Fix #6238: Invalid tile elem iteration in Guest::UpdateUsingBin (#11248)

distribution/changelog.txt

@@ -4,6 +4,7 @@
 - Feature: [#11013] Ctrl+C copies input dialog text to clipboard.
 - Fix: [#475] Water sides drawn incorrectly (original bug).
 - Fix: [#6123, #7907, #9472, #11028] Cannot build some track designs with 4 stations (original bug).
+- Fix: [#6238] Invalid tile elem iteration in Guest::UpdateUsingBin
 - Fix: [#7094] Back wall edge texture in water missing.
 - Fix: [#9719] Hacked walls in RCT1 saves are imported incorrectly. 
 - Fix: [#10928] File browser's date column is too narrow.

src/openrct2/peep/Guest.cpp

@@ -5850,7 +5850,8 @@ void Guest::UpdateUsingBin()
             if (tileElement == nullptr)
                 return;
 
-            for (;; tileElement++)
+            bool found = false;
+            do
             {
                 if (tileElement->GetType() != TILE_ELEMENT_TYPE_PATH)
                 {
@@ -5858,13 +5859,16 @@ void Guest::UpdateUsingBin()
                 }
 
                 if (tileElement->GetBaseZ() == NextLoc.z)
-                    break;
-
-                if (tileElement->IsLastForTile())
                 {
-                    StateReset();
-                    return;
+                    found = true;
+                    break;
                 }
+            } while (!(tileElement++)->IsLastForTile());
+
+            if (!found)
+            {
+                StateReset();
+                return;
             }
 
             if (!tileElement->AsPath()->HasAddition())