGroup (Deterministic)")) return; - for (uint i = 0; i < group->num_ranges; i++) { group->ranges[i].group = GetGroupFromGroupID(setid, type, grf_load_word(&buf)); group->ranges[i].low = grf_load_var(varsize, &buf); @@ -2831,8 +2831,6 @@ static void NewSpriteGroup(byte *buf, size_t len) case 0x83: // Parent scope case 0x84: // Relative scope { - if (!check_length(bufend - buf, HasBit(type, 2) ? 8 : 7, "NewSpriteGroup (Randomized) (1)")) return; - RandomizedSpriteGroup *group = new RandomizedSpriteGroup(); act_group = group; group->var_scope = HasBit(type, 1) ? VSG_SCOPE_PARENT : VSG_SCOPE_SELF; @@ -2849,8 +2847,6 @@ static void NewSpriteGroup(byte *buf, size_t len) group->num_groups = grf_load_byte(&buf); group->groups = CallocT<const SpriteGroup*>(group->num_groups); - if (!check_length(bufend - buf, 2 * group->num_groups, "NewSpriteGroup (Randomized) (2)")) return; - for (uint i = 0; i < group->num_groups; i++) { group->groups[i] = GetGroupFromGroupID(setid, type, grf_load_word(&buf)); } @@ -2879,8 +2875,6 @@ static void NewSpriteGroup(byte *buf, size_t len) return; } - if (!check_length(bufend - buf, 2 * num_loaded + 2 * num_loading, "NewSpriteGroup (Real) (1)")) return; - RealSpriteGroup *group = new RealSpriteGroup(); act_group = group; @@ -3084,7 +3078,7 @@ static bool IsValidGroupID(uint16 groupid, const char *function) return true; } -static void VehicleMapSpriteGroup(byte *buf, byte feature, uint8 idcount) +static void VehicleMapSpriteGroup(ByteReader *buf, byte feature, uint8 idcount) { static EngineID *last_engines; static uint last_engines_count; @@ -3158,7 +3152,7 @@ static void VehicleMapSpriteGroup(byte *buf, byte feature, uint8 idcount) } -static void CanalMapSpriteGroup(byte *buf, uint8 idcount) +static void CanalMapSpriteGroup(ByteReader *buf, uint8 idcount) { CanalFeature *cfs = AllocaM(CanalFeature, idcount); for (uint i = 0; i < idcount; i++) { @@ -3166,7 +3160,7 @@ static void CanalMapSpriteGroup(byte *buf, uint8 idcount) } uint8 cidcount = grf_load_byte(&buf); - buf += cidcount * 3; + buf->Skip(cidcount * 3); uint16 groupid = grf_load_word(&buf); if (!IsValidGroupID(groupid, "CanalMapSpriteGroup")) return; @@ -3185,7 +3179,7 @@ static void CanalMapSpriteGroup(byte *buf, uint8 idcount) } -static void StationMapSpriteGroup(byte *buf, uint8 idcount) +static void StationMapSpriteGroup(ByteReader *buf, uint8 idcount) { uint8 *stations = AllocaM(uint8, idcount); for (uint i = 0; i < idcount; i++) { @@ -3232,7 +3226,7 @@ static void StationMapSpriteGroup(byte *buf, uint8 idcount) } -static void TownHouseMapSpriteGroup(byte *buf, uint8 idcount) +static void TownHouseMapSpriteGroup(ByteReader *buf, uint8 idcount) { uint8 *houses = AllocaM(uint8, idcount); for (uint i = 0; i < idcount; i++) { @@ -3241,7 +3235,7 @@ static void TownHouseMapSpriteGroup(byte *buf, uint8 idcount) /* Skip the cargo type section, we only care about the default group */ uint8 cidcount = grf_load_byte(&buf); - buf += cidcount * 3; + buf->Skip(cidcount * 3); uint16 groupid = grf_load_word(&buf); if (!IsValidGroupID(groupid, "TownHouseMapSpriteGroup")) return; @@ -3263,7 +3257,7 @@ static void TownHouseMapSpriteGroup(byte *buf, uint8 idcount) } } -static void IndustryMapSpriteGroup(byte *buf, uint8 idcount) +static void IndustryMapSpriteGroup(ByteReader *buf, uint8 idcount) { uint8 *industries = AllocaM(uint8, idcount); for (uint i = 0; i < idcount; i++) { @@ -3272,7 +3266,7 @@ static void IndustryMapSpriteGroup(byte *buf, uint8 