cpp/openttd-patchpack/source Changeset - r27042:59789c06aca3

Changeset - r27042:59789c06aca3

Parent rev.

Child rev.

[Not reviewed]

master

0 1 0

Peter Nelson - 14 months ago 2023-04-06 19:29:58
peter1138@openttd.org

Fix: Check sprite group mapping ID is within bounds of feature.

1 file changed with 10 insertions and 10 deletions:

src/newgrf.cpp

0 comments (0 inline, 0 general)

src/newgrf.cpp

➞

Show inline comments

@@ @@ -5723,13 +5723,13 @@ static void StationMapSpriteGroup(ByteRe @@
 		if (!IsValidGroupID(groupid, "StationMapSpriteGroup")) continue;
 		ctype = TranslateCargo(GSF_STATIONS, ctype);
 		if (ctype == CT_INVALID) continue;
 		for (uint i = 0; i < idcount; i++) {
-			StationSpec *statspec = _cur.grffile->stations == nullptr ? nullptr : _cur.grffile->stations[stations[i]];
+			StationSpec *statspec = stations[i] >= NUM_STATIONS_PER_GRF ? nullptr : _cur.grffile->stations[stations[i]];
 			if (statspec == nullptr) {
 				grfmsg(1, "StationMapSpriteGroup: Station with ID 0x%02X does not exist, skipping", stations[i]);
 				continue;
+			}
@@ @@ -5738,13 +5738,13 @@ static void StationMapSpriteGroup(ByteRe @@
+	}
 	uint16 groupid = buf->ReadWord();
 	if (!IsValidGroupID(groupid, "StationMapSpriteGroup")) return;
 	for (uint i = 0; i < idcount; i++) {
-		StationSpec *statspec = _cur.grffile->stations == nullptr ? nullptr : _cur.grffile->stations[stations[i]];
+		StationSpec *statspec = stations[i] >= NUM_STATIONS_PER_GRF ? nullptr : _cur.grffile->stations[stations[i]];
 		if (statspec == nullptr) {
 			grfmsg(1, "StationMapSpriteGroup: Station with ID 0x%02X does not exist, skipping", stations[i]);
 			continue;
+		}
@@ @@ -5809,13 +5809,13 @@ static void IndustryMapSpriteGroup(ByteR @@
 	buf->Skip(cidcount * 3);
 	uint16 groupid = buf->ReadWord();
 	if (!IsValidGroupID(groupid, "IndustryMapSpriteGroup")) return;
 	for (uint i = 0; i < idcount; i++) {
 		IndustrySpec *indsp = _cur.grffile->industryspec[industries[i]];
+		IndustrySpec *indsp = industries[i] >= NUM_INDUSTRYTYPES_PER_GRF ? nullptr : _cur.grffile->industryspec[industries[i]];
 		if (indsp == nullptr) {
 			grfmsg(1, "IndustryMapSpriteGroup: Industry %d undefined, skipping", industries[i]);
 			continue;
+		}
@@ @@ -5840,13 +5840,13 @@ static void IndustrytileMapSpriteGroup(B @@
 	buf->Skip(cidcount * 3);
 	uint16 groupid = buf->ReadWord();
 	if (!IsValidGroupID(groupid, "IndustrytileMapSpriteGroup")) return;
 	for (uint i = 0; i < idcount; i++) {
 		IndustryTileSpec *indtsp = _cur.grffile->indtspec[indtiles[i]];
+		IndustryTileSpec *indtsp = indtiles[i] >= NUM_INDUSTRYTILES_PER_GRF ? nullptr : _cur.grffile->indtspec[indtiles[i]];
 		if (indtsp == nullptr) {
 			grfmsg(1, "IndustrytileMapSpriteGroup: Industry tile %d undefined, skipping", indtiles[i]);
 			continue;
+		}
@@ @@ -5901,13 +5901,13 @@ static void ObjectMapSpriteGroup(ByteRea @@
 		if (!IsValidGroupID(groupid, "ObjectMapSpriteGroup")) continue;
 		ctype = TranslateCargo(GSF_OBJECTS, ctype);
 		if (ctype == CT_INVALID) continue;
 		for (uint i = 0; i < idcount; i++) {
 			ObjectSpec *spec = _cur.grffile->objectspec[objects[i]];
