From 6391d4927744407d6ea8b7336dad34565bc986d0 Mon Sep 17 00:00:00 2001
From: frosch <frosch@openttd.org>
Date: Tue, 14 Aug 2018 16:41:50 +0200
Subject: Fix: Variable 0x85 had no bounds checks.

---
 src/newgrf.cpp | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/newgrf.cpp b/src/newgrf.cpp
index 4cd61b95c..216bdc190 100644
--- a/src/newgrf.cpp
+++ b/src/newgrf.cpp
@@ -5907,7 +5907,8 @@ static uint32 GetParamVal(byte param, uint32 *cond_val)
 				/* Supported in Action 0x07 and 0x09, not 0x0D */
 				return 0;
 			} else {
-				uint32 param_val = _ttdpatch_flags[*cond_val / 0x20];
+				uint32 index = *cond_val / 0x20;
+				uint32 param_val = index < lengthof(_ttdpatch_flags) ? _ttdpatch_flags[index] : 0;
 				*cond_val %= 0x20;
 				return param_val;
 			}
-- 
cgit v1.2.3-54-g00ecf