Fix out of bounds errors

Changed get_surface_element to bubble up the null mapElement to be taken care of by the calling function.
Added checks on the track functions to ensure that invalid coordinates do not call get_surface_element_at.
Fixes #1066 and Fixes #1057
This commit is contained in:
Duncan Frost 2015-05-17 07:58:51 +01:00
parent f1e3668127
commit 328abd1d45
2 changed files with 19 additions and 0 deletions

View File

@ -1450,6 +1450,10 @@ int track_place_maze(sint16 x, sint16 y, sint16 z, uint8 rideIndex, uint8** trac
continue;
if (mapCoord.y > 0x1FFF)
continue;
if (mapCoord.x < 0)
continue;
if (mapCoord.y < 0)
continue;
rct_map_element* map_element = map_get_surface_element_at(mapCoord.x / 32, mapCoord.y / 32);
@ -1645,8 +1649,17 @@ int track_place_ride(sint16 x, sint16 y, sint16 z, uint8 rideIndex, uint8** trac
if (tile.y > 0x1FFF)
continue;
if (tile.x < 0)
continue;
if (tile.y < 0)
continue;
rct_map_element* map_element = map_get_surface_element_at(tile.x / 32, tile.y / 32);
if (map_element == NULL)
return 0;
int height = map_element->base_height * 8;
if (map_element->properties.surface.slope & 0xF){
height += 16;

View File

@ -164,6 +164,9 @@ rct_map_element *map_get_surface_element_at(int x, int y)
{
rct_map_element *mapElement = map_get_first_element_at(x, y);
if (mapElement == NULL)
return NULL;
// Find the first surface element
while (map_element_get_type(mapElement) != MAP_ELEMENT_TYPE_SURFACE) {
if (map_element_is_last_for_tile(mapElement))
@ -178,6 +181,9 @@ rct_map_element *map_get_surface_element_at(int x, int y)
rct_map_element* map_get_path_element_at(int x, int y, int z){
rct_map_element *mapElement = map_get_first_element_at(x, y);
if (mapElement == NULL)
return NULL;
uint8 mapFound = 0;
// Find the path element at known z
do {