idcount) /* Skip the cargo type section, we only care about the default group */ uint8 cidcount = grf_load_byte(&buf); - buf += cidcount * 3; + buf->Skip(cidcount * 3); uint16 groupid = grf_load_word(&buf); if (!IsValidGroupID(groupid, "IndustryMapSpriteGroup")) return; @@ -3294,7 +3288,7 @@ static void IndustryMapSpriteGroup(byte *buf, uint8 idcount) } } -static void IndustrytileMapSpriteGroup(byte *buf, uint8 idcount) +static void IndustrytileMapSpriteGroup(ByteReader *buf, uint8 idcount) { uint8 *indtiles = AllocaM(uint8, idcount); for (uint i = 0; i < idcount; i++) { @@ -3303,7 +3297,7 @@ static void IndustrytileMapSpriteGroup(byte *buf, uint8 idcount) /* Skip the cargo type section, we only care about the default group */ uint8 cidcount = grf_load_byte(&buf); - buf += cidcount * 3; + buf->Skip(cidcount * 3); uint16 groupid = grf_load_word(&buf); if (!IsValidGroupID(groupid, "IndustrytileMapSpriteGroup")) return; @@ -3325,7 +3319,7 @@ static void IndustrytileMapSpriteGroup(byte *buf, uint8 idcount) } } -static void CargoMapSpriteGroup(byte *buf, uint8 idcount) +static void CargoMapSpriteGroup(ByteReader *buf, uint8 idcount) { CargoID *cargos = AllocaM(CargoID, idcount); for (uint i = 0; i < idcount; i++) { @@ -3334,7 +3328,7 @@ static void CargoMapSpriteGroup(byte *buf, uint8 idcount) /* Skip the cargo type section, we only care about the default group */ uint8 cidcount = grf_load_byte(&buf); - buf += cidcount * 3; + buf->Skip(cidcount * 3); uint16 groupid = grf_load_word(&buf); if (!IsValidGroupID(groupid, "CargoMapSpriteGroup")) return; @@ -3355,7 +3349,7 @@ static void CargoMapSpriteGroup(byte *buf, uint8 idcount) /* Action 0x03 */ -static void FeatureMapSpriteGroup(byte *buf, size_t len) +static void FeatureMapSpriteGroup(ByteReader *buf) { /* <03> <feature> <n-id> <ids>... <num-cid> [<cargo-type> <cid>]... <def-cid> * id-list := [<id>] [id-list] @@ -3376,9 +3370,6 @@ static void FeatureMapSpriteGroup(byte *buf, size_t len) return; } - if (!check_length(len, 6, "FeatureMapSpriteGroup")) return; - - buf++; uint8 feature = grf_load_byte(&buf); uint8 idcount = grf_load_byte(&buf); @@ -3438,7 +3429,7 @@ static void FeatureMapSpriteGroup(byte *buf, size_t len) } /* Action 0x04 */ -static void FeatureNewName(byte *buf, size_t len) +static void FeatureNewName(ByteReader *buf) { /* <04> <veh-type> <language-id> <num-veh> <offset> <data...> * @@ -3458,8 +3449,6 @@ static void FeatureNewName(byte *buf, size_t len) bool new_scheme = _cur_grffile->grf_version >= 7; - if (!check_length(len, 6, "FeatureNewName")) return; - buf++; uint8 feature = grf_load_byte(&buf); uint8 lang = grf_load_byte(&buf); uint8 num = grf_load_byte(&buf); @@ -3480,14 +3469,8 @@ static void FeatureNewName(byte *buf, size_t len) grfmsg(6, "FeatureNewName: About to rename engines %d..%d (feature %d) in language 0x%02X", id, endid, feature, lang); - len -= generic ? 6 : 5; - - for (; id < endid && len > 0; id++) { - const char *name = grf_load_string(&buf, len); - size_t name_length = strlen(name) + 1; - - len -= (int)name_length; - + for (; id < endid && buf->HasData(); id++) { + const char *name = grf_load_string(&buf); grfmsg(8, "FeatureNewName: 0x%04X <- %s", id, name); switch (feature) { @@ -3600,7 +3583,7 @@ static uint16 SanitizeSpriteOffset(uint16& num, uint16 offset, int max_sprites, } /* Action 0x05 */ -static void GraphicsNew(byte *buf, size_t len) +static void GraphicsNew(ByteReader *buf) { /* <05> <graphics-type> <num-sprites> <other data...