From 08977828ccc60545053af0de8db779484ea2af3e Mon Sep 17 00:00:00 2001 From: Peter Nelson Date: Thu, 6 Apr 2023 20:30:01 +0100 Subject: [PATCH] Fix: Check ID for name is within bounds. --- src/newgrf.cpp | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src/newgrf.cpp b/src/newgrf.cpp index 387d95fd7a..bd283fa6d8 100644 --- a/src/newgrf.cpp +++ b/src/newgrf.cpp @@ -6301,7 +6301,7 @@ static void FeatureNewName(ByteReader *buf) switch (GB(id, 8, 8)) { case 0xC4: // Station class name - if (_cur.grffile->stations == nullptr || _cur.grffile->stations[GB(id, 0, 8)] == nullptr) { + if (GB(id, 0, 8) >= NUM_STATIONS_PER_GRF || _cur.grffile->stations == nullptr || _cur.grffile->stations[GB(id, 0, 8)] == nullptr) { grfmsg(1, "FeatureNewName: Attempt to name undefined station 0x%X, ignoring", GB(id, 0, 8)); } else { StationClassID cls_id = _cur.grffile->stations[GB(id, 0, 8)]->cls_id; @@ -6310,7 +6310,7 @@ static void FeatureNewName(ByteReader *buf) break; case 0xC5: // Station name - if (_cur.grffile->stations == nullptr || _cur.grffile->stations[GB(id, 0, 8)] == nullptr) { + if (GB(id, 0, 8) >= NUM_STATIONS_PER_GRF || _cur.grffile->stations == nullptr || _cur.grffile->stations[GB(id, 0, 8)] == nullptr) { grfmsg(1, "FeatureNewName: Attempt to name undefined station 0x%X, ignoring", GB(id, 0, 8)); } else { _cur.grffile->stations[GB(id, 0, 8)]->name = AddGRFString(_cur.grffile->grfid, id, lang, new_scheme, false, name, STR_UNDEFINED); @@ -6318,7 +6318,7 @@ static void FeatureNewName(ByteReader *buf) break; case 0xC7: // Airporttile name - if (_cur.grffile->airtspec == nullptr || _cur.grffile->airtspec[GB(id, 0, 8)] == nullptr) { + if (GB(id, 0, 8) >= NUM_AIRPORTTILES_PER_GRF || _cur.grffile->airtspec == nullptr || _cur.grffile->airtspec[GB(id, 0, 8)] == nullptr) { grfmsg(1, "FeatureNewName: Attempt to name undefined airport tile 0x%X, ignoring", GB(id, 0, 8)); } else { _cur.grffile->airtspec[GB(id, 0, 8)]->name = AddGRFString(_cur.grffile->grfid, id, lang, new_scheme, false, name, STR_UNDEFINED); @@ -6326,7 +6326,7 @@ static void FeatureNewName(ByteReader *buf) break; case 0xC9: // House name - if (_cur.grffile->housespec == nullptr || _cur.grffile->housespec[GB(id, 0, 8)] == nullptr) { + if (GB(id, 0, 8) >= NUM_HOUSES_PER_GRF || _cur.grffile->housespec == nullptr || _cur.grffile->housespec[GB(id, 0, 8)] == nullptr) { grfmsg(1, "FeatureNewName: Attempt to name undefined house 0x%X, ignoring.", GB(id, 0, 8)); } else { _cur.grffile->housespec[GB(id, 0, 8)]->building_name = AddGRFString(_cur.grffile->grfid, id, lang, new_scheme, false, name, STR_UNDEFINED);