From 0b3659b41a3f89e2e8016c7be6219a010646b3cf Mon Sep 17 00:00:00 2001 From: peter1138 Date: Fri, 21 Apr 2006 20:59:04 +0000 Subject: [PATCH] (svn r4510) - NewGRF bounds checking: - check Engine ID is within range - don't try setting a vehicle name if the string id is not a valid Engine ID --- newgrf.c | 6 ++++-- newgrf_engine.c | 2 ++ 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/newgrf.c b/newgrf.c index 7269c5d6e5..6d373d6cd2 100644 --- a/newgrf.c +++ b/newgrf.c @@ -1761,9 +1761,11 @@ static void VehicleNewName(byte *buf, int len) case GSF_TRAIN: case GSF_ROAD: case GSF_SHIP: - case GSF_AIRCRAFT: - SetCustomEngineName(id, AddGRFString(_cur_grffile->grfid, id, lang, name)); + case GSF_AIRCRAFT: { + StringID string = AddGRFString(_cur_grffile->grfid, id, lang, name); + if (id < TOTAL_NUM_ENGINES) SetCustomEngineName(id, string); break; + } #if 0 case GSF_STATION: diff --git a/newgrf_engine.c b/newgrf_engine.c index 679a88cbd9..841cba1a9e 100644 --- a/newgrf_engine.c +++ b/newgrf_engine.c @@ -102,6 +102,7 @@ static SpriteGroup *engine_custom_sprites[TOTAL_NUM_ENGINES][NUM_GLOBAL_CID]; void SetCustomEngineSprites(EngineID engine, byte cargo, SpriteGroup *group) { + assert(engine < TOTAL_NUM_ENGINES); if (engine_custom_sprites[engine][cargo] != NULL) { DEBUG(grf, 6)("SetCustomEngineSprites: engine `%d' cargo `%d' already has group -- replacing.", engine, cargo); } @@ -610,6 +611,7 @@ StringID _engine_custom_names[TOTAL_NUM_ENGINES]; void SetCustomEngineName(EngineID engine, StringID name) { + assert(engine < lengthof(_engine_custom_names)); _engine_custom_names[engine] = name; }