> * @@ -3648,8 +3631,6 @@ static void GraphicsNew(byte *buf, size_t len) /* 0x15 */ { A5BLOCK_ALLOW_OFFSET, SPR_OPENTTD_BASE, 1, OPENTTD_SPRITE_COUNT, "OpenTTD GUI graphics" }, }; - if (!check_length(len, 2, "GraphicsNew")) return; - buf++; uint8 type = grf_load_byte(&buf); uint16 num = grf_load_extended(&buf); uint16 offset = HasBit(type, 7) ? grf_load_extended(&buf) : 0; @@ -3714,11 +3695,8 @@ static void GraphicsNew(byte *buf, size_t len) } /* Action 0x05 (SKIP) */ -static void SkipAct5(byte *buf, size_t len) +static void SkipAct5(ByteReader *buf) { - if (!check_length(len, 2, "SkipAct5")) return; - buf++; - /* Ignore type byte */ grf_load_byte(&buf); @@ -3906,7 +3884,7 @@ static uint32 GetParamVal(byte param, uint32 *cond_val) } /* Action 0x06 */ -static void CfgApply(byte *buf, size_t len) +static void CfgApply(ByteReader *buf) { /* <06> <param-num> <param-size> <offset> ... <FF> * @@ -3950,7 +3928,6 @@ static void CfgApply(byte *buf, size_t len) } /* Now perform the Action 0x06 on our data. */ - buf++; for (;;) { uint i; @@ -4030,7 +4007,7 @@ static void DisableStaticNewGRFInfluencingNonStaticNewGRFs(GRFConfig *c) /* Action 0x07 * Action 0x09 */ -static void SkipIf(byte *buf, size_t len) +static void SkipIf(ByteReader *buf) { /* <07/09> <param-num> <param-size> <condition-type> <value> <num-sprites> * @@ -4044,8 +4021,6 @@ static void SkipIf(byte *buf, size_t len) uint32 mask = 0; bool result; - if (!check_length(len, 6, "SkipIf")) return; - buf++; uint8 param = grf_load_byte(&buf); uint8 paramsize = grf_load_byte(&buf); uint8 condtype = grf_load_byte(&buf); @@ -4196,10 +4171,8 @@ static void SkipIf(byte *buf, size_t len) /* Action 0x08 (GLS_FILESCAN) */ -static void ScanInfo(byte *buf, size_t len) +static void ScanInfo(ByteReader *buf) { - if (!check_length(len, 8, "Info")) return; - buf++; grf_load_byte(&buf); uint32 grfid = grf_load_dword(&buf); @@ -4208,13 +4181,11 @@ static void ScanInfo(byte *buf, size_t len) /* GRF IDs starting with 0xFF are reserved for internal TTDPatch use */ if (GB(grfid, 24, 8) == 0xFF) SetBit(_cur_grfconfig->flags, GCF_SYSTEM); - len -= 6; - const char *name = grf_load_string(&buf, len); + const char *name = grf_load_string(&buf); _cur_grfconfig->name = TranslateTTDPatchCodes(grfid, name); - len -= strlen(name) + 1; - if (len > 0) { - const char *info = grf_load_string(&buf, len); + if (buf->HasData()) { + const char *info = grf_load_string(&buf); _cur_grfconfig->info = TranslateTTDPatchCodes(grfid, info); } @@ -4223,7 +4194,7 @@ static void ScanInfo(byte *buf, size_t len) } /* Action 0x08 */ -static void GRFInfo(byte *buf, size_t len) +static void GRFInfo(ByteReader *buf) { /* <08> <version> <grf-id> <name> <info> * @@ -4232,11 +4203,9 @@ static void GRFInfo(byte *buf, size_t len) * S name name of this .grf set * S info string describing the set, and e.g. author and copyright */ - if (!check_length(len, 8, "GRFInfo")) return; - buf++; uint8 version = grf_load_byte(&buf); uint32 grfid = grf_load_dword(&buf); - const char *name = grf_load_string(&buf, len - 6); + const char *name = grf_load_string(&buf); if (_cur_stage < GLS_RESERVE && _cur_grfconfig->status != GCS_UNKNOWN) { _cur_grfconfig->status = GCS_DISABLED; @@ -4257,7 +4226,7 @@ static void GRFInfo(byte *buf, size_t len) } /* Action 0x0A */ -static void SpriteReplace(byte *buf, size_t len) +static void SpriteReplace(ByteReader *buf) { /* <0A> <num-sets> <set1> [<set2> ...] * <set>: <num-sprites> <first-sprite> @@ -4267,7 +4236,6 @@ static void SpriteReplace(byte *buf, size_t len) * B num-sprites How many sprites are in this set * W first-sprite First sprite number to replace */ - buf++; // skip action byte uint8 num_sets = grf_load_byte(&buf); for (uint i = 0; i < num_sets; i++) { @@ -4293,9 +4261,8 @@ static void SpriteReplace(byte *buf, size_t len) } /* Action 0x0A (SKIP) */ -static void SkipActA(byte *buf, size_t len) +static void SkipActA(ByteReader *buf) { - buf++; uint8 num_sets = grf_load_byte(&buf); for (uint i = 0; i < num_sets; i++) { @@ -4309,7 +4276,7 @@ static void SkipActA(byte *buf, size_t len) } /* Action 0x0B */ -static void GRFLoadError(byte *buf, size_t len) +static void GRFLoadError(ByteReader *buf) { /* <0B> <severity> <language-id> <message-id> [<message...> 00] [<data...>] 00 [<parnum>] * @@ -4343,16 +4310,12 @@ static void GRFLoadError(byte *buf, size_t len) STR_NEWGRF_ERROR_MSG_FATAL }; - if (!check_length(len, 6, "GRFLoadError")) return; - /* For now we can only show one message per newgrf file. */ if (_cur_grfconfig->error != NULL) return; - buf++; // Skip the action byte. byte severity = grf_load_byte(&buf); byte lang = grf_load_byte(&buf); byte message_id = grf_load_byte(&buf); - len -= 4; /* Skip the error if it isn't valid for the current language. */ if (!CheckGrfLangID(lang, _cur_grffile->grf_version)) return; @@ -4381,7 +4344,7 @@ static void GRFLoadError(byte *buf, size_t len) return; } - if (len <= 1) { + if (buf->Remaining() <= 1) { grfmsg(7, "GRFLoadError: No message data supplied."); return; } @@ -4392,17 +4355,20 @@ static void GRFLoadError(byte *buf, size_t len) if (message_id == 0xFF) { /* This is a custom error message. */ - const char *message = grf_load_string(&buf, len); - len -= (strlen(message) + 1); + if (buf->HasData()) { + const char *message = grf_load_string(&buf); - error->custom_message = TranslateTTDPatchCodes(_cur_grffile->grfid, message); + error->custom_message = TranslateTTDPatchCodes(_cur_grffile->grfid, message); + } else { + grfmsg(7, "GRFLoadError: No custom message supplied."); + error->custom_message = strdup(""); + } } else { error->message = msgstr[message_id]; } - if (len > 0) { - const char *data = grf_load_string(&buf, len); - len -= (strlen(data) + 1); + if (buf->HasData()) { + const char *data = grf_load_string(&buf); error->data = TranslateTTDPatchCodes(_cur_grffile->grfid, data); } else { @@ -4412,10 +4378,9 @@ static void GRFLoadError(byte *buf, size_t len) /* Only two parameter numbers can be used in the string. */ uint i = 0; - for (; i < 2 && len > 0; i++) { + for (; i < 2 && buf->HasData(); i++) { uint param_number = grf_load_byte(&buf); error->param_value[i] = _cur_grffile->GetParam(param_number); - len--; } error->num_params = i; @@ -4423,24 +4388,21 @@ static void GRFLoadError(byte *buf, size_t len) } /* Action 0x0C */ -static void GRFComment(byte *buf, size_t len) +static void GRFComment(ByteReader *buf) { /* <0C> [<ignored...>] * * V ignored Anything following the 0C is ignored */ - if (len == 1) return; + if (!buf->HasData()) return; - size_t text_len = len - 1; - const char *text = (const char*)(buf + 1); - grfmsg(2, "GRFComment: %.