From 856ec901ca9523812b16e367b49d2baf4a28d26b Mon Sep 17 00:00:00 2001 From: Peter Nelson Date: Sat, 18 May 2024 09:17:06 +0100 Subject: [PATCH] Fix #12685: nullptr dereference when checking for equal loaded/loading groups. (#12686) Always treat empty groups as non-equal. Given that the case of both being empty is handled earlier, they cannot both be equal and empty. Additionally if a loaded or loading set are all the same, only add one reference. --- src/newgrf.cpp | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/src/newgrf.cpp b/src/newgrf.cpp index 01f96961f2..51514054fa 100644 --- a/src/newgrf.cpp +++ b/src/newgrf.cpp @@ -5360,10 +5360,9 @@ static void NewSpriteGroup(ByteReader *buf) GrfMsg(8, "NewSpriteGroup: + rg->loading[{}] = subset {}", i, loading[i]); } - if (std::adjacent_find(loaded.begin(), loaded.end(), std::not_equal_to<>()) == loaded.end() && - std::adjacent_find(loading.begin(), loading.end(), std::not_equal_to<>()) == loading.end() && - loaded[0] == loading[0]) - { + bool loaded_same = !loaded.empty() && std::adjacent_find(loaded.begin(), loaded.end(), std::not_equal_to<>()) == loaded.end(); + bool loading_same = !loading.empty() && std::adjacent_find(loading.begin(), loading.end(), std::not_equal_to<>()) == loading.end(); + if (loaded_same && loading_same && loaded[0] == loading[0]) { /* Both lists only contain the same value, so don't create 'Real' sprite group */ act_group = CreateGroupFromGroupID(feature, setid, type, loaded[0]); GrfMsg(8, "NewSpriteGroup: same result, skipping RealSpriteGroup = subset {}", loaded[0]); @@ -5375,11 +5374,13 @@ static void NewSpriteGroup(ByteReader *buf) group->nfo_line = _cur.nfo_line; act_group = group; + if (loaded_same && loaded.size() > 1) loaded.resize(1); for (uint16_t spriteid : loaded) { const SpriteGroup *t = CreateGroupFromGroupID(feature, setid, type, spriteid); group->loaded.push_back(t); } + if (loading_same && loading.size() > 1) loading.resize(1); for (uint16_t spriteid : loading) { const SpriteGroup *t = CreateGroupFromGroupID(feature, setid, type, spriteid); group->loading.push_back(t);