mirror
/
OpenTTD
mirror of https://github.com/OpenTTD/OpenTTD
1
0
Fork 0
Code Issues

Fix: Corrupted savegame could crash the game by providing invalid gamelog enums. (#9045)

pull/9050/head
Milek7 2021-04-17 20:19:18 +02:00 committed by GitHub
parent 8e539ce293
commit da55286c2c
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 9 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
src/saveload/gamelog_sl.cpp
View File

@ -107,8 +107,11 @@ static void Load_GLOG_common(LoggedAction *&gamelog_action, uint &gamelog_action
assert(gamelog_action == nullptr); assert(gamelog_action == nullptr);
assert(gamelog_actions == 0); assert(gamelog_actions == 0);
GamelogActionType at; byte type;
while ((at = (GamelogActionType)SlReadByte()) != GLAT_NONE) { while ((type = SlReadByte()) != GLAT_NONE) {
if (type >= GLAT_END) SlErrorCorrupt("Invalid gamelog action type");
GamelogActionType at = (GamelogActionType)type;
gamelog_action = ReallocT(gamelog_action, gamelog_actions + 1); gamelog_action = ReallocT(gamelog_action, gamelog_actions + 1);
LoggedAction *la = &gamelog_action[gamelog_actions++]; LoggedAction *la = &gamelog_action[gamelog_actions++];
@ -118,8 +121,10 @@ static void Load_GLOG_common(LoggedAction *&gamelog_action, uint &gamelog_action
la->change = nullptr; la->change = nullptr;
la->changes = 0; la->changes = 0;
GamelogChangeType ct; while ((type = SlReadByte()) != GLCT_NONE) {
while ((ct = (GamelogChangeType)SlReadByte()) != GLCT_NONE) { if (type >= GLCT_END) SlErrorCorrupt("Invalid gamelog change type");
GamelogChangeType ct = (GamelogChangeType)type;
la->change = ReallocT(la->change, la->changes + 1); la->change = ReallocT(la->change, la->changes + 1);
LoggedChange *lc = &la->change[la->changes++]; LoggedChange *lc = &la->change[la->changes++];
@ -127,8 +132,6 @@ static void Load_GLOG_common(LoggedAction *&gamelog_action, uint &gamelog_action
memset(lc, 0, sizeof(*lc)); memset(lc, 0, sizeof(*lc));
lc->ct = ct; lc->ct = ct;
assert((uint)ct < GLCT_END);
SlObject(lc, _glog_desc[ct]); SlObject(lc, _glog_desc[ct]);
} }
} }