*s", (int)text_len, text); + const char *text = grf_load_string(&buf); + grfmsg(2, "GRFComment: %s", text); } /* Action 0x0D (GLS_SAFETYSCAN) */ -static void SafeParamSet(byte *buf, size_t len) +static void SafeParamSet(ByteReader *buf) { - if (!check_length(len, 5, "SafeParamSet")) return; - buf++; uint8 target = grf_load_byte(&buf); /* Only writing GRF parameters is considered safe */ @@ -4570,7 +4532,7 @@ static uint32 PerformGRM(uint32 *grm, uint16 num_ids, uint16 count, uint8 op, ui /* Action 0x0D */ -static void ParamSet(byte *buf, size_t len) +static void ParamSet(ByteReader *buf) { /* <0D> <target> <operation> <source1> <source2> [<data>] * @@ -4594,15 +4556,13 @@ static void ParamSet(byte *buf, size_t len) * (source2 like in 05, and source1 as well) */ - if (!check_length(len, 5, "ParamSet")) return; - buf++; uint8 target = grf_load_byte(&buf); uint8 oper = grf_load_byte(&buf); uint32 src1 = grf_load_byte(&buf); uint32 src2 = grf_load_byte(&buf); uint32 data = 0; - if (len >= 8) data = grf_load_dword(&buf); + if (buf->Remaining() >= 4) data = grf_load_dword(&buf); /* You can add 80 to the operation to make it apply only if the target * is not defined yet. In this respect, a parameter is taken to be @@ -4873,17 +4833,14 @@ static void ParamSet(byte *buf, size_t len) } /* Action 0x0E (GLS_SAFETYSCAN) */ -static void SafeGRFInhibit(byte *buf, size_t len) +static void SafeGRFInhibit(ByteReader *buf) { /* <0E> <num> <grfids...> * * B num Number of GRFIDs that follow * D grfids GRFIDs of the files to deactivate */ - if (!check_length(len, 2, "GRFInhibit")) return; - buf++; uint8 num = grf_load_byte(&buf); - if (!check_length(len, 2 + 4 * num, "GRFInhibit")) return; for (uint i = 0; i < num; i++) { uint32 grfid = grf_load_dword(&buf); @@ -4901,17 +4858,14 @@ static void SafeGRFInhibit(byte *buf, size_t len) } /* Action 0x0E */ -static void GRFInhibit(byte *buf, size_t len) +static void GRFInhibit(ByteReader *buf) { /* <0E> <num> <grfids...> * * B num Number of GRFIDs that follow * D grfids GRFIDs of the files to deactivate */ - if (!check_length(len, 2, "GRFInhibit")) return; - buf++; uint8 num = grf_load_byte(&buf); - if (!check_length(len, 2 + 4 * num, "GRFInhibit")) return; for (uint i = 0; i < num; i++) { uint32 grfid = grf_load_dword(&buf); @@ -4926,7 +4880,7 @@ static void GRFInhibit(byte *buf, size_t len) } /* Action 0x0F */ -static void FeatureTownName(byte *buf, size_t len) +static void FeatureTownName(ByteReader *buf) { /* <0F> <id> <style-name> <num-parts> <parts> * @@ -4935,15 +4889,11 @@ static void FeatureTownName(byte *buf, size_t len) * B num-parts Number of parts in this definition * V parts The parts */ - if (!check_length(len, 1, "FeatureTownName: definition ID")) return; - buf++; len--; - uint32 grfid = _cur_grffile->grfid; GRFTownName *townname = AddGRFTownName(grfid); byte id = grf_load_byte(&buf); - len--; grfmsg(6, "FeatureTownName: definition 0x%02X", id & 0x7F); if (HasBit(id, 7)) { @@ -4951,17 +4901,13 @@ static void FeatureTownName(byte *buf, size_t len) ClrBit(id, 7); bool new_scheme = _cur_grffile->grf_version >= 7; - if (!check_length(len, 1, "FeatureTownName: lang_id")) return; byte lang = grf_load_byte(&buf); - len--; byte nb_gen = townname->nb_gen; do { ClrBit(lang, 7); - if (!check_length(len, 1, "FeatureTownName: style name")) return; - const char *name = grf_load_string(&buf, len); - len -= strlen(name) + 1; + const char *name = grf_load_string(&buf); char *lang_name = TranslateTTDPatchCodes(grfid, name); grfmsg(6, "FeatureTownName: lang 0x%X -> '%s'", lang, lang_name); @@ -4969,41 +4915,32 @@ static void FeatureTownName(byte *buf, size_t len) townname->name[nb_gen] = AddGRFString(grfid, id, lang, new_scheme, name, STR_UNDEFINED); - if (!check_length(len, 