+			ObjectSpec *spec = objects[i] >= NUM_OBJECTS_PER_GRF ? nullptr : _cur.grffile->objectspec[objects[i]];
 			if (spec == nullptr) {
 				grfmsg(1, "ObjectMapSpriteGroup: Object with ID 0x%02X undefined, skipping", objects[i]);
 				continue;
+			}
@@ @@ -5916,13 +5916,13 @@ static void ObjectMapSpriteGroup(ByteRea @@
+	}
 	uint16 groupid = buf->ReadWord();
 	if (!IsValidGroupID(groupid, "ObjectMapSpriteGroup")) return;
 	for (uint i = 0; i < idcount; i++) {
 		ObjectSpec *spec = _cur.grffile->objectspec[objects[i]];
+		ObjectSpec *spec = objects[i] >= NUM_OBJECTS_PER_GRF ? nullptr : _cur.grffile->objectspec[objects[i]];
 		if (spec == nullptr) {
 			grfmsg(1, "ObjectMapSpriteGroup: Object with ID 0x%02X undefined, skipping", objects[i]);
 			continue;
+		}
@@ @@ -6018,13 +6018,13 @@ static void AirportMapSpriteGroup(ByteRe @@
 	buf->Skip(cidcount * 3);
 	uint16 groupid = buf->ReadWord();
 	if (!IsValidGroupID(groupid, "AirportMapSpriteGroup")) return;
 	for (uint i = 0; i < idcount; i++) {
 		AirportSpec *as = _cur.grffile->airportspec[airports[i]];
+		AirportSpec *as = airports[i] >= NUM_AIRPORTS_PER_GRF ? nullptr : _cur.grffile->airportspec[airports[i]];
 		if (as == nullptr) {
 			grfmsg(1, "AirportMapSpriteGroup: Airport %d undefined, skipping", airports[i]);
 			continue;
+		}
@@ @@ -6049,13 +6049,13 @@ static void AirportTileMapSpriteGroup(By @@
 	buf->Skip(cidcount * 3);
 	uint16 groupid = buf->ReadWord();
 	if (!IsValidGroupID(groupid, "AirportTileMapSpriteGroup")) return;
 	for (uint i = 0; i < idcount; i++) {
 		AirportTileSpec *airtsp = _cur.grffile->airtspec[airptiles[i]];
+		AirportTileSpec *airtsp = airptiles[i] >= NUM_AIRPORTTILES_PER_GRF ? nullptr : _cur.grffile->airtspec[airptiles[i]];
 		if (airtsp == nullptr) {
 			grfmsg(1, "AirportTileMapSpriteGroup: Airport tile %d undefined, skipping", airptiles[i]);
 			continue;
+		}
@@ @@ -6082,13 +6082,13 @@ static void RoadStopMapSpriteGroup(ByteR @@
 		if (!IsValidGroupID(groupid, "RoadStopMapSpriteGroup")) continue;
 		ctype = TranslateCargo(GSF_ROADSTOPS, ctype);
 		if (ctype == CT_INVALID) continue;
 		for (uint i = 0; i < idcount; i++) {
-			RoadStopSpec *roadstopspec = _cur.grffile->roadstops == nullptr ? nullptr : _cur.grffile->roadstops[roadstops[i]];
+			RoadStopSpec *roadstopspec = roadstops[i] >= NUM_ROADSTOPS_PER_GRF ? nullptr : _cur.grffile->roadstops[roadstops[i]];
 			if (roadstopspec == nullptr) {
 				grfmsg(1, "RoadStopMapSpriteGroup: Road stop with ID 0x%02X does not exist, skipping", roadstops[i]);
 				continue;
+			}
@@ @@ -6097,13 +6097,13 @@ static void RoadStopMapSpriteGroup(ByteR @@
+	}
 	uint16 groupid = buf->ReadWord();
 	if (!IsValidGroupID(groupid, "RoadStopMapSpriteGroup")) return;
 	for (uint i = 0; i < idcount; i++) {
-		RoadStopSpec *roadstopspec = _cur.grffile->roadstops == nullptr ? nullptr : _cur.grffile->roadstops[roadstops[i]];
+		RoadStopSpec *roadstopspec = roadstops[i] >= NUM_ROADSTOPS_PER_GRF ? nullptr : _cur.grffile->roadstops[roadstops[i]];
 		if (roadstopspec == nullptr) {
 			grfmsg(1, "RoadStopMapSpriteGroup: Road stop with ID 0x%02X does not exist, skipping.", roadstops[i]);
 			continue;
+		}

0 comments (0 inline, 0 general)