# HG changeset patch
# User rubidium <rubidium@openttd.org>
# Date 2011-08-12 18:36:47
# Node ID ab4cbf6c55fc372f25f16d992c886c63345fa92d
# Parent  440046a1ce5e61f84a7db76c1747982017ed569f

(svn r22737) -Fix [FS#4717]: some corrupted savegames could crash OpenTTD instead of showing the "savegame corrupted" message

diff --git a/src/saveload/cheat_sl.cpp b/src/saveload/cheat_sl.cpp
--- a/src/saveload/cheat_sl.cpp
+++ b/src/saveload/cheat_sl.cpp
@@ -38,6 +38,8 @@ static void Load_CHTS()
 {
 	Cheat *cht = (Cheat*)&_cheats;
 	size_t count = SlGetFieldLength() / 2;
+	/* Cannot use lengthof because _cheats is of type Cheats, not Cheat */
+	if (count > sizeof(_cheats) / sizeof(Cheat)) SlErrorCorrupt("Too many cheat values");
 
 	for (uint i = 0; i < count; i++) {
 		cht[i].been_used = (SlReadByte() != 0);
diff --git a/src/saveload/company_sl.cpp b/src/saveload/company_sl.cpp
--- a/src/saveload/company_sl.cpp
+++ b/src/saveload/company_sl.cpp
@@ -283,6 +283,7 @@ static void SaveLoad_PLYR_common(Company
 	SlObject(&cprops->cur_economy, _company_economy_desc);
 
 	/* Write old economy entries. */
+	if (cprops->num_valid_stat_ent > lengthof(cprops->old_economy)) SlErrorCorrupt("Too many old economy entries");
 	for (i = 0; i < cprops->num_valid_stat_ent; i++) {
 		SlObject(&cprops->old_economy[i], _company_economy_desc);
 	}
diff --git a/src/saveload/strings_sl.cpp b/src/saveload/strings_sl.cpp
--- a/src/saveload/strings_sl.cpp
+++ b/src/saveload/strings_sl.cpp
@@ -126,7 +126,12 @@ static void Load_NAME()
 	int index;
 
 	while ((index = SlIterateArray()) != -1) {
+		if (index >= NUM_OLD_STRINGS) SlErrorCorrupt("Invalid old name index");
+		if (SlGetFieldLength() > (uint)LEN_OLD_STRINGS) SlErrorCorrupt("Invalid old name length");
+
 		SlArray(&_old_name_array[LEN_OLD_STRINGS * index], SlGetFieldLength(), SLE_UINT8);
+		/* Make sure the old name is null terminated */
+		_old_name_array[LEN_OLD_STRINGS * index + LEN_OLD_STRINGS - 1] = '\0';
 	}
 }