From 67bd6ab0add1673ebf7a9882b71511e664b5e8d1 Mon Sep 17 00:00:00 2001 From: Peter Nelson Date: Thu, 6 Apr 2023 20:29:59 +0100 Subject: [PATCH] Fix: Check station ID is within bounds when copying layouts. --- src/newgrf.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/newgrf.cpp b/src/newgrf.cpp index 1f35f56d57..0bdcd3e5ee 100644 --- a/src/newgrf.cpp +++ b/src/newgrf.cpp @@ -1999,7 +1999,7 @@ static ChangeInfoResult StationChangeInfo(uint stid, int numinfo, int prop, Byte case 0x0A: { // Copy sprite layout byte srcid = buf->ReadByte(); - const StationSpec *srcstatspec = _cur.grffile->stations[srcid]; + const StationSpec *srcstatspec = srcid >= NUM_STATIONS_PER_GRF ? nullptr : _cur.grffile->stations[srcid]; if (srcstatspec == nullptr) { grfmsg(1, "StationChangeInfo: Station %u is not defined, cannot copy sprite layout to %u.", srcid, stid + i); @@ -2053,7 +2053,7 @@ static ChangeInfoResult StationChangeInfo(uint stid, int numinfo, int prop, Byte case 0x0F: { // Copy custom layout byte srcid = buf->ReadByte(); - const StationSpec *srcstatspec = _cur.grffile->stations[srcid]; + const StationSpec *srcstatspec = srcid >= NUM_STATIONS_PER_GRF ? nullptr : _cur.grffile->stations[srcid]; if (srcstatspec == nullptr) { grfmsg(1, "StationChangeInfo: Station %u is not defined, cannot copy tile layout to %u.", srcid, stid + i);