(svn r18990) -Codechange: [NewGRF] Add rail type map bounds checking to RailType[Change|Reserve]Info().

This commit is contained in:
peter1138 2010-02-03 08:02:07 +00:00
parent 9950fc1ede
commit f1458df1ca
1 changed files with 10 additions and 0 deletions

View File

@ -2494,6 +2494,11 @@ static ChangeInfoResult RailTypeChangeInfo(uint id, int numinfo, int prop, ByteR
extern RailtypeInfo _railtypes[RAILTYPE_END];
if (id + numinfo > RAILTYPE_END) {
grfmsg(1, "RailTypeChangeInfo: Rail type %u is invalid, max %u, ignoring", id + numinfo, RAILTYPE_END);
return CIR_INVALID_ID;
}
for (int i = 0; i < numinfo; i++) {
RailType rt = _cur_grffile->railtype_map[id + i];
if (rt == INVALID_RAILTYPE) return CIR_INVALID_ID;
@ -2589,6 +2594,11 @@ static ChangeInfoResult RailTypeReserveInfo(uint id, int numinfo, int prop, Byte
{
ChangeInfoResult ret = CIR_SUCCESS;
if (id + numinfo > RAILTYPE_END) {
grfmsg(1, "RailTypeReserveInfo: Rail type %u is invalid, max %u, ignoring", id + numinfo, RAILTYPE_END);
return CIR_INVALID_ID;
}
for (int i = 0; i < numinfo; i++) {
switch (prop) {
case 0x08: // Label of rail type