1, "FeatureTownName: lang_id")) return; lang = grf_load_byte(&buf); - len--; } while (lang != 0); townname->id[nb_gen] = id; townname->nb_gen++; } - if (!check_length(len, 1, "FeatureTownName: number of parts")) return; byte nb = grf_load_byte(&buf); - len--; grfmsg(6, "FeatureTownName: %u parts", nb); townname->nbparts[id] = nb; townname->partlist[id] = CallocT<NamePartList>(nb); for (int i = 0; i < nb; i++) { - if (!check_length(len, 3, "FeatureTownName: parts header")) return; byte nbtext = grf_load_byte(&buf); townname->partlist[id][i].bitstart = grf_load_byte(&buf); townname->partlist[id][i].bitcount = grf_load_byte(&buf); townname->partlist[id][i].maxprob = 0; townname->partlist[id][i].partcount = nbtext; townname->partlist[id][i].parts = CallocT<NamePart>(nbtext); - len -= 3; grfmsg(6, "FeatureTownName: part %d contains %d texts and will use GB(seed, %d, %d)", i, nbtext, townname->partlist[id][i].bitstart, townname->partlist[id][i].bitcount); for (int j = 0; j < nbtext; j++) { - if (!check_length(len, 2, "FeatureTownName: part")) return; byte prob = grf_load_byte(&buf); - len--; if (HasBit(prob, 7)) { byte ref_id = grf_load_byte(&buf); - len--; if (townname->nbparts[ref_id] == 0) { grfmsg(0, "FeatureTownName: definition 0x%02X doesn't exist, deactivating", ref_id); @@ -5017,8 +4954,7 @@ static void FeatureTownName(byte *buf, size_t len) grfmsg(6, "FeatureTownName: part %d, text %d, uses intermediate definition 0x%02X (with probability %d)", i, j, ref_id, prob & 0x7F); townname->partlist[id][i].parts[j].data.id = ref_id; } else { - const char *text = grf_load_string(&buf, len); - len -= strlen(text) + 1; + const char *text = grf_load_string(&buf); townname->partlist[id][i].parts[j].data.text = TranslateTTDPatchCodes(grfid, text); grfmsg(6, "FeatureTownName: part %d, text %d, '%s' (with probability %d)", i, j, townname->partlist[id][i].parts[j].data.text, prob); } @@ -5030,18 +4966,17 @@ static void FeatureTownName(byte *buf, size_t len) } /* Action 0x10 */ -static void DefineGotoLabel(byte *buf, size_t len) +static void DefineGotoLabel(ByteReader *buf) { /* <10> <label> [<comment>] * * B label The label to define * V comment Optional comment - ignored */ - if (!check_length(len, 1, "DefineGotoLabel")) return; - buf++; len--; + byte nfo_label = grf_load_byte(&buf); GRFLabel *label = MallocT<GRFLabel>(1); - label->label = grf_load_byte(&buf); + label->label = nfo_label; label->nfo_line = _nfo_line; label->pos = FioGetPos(); label->next = NULL; @@ -5060,14 +4995,12 @@ static void DefineGotoLabel(byte *buf, size_t len) } /* Action 0x11 */ -static void GRFSound(byte *buf, size_t len) +static void GRFSound(ByteReader *buf) { /* <11> <num> * * W num Number of sound files that follow */ - if (!check_length(len, 1, "GRFSound")) return; - buf++; uint16 num = grf_load_word(&buf); _grf_data_blocks = num; @@ -5077,20 +5010,18 @@ static void GRFSound(byte *buf, size_t len) } /* Action 0x11 (SKIP) */ -static void SkipAct11(byte *buf, size_t len) +static void SkipAct11(ByteReader *buf) { /* <11> <num> * * W num Number of sound files that follow */ - if (!check_length(len, 1, "SkipAct11")) return; - buf++; _skip_sprites = grf_load_word(&buf); grfmsg(3, "SkipAct11: Skipping %d sprites", _skip_sprites); } -static void ImportGRFSound(byte *buf, int len) +static void ImportGRFSound(ByteReader *buf) { const GRFFile *file; SoundEntry *sound = AllocateSound(); @@ -5118,15 +5049,13 @@ static void ImportGRFSound(byte *buf, int