From 0471d4ccf64f62efc9cd2a15217eb0e85495a854 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Micha=C5=82=20Janiszewski?= Date: Sat, 18 Mar 2017 23:05:45 +0100 Subject: [PATCH] Guard access to ride_type field in ride.c --- src/openrct2/windows/ride.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/openrct2/windows/ride.c b/src/openrct2/windows/ride.c index a35bdb6499..23cd90cd5b 100644 --- a/src/openrct2/windows/ride.c +++ b/src/openrct2/windows/ride.c @@ -3747,6 +3747,7 @@ static void window_ride_maintenance_mousedown(sint32 widgetIndex, rct_window *w, gDropdownItemsFormat[0] = STR_DROPDOWN_MENU_LABEL; gDropdownItemsArgs[0] = STR_DEBUG_FIX_RIDE; for (sint32 i = 0; i < 8; i++) { + assert(j < countof(ride_type->ride_type)); if (RideAvailableBreakdowns[ride_type->ride_type[j]] & (uint8)(1 << i)) { if (i == BREAKDOWN_BRAKES_FAILURE && (ride->mode == RIDE_MODE_CONTINUOUS_CIRCUIT_BLOCK_SECTIONED || ride->mode == RIDE_MODE_POWERED_LAUNCH_BLOCK_SECTIONED)) { if (ride->num_vehicles != 1) @@ -3867,6 +3868,7 @@ static void window_ride_maintenance_dropdown(rct_window *w, sint32 widgetIndex, sint32 i; sint32 num_items = 1; for (i = 0; i < 8; i++) { + assert(j < countof(ride_type->ride_type)); if (RideAvailableBreakdowns[ride_type->ride_type[j]] & (uint8)(1 << i)) { if (i == BREAKDOWN_BRAKES_FAILURE && (ride->mode == RIDE_MODE_CONTINUOUS_CIRCUIT_BLOCK_SECTIONED || ride->mode == RIDE_MODE_POWERED_LAUNCH_BLOCK_SECTIONED)) { if (ride->num_vehicles != 1)