From 4a6fdc829331dddd4045d9ad91db972ad4083095 Mon Sep 17 00:00:00 2001
From: Rubidium <rubidium@openttd.org>
Date: Sun, 14 May 2023 21:13:24 +0200
Subject: [PATCH] Fix: multiplication result converted to larger type

Technically unlikely to happen, though uint16 * uint16 get promoted to int and
then stored as uint64; similarly uint * uint16 remains uint and gets stored as
uint64. In both cases the value can get truncated before the change to uint64.
---
 src/cargopacket.cpp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/cargopacket.cpp b/src/cargopacket.cpp
index 28523e2844..a72e8fe622 100644
--- a/src/cargopacket.cpp
+++ b/src/cargopacket.cpp
@@ -180,7 +180,7 @@ void CargoList<Tinst, Tcont>::RemoveFromCache(const CargoPacket *cp, uint count)
 {
 	assert(count <= cp->count);
 	this->count                 -= count;
-	this->cargo_days_in_transit -= cp->days_in_transit * count;
+	this->cargo_days_in_transit -= static_cast<uint64_t>(cp->days_in_transit) * count;
 }
 
 /**
@@ -192,7 +192,7 @@ template <class Tinst, class Tcont>
 void CargoList<Tinst, Tcont>::AddToCache(const CargoPacket *cp)
 {
 	this->count                 += cp->count;
-	this->cargo_days_in_transit += cp->days_in_transit * cp->count;
+	this->cargo_days_in_transit += static_cast<uint64_t>(cp->days_in_transit) * cp->count;
 }
 
 /** Invalidates the cached data and rebuilds it. */