From cd6c04a6630de0d8a123f670b108b813c4486a6c Mon Sep 17 00:00:00 2001 From: Peter Nelson Date: Thu, 6 Apr 2023 20:29:59 +0100 Subject: [PATCH] Fix: Check station ID is within bounds when copying layouts. --- src/newgrf.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/newgrf.cpp b/src/newgrf.cpp index 82dfe8cde7..387d95fd7a 100644 --- a/src/newgrf.cpp +++ b/src/newgrf.cpp @@ -2000,7 +2000,7 @@ static ChangeInfoResult StationChangeInfo(uint stid, int numinfo, int prop, Byte case 0x0A: { // Copy sprite layout byte srcid = buf->ReadByte(); - const StationSpec *srcstatspec = _cur.grffile->stations[srcid]; + const StationSpec *srcstatspec = srcid >= NUM_STATIONS_PER_GRF ? nullptr : _cur.grffile->stations[srcid]; if (srcstatspec == nullptr) { grfmsg(1, "StationChangeInfo: Station %u is not defined, cannot copy sprite layout to %u.", srcid, stid + i); @@ -2054,7 +2054,7 @@ static ChangeInfoResult StationChangeInfo(uint stid, int numinfo, int prop, Byte case 0x0F: { // Copy custom layout byte srcid = buf->ReadByte(); - const StationSpec *srcstatspec = _cur.grffile->stations[srcid]; + const StationSpec *srcstatspec = srcid >= NUM_STATIONS_PER_GRF ? nullptr : _cur.grffile->stations[srcid]; if (srcstatspec == nullptr) { grfmsg(1, "StationChangeInfo: Station %u is not defined, cannot copy tile layout to %u.", srcid, stid + i);