len) } /* 'Action 0xFE' */ -static void GRFImportBlock(byte *buf, int len) +static void GRFImportBlock(ByteReader *buf) { if (_grf_data_blocks == 0) { grfmsg(2, "GRFImportBlock: Unexpected import block, skipping"); return; } - buf++; - _grf_data_blocks--; /* XXX 'Action 0xFE' isn't really specified. It is only mentioned for @@ -5136,15 +5065,13 @@ static void GRFImportBlock(byte *buf, int len) } switch (_grf_data_type) { - case GDT_SOUND: ImportGRFSound(buf, len - 1); break; + case GDT_SOUND: ImportGRFSound(buf); break; default: NOT_REACHED(); } } -static void LoadGRFSound(byte *buf, uint len) +static void LoadGRFSound(ByteReader *buf) { - byte *buf_start = buf; - /* Allocate a sound entry. This is done even if the data is not loaded * so that the indices used elsewhere are still correct. */ SoundEntry *sound = AllocateSound(); @@ -5155,7 +5082,7 @@ static void LoadGRFSound(byte *buf, uint len) } uint32 total_size = grf_load_dword(&buf); - if (total_size > len + 8) { + if (total_size > buf->Remaining()) { grfmsg(1, "LoadGRFSound: RIFF was truncated"); return; } @@ -5194,7 +5121,7 @@ static void LoadGRFSound(byte *buf, uint len) case 'atad': // 'data' sound->file_size = size; - sound->file_offset = FioGetPos() - (len - (buf - buf_start)); + sound->file_offset = FioGetPos() - buf->Remaining(); sound->file_slot = _file_index; /* Set default volume and priority */ @@ -5220,7 +5147,7 @@ static void LoadGRFSound(byte *buf, uint len) } /* Action 0x12 */ -static void LoadFontGlyph(byte *buf, size_t len) +static void LoadFontGlyph(ByteReader *buf) { /* <12> <num_def> <font_size> <num_char> <base_char> * @@ -5229,13 +5156,8 @@ static void LoadFontGlyph(byte *buf, size_t len) * B num_char Number of consecutive glyphs * W base_char First character index */ - buf++; len--; - if (!check_length(len, 1, "LoadFontGlyph")) return; - uint8 num_def = grf_load_byte(&buf); - if (!check_length(len, 1 + num_def * 4, "LoadFontGlyph")) return; - for (uint i = 0; i < num_def; i++) { FontSize size = (FontSize)grf_load_byte(&buf); uint8 num_char = grf_load_byte(&buf); @@ -5252,7 +5174,7 @@ static void LoadFontGlyph(byte *buf, size_t len) } /* Action 0x12 (SKIP) */ -static void SkipAct12(byte *buf, size_t len) +static void SkipAct12(ByteReader *buf) { /* <12> <num_def> <font_size> <num_char> <base_char> * @@ -5261,12 +5183,8 @@ static void SkipAct12(byte *buf, size_t len) * B num_char Number of consecutive glyphs * W base_char First character index */ - buf++; len--; - if (!check_length(len, 1, "SkipAct12")) return; uint8 num_def = grf_load_byte(&buf); - if (!check_length(len, 1 + num_def * 4, "SkipAct12")) return; - for (uint i = 0; i < num_def; i++) { /* Ignore 'size' byte */ grf_load_byte(&buf); @@ -5282,7 +5200,7 @@ static void SkipAct12(byte *buf, size_t len) } /* Action 0x13 */ -static void TranslateGRFStrings(byte *buf, size_t len) +static void TranslateGRFStrings(ByteReader *buf) { /* <13> <grfid> <num-ent> <offset> <text...