From f658b79e152a178a1a6b8c5d585a523de15f1830 Mon Sep 17 00:00:00 2001
From: rubidium <rubidium@openttd.org>
Date: Thu, 17 Jan 2008 02:09:34 +0000
Subject: [PATCH] (svn r11887) -Fix [FS#1658]: segmentation faults/wrong frees
 due uninitialized memory in the AI.

---
 src/ai/default/default.cpp | 16 ++++++++--------
 src/order.h                |  3 ++-
 2 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/src/ai/default/default.cpp b/src/ai/default/default.cpp
index f582e1edff..d48f302115 100644
--- a/src/ai/default/default.cpp
+++ b/src/ai/default/default.cpp
@@ -297,9 +297,9 @@ static void AiHandleGotoDepot(Player *p, int cmd)
 
 static void AiRestoreVehicleOrders(Vehicle *v, BackuppedOrders *bak)
 {
-	uint i;
+	if (bak->order == NULL) return;
 
-	for (i = 0; bak->order[i].type != OT_NOTHING; i++) {
+	for (uint i = 0; bak->order[i].type != OT_NOTHING; i++) {
 		if (!DoCommandP(0, v->index + (i << 16), PackOrder(&bak->order[i]), NULL, CMD_INSERT_ORDER | CMD_NO_TEST_IF_IN_NETWORK))
 			break;
 	}
@@ -338,7 +338,7 @@ static void AiHandleReplaceTrain(Player *p)
 static void AiHandleReplaceRoadVeh(Player *p)
 {
 	const Vehicle* v = _players_ai[p->index].cur_veh;
-	BackuppedOrders orderbak[1];
+	BackuppedOrders orderbak;
 	EngineID veh;
 
 	if (!v->IsStoppedInDepot()) {
@@ -350,14 +350,14 @@ static void AiHandleReplaceRoadVeh(Player *p)
 	if (veh != INVALID_ENGINE) {
 		TileIndex tile;
 
-		BackupVehicleOrders(v, orderbak);
+		BackupVehicleOrders(v, &orderbak);
 		tile = v->tile;
 
 		if (CmdSucceeded(DoCommand(0, v->index, 0, DC_EXEC, CMD_SELL_ROAD_VEH)) &&
 				CmdSucceeded(DoCommand(tile, veh, 0, DC_EXEC, CMD_BUILD_ROAD_VEH))) {
 			VehicleID veh = _new_vehicle_id;
 
-			AiRestoreVehicleOrders(GetVehicle(veh), orderbak);
+			AiRestoreVehicleOrders(GetVehicle(veh), &orderbak);
 			DoCommand(0, veh, 0, DC_EXEC, CMD_START_STOP_ROADVEH);
 			DoCommand(0, veh, _ai_service_interval, DC_EXEC, CMD_CHANGE_SERVICE_INT);
 		}
@@ -367,7 +367,7 @@ static void AiHandleReplaceRoadVeh(Player *p)
 static void AiHandleReplaceAircraft(Player *p)
 {
 	const Vehicle* v = _players_ai[p->index].cur_veh;
-	BackuppedOrders orderbak[1];
+	BackuppedOrders orderbak;
 	EngineID veh;
 
 	if (!v->IsStoppedInDepot()) {
@@ -379,13 +379,13 @@ static void AiHandleReplaceAircraft(Player *p)
 	if (veh != INVALID_ENGINE) {
 		TileIndex tile;
 
-		BackupVehicleOrders(v, orderbak);
+		BackupVehicleOrders(v, &orderbak);
 		tile = v->tile;
 
 		if (CmdSucceeded(DoCommand(0, v->index, 0, DC_EXEC, CMD_SELL_AIRCRAFT)) &&
 				CmdSucceeded(DoCommand(tile, veh, 0, DC_EXEC, CMD_BUILD_AIRCRAFT))) {
 			VehicleID veh = _new_vehicle_id;
-			AiRestoreVehicleOrders(GetVehicle(veh), orderbak);
+			AiRestoreVehicleOrders(GetVehicle(veh), &orderbak);
 			DoCommand(0, veh, 0, DC_EXEC, CMD_START_STOP_AIRCRAFT);
 
 			DoCommand(0, veh, _ai_service_interval, DC_EXEC, CMD_CHANGE_SERVICE_INT);
diff --git a/src/order.h b/src/order.h
index ff3c78a959..e961cec807 100644
--- a/src/order.h
+++ b/src/order.h
@@ -121,7 +121,8 @@ struct Order : PoolItem<Order, OrderID, &_Order_pool> {
 };
 
 struct BackuppedOrders {
-	BackuppedOrders() : order(NULL) { }
+	BackuppedOrders() : order(NULL), name(NULL) { }
+	~BackuppedOrders() { free(order); free(name); }
 
 	VehicleID clone;
 	VehicleOrderID orderindex;