From 81074e0ca2b8c7fa470db5b657998ac614a810de Mon Sep 17 00:00:00 2001
From: rubidium <rubidium@openttd.org>
Date: Fri, 12 Aug 2011 18:36:47 +0000
Subject: (svn r22737) -Fix [FS#4717]: some corrupted savegames could crash
 OpenTTD instead of showing the "savegame corrupted" message

---
 src/saveload/cheat_sl.cpp | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'src/saveload/cheat_sl.cpp')

diff --git a/src/saveload/cheat_sl.cpp b/src/saveload/cheat_sl.cpp
index 724c945df..aa5648a88 100644
--- a/src/saveload/cheat_sl.cpp
+++ b/src/saveload/cheat_sl.cpp
@@ -38,6 +38,8 @@ static void Load_CHTS()
 {
 	Cheat *cht = (Cheat*)&_cheats;
 	size_t count = SlGetFieldLength() / 2;
+	/* Cannot use lengthof because _cheats is of type Cheats, not Cheat */
+	if (count > sizeof(_cheats) / sizeof(Cheat)) SlErrorCorrupt("Too many cheat values");
 
 	for (uint i = 0; i < count; i++) {
 		cht[i].been_used = (SlReadByte() != 0);
-- 
cgit v1.2.3-70-g09d2