> * @@ -5291,9 +5209,6 @@ static void TranslateGRFStrings(byte *buf, size_t len) * W offset First text ID * S text... Zero-terminated strings */ - buf++; len--; - if (!check_length(len, 7, "TranslateGRFString")) return; - uint32 grfid = grf_load_dword(&buf); const GRFConfig *c = GetGRFConfig(grfid); if (c == NULL || (c->status != GCS_INITIALISED && c->status != GCS_ACTIVATED)) { @@ -5330,15 +5245,10 @@ static void TranslateGRFStrings(byte *buf, size_t len) return; } - len -= 7; - - for (uint i = 0; i < num_strings && len > 0; i++) { - const char *string = grf_load_string(&buf, len); - size_t string_length = strlen(string) + 1; + for (uint i = 0; i < num_strings && buf->HasData(); i++) { + const char *string = grf_load_string(&buf); - len -= (int)string_length; - - if (string_length == 1) { + if (StrEmpty(string)) { grfmsg(7, "TranslateGRFString: Ignoring empty string."); continue; } @@ -5353,7 +5263,7 @@ static void TranslateGRFStrings(byte *buf, size_t len) } /* 'Action 0xFF' */ -static void GRFDataBlock(byte *buf, int len) +static void GRFDataBlock(ByteReader *buf) { /* <FF> <name_len> <name> '\0' <data> */ @@ -5362,12 +5272,9 @@ static void GRFDataBlock(byte *buf, int len) return; } - if (!check_length(len, 3, "GRFDataBlock")) return; - - buf++; uint8 name_len = grf_load_byte(&buf); - const char *name = (const char *)buf; - buf += name_len; + const char *name = reinterpret_cast<const char *>(buf->Data()); + buf->Skip(name_len); /* Test string termination */ if (grf_load_byte(&buf) != 0) { @@ -5375,21 +5282,19 @@ static void GRFDataBlock(byte *buf, int len) return; } - if (!check_length(len, 3 + name_len, "GRFDataBlock")) return; - grfmsg(2, "GRFDataBlock: block name '%s'...", name); _grf_data_blocks--; switch (_grf_data_type) { - case GDT_SOUND: LoadGRFSound(buf, len - name_len - 3); break; + case GDT_SOUND: LoadGRFSound(buf); break; default: NOT_REACHED(); } } /* Used during safety scan on unsafe actions */ -static void GRFUnsafe(byte *buf, size_t len) +static void GRFUnsafe(ByteReader *buf) { SetBit(_cur_grfconfig->flags, GCF_UNSAFE); @@ -6045,21 +5950,34 @@ static void DecodeSpecialSprite(byte *buf, uint num, GrfLoadingStage stage) FioSeekTo(num, SEEK_CUR); } - byte action = buf[0]; + ByteReader br(buf, buf + num); + ByteReader *bufp = &br; - if (action == 0xFF) { - grfmsg(7, "DecodeSpecialSprite: Handling data block in stage %d", stage); - GRFDataBlock(buf, num); - } else if (action == 0xFE) { - grfmsg(7, "DecodeSpecialSprite: Handling import block in stage %d", stage); - GRFImportBlock(buf, num); - } else if (action >= lengthof(handlers)) { - grfmsg(7, "DecodeSpecialSprite: Skipping unknown action 0x%02X", action); - } else if (handlers[action][stage] == NULL) { - grfmsg(7, "DecodeSpecialSprite: Skipping action 0x%02X in stage %d", action, stage); - } else { - grfmsg(7, "DecodeSpecialSprite: Handling action 0x%02X in stage %d", action, stage); - handlers[action][stage](buf, num); + try { + byte action = grf_load_byte(&bufp); + + if (action == 0xFF) { + grfmsg(7, "DecodeSpecialSprite: Handling data block in stage %d", stage); + GRFDataBlock(bufp); + } else if (action == 0xFE) { + grfmsg(7, "DecodeSpecialSprite: Handling import block in stage %d", stage); + GRFImportBlock(bufp); + } else if (action >= lengthof(handlers)) { + grfmsg(7, "DecodeSpecialSprite: Skipping unknown action 0x%02X", action); + } else if (handlers[action][stage] == NULL) { + grfmsg(7, "DecodeSpecialSprite: Skipping action 0x%02X in stage %d", action, stage); + } else { + grfmsg(7, "DecodeSpecialSprite: Handling action 0x%02X in stage %d", action, stage); + handlers[action][stage](bufp); + } + } catch (...) { + grfmsg(1, "DecodeSpecialSprite: Tried to read past end of pseudo-sprite data"); + + _skip_sprites = -1; + _cur_grfconfig->status = GCS_DISABLED; + _cur_grfconfig->error = CallocT<GRFError>(1); + _cur_grfconfig->error->severity = STR_NEWGRF_ERROR_MSG_FATAL; + _cur_grfconfig->error->message = STR_NEWGRF_ERROR_READ_BOUNDS; } } |