From 5ade3e704c91ad5deeaadc8d13e07c774ade188b Mon Sep 17 00:00:00 2001
From: Hielke Morsink <hielke.morsink@gmail.com>
Date: Sat, 22 Apr 2023 19:59:30 +0200
Subject: [PATCH] Fix #20008: Crash in PaintRotoDropTowerSection

---
 src/openrct2/ride/thrill/RotoDrop.cpp | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/src/openrct2/ride/thrill/RotoDrop.cpp b/src/openrct2/ride/thrill/RotoDrop.cpp
index ec0ed6e608..a803eab8a2 100644
--- a/src/openrct2/ride/thrill/RotoDrop.cpp
+++ b/src/openrct2/ride/thrill/RotoDrop.cpp
@@ -185,14 +185,16 @@ static void PaintRotoDropTowerSection(
     auto imageId = session.TrackColours[SCHEME_TRACK].WithIndex(SPR_ROTO_DROP_TOWER_SEGMENT);
     PaintAddImageAsParent(session, imageId, { 0, 0, height }, { { 8, 8, height }, { 2, 2, 30 } });
 
-    const TileElement* nextTileElement = reinterpret_cast<const TileElement*>(&trackElement) + 1;
-
-    while (nextTileElement->GetType() != TileElementType::Track && !nextTileElement->IsLastForTile())
+    // The top segment of the Roto drop is only drawn when there is no tile element right above it
+    bool paintTopSegment = true;
+    const auto* tileElement = trackElement.as<TileElement>();
+    while (paintTopSegment && !tileElement->IsLastForTile())
     {
-        nextTileElement++;
+        tileElement++;
+        paintTopSegment = trackElement.GetClearanceZ() != tileElement->GetBaseZ();
     }
 
-    if (trackElement.IsLastForTile() || trackElement.GetClearanceZ() != nextTileElement->GetBaseZ())
+    if (paintTopSegment)
     {
         imageId = session.TrackColours[SCHEME_TRACK].WithIndex(SPR_ROTO_DROP_TOWER_SEGMENT_TOP);
         PaintAddImageAsChild(session, imageId, { 0, 0, height }, { { 8, 8, height }, { 2, 2, 30 } });