mirrors/OpenRCT2
1
0
Fork 0
mirror of https://github.com/OpenRCT2/OpenRCT2 synced 2026-01-04 13:42:55 +01:00
Code Issues Releases Wiki Activity

Fix #8824: invalid read in footpath_chain_ride_queue (#8831)

Browse Source
This commit is contained in:
Ted John
2019-03-06 19:11:21 +00:00
committed by GitHub
parent 736734c065
commit 0aade935aa
3 changed files with 49 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
distribution/changelog.txt
View File

@@ -78,6 +78,7 @@
- Fix: [#8742] Access violation in vehicle_update_sound_params.
- Fix: [#8804] Raising water shows money effect at the bottom rather than new height.
- Fix: [#8811] Some fields in the sv6 save file not being copied correctly.
- Fix: [#8824] Invalid read in footpath_chain_ride_queue.
- Improved: [#2940] Allow mouse-dragging to set patrol area (Singleplayer only).
- Improved: [#7730] Draw extreme vertical and lateral Gs red in the ride window's graph tab.
- Improved: [#7930] Automatically create folders for custom content.

19
src/openrct2/ride/Ride.cpp
View File

@@ -4173,16 +4173,19 @@ static void sub_6B5952(Ride* ride)
// This will fire for every entrance on this x, y and z, regardless whether that actually belongs to
// the ride or not.
TileElement* tileElement = map_get_first_element_at(location.x, location.y);
do
if (tileElement != nullptr)
{
if (tileElement->GetType() != TILE_ELEMENT_TYPE_ENTRANCE)
continue;
if (tileElement->base_height != z)
continue;
do
{
if (tileElement->GetType() != TILE_ELEMENT_TYPE_ENTRANCE)
continue;
if (tileElement->base_height != z)
continue;
int32_t direction = tileElement->GetDirection();
footpath_chain_ride_queue(ride->id, i, x, y, tileElement, direction_reverse(direction));
} while (!(tileElement++)->IsLastForTile());
int32_t direction = tileElement->GetDirection();
footpath_chain_ride_queue(ride->id, i, x, y, tileElement, direction_reverse(direction));
} while (!(tileElement++)->IsLastForTile());
}
}
}

68
src/openrct2/world/Footpath.cpp
View File

@@ -1247,33 +1247,36 @@ void footpath_chain_ride_queue(
x += CoordsDirectionDelta[direction].x;
y += CoordsDirectionDelta[direction].y;
tileElement = map_get_first_element_at(x >> 5, y >> 5);
do
if (tileElement != nullptr)
{
if (lastQueuePathElement == tileElement)
continue;
if (tileElement->GetType() != TILE_ELEMENT_TYPE_PATH)
continue;
if (tileElement->base_height == z)
do
{
if (tileElement->AsPath()->IsSloped())
if (lastQueuePathElement == tileElement)
continue;
if (tileElement->GetType() != TILE_ELEMENT_TYPE_PATH)
continue;
if (tileElement->base_height == z)
{
if (tileElement->AsPath()->GetSlopeDirection() != direction)
break;
if (tileElement->AsPath()->IsSloped())
{
if (tileElement->AsPath()->GetSlopeDirection() != direction)
break;
}
goto foundNextPath;
}
goto foundNextPath;
}
if (tileElement->base_height == z - 2)
{
if (!tileElement->AsPath()->IsSloped())
break;
if (tileElement->base_height == z - 2)
{
if (!tileElement->AsPath()->IsSloped())
break;
if (direction_reverse(tileElement->AsPath()->GetSlopeDirection()) != direction)
break;
if (direction_reverse(tileElement->AsPath()->GetSlopeDirection()) != direction)
break;
z -= 2;
goto foundNextPath;
}
} while (!(tileElement++)->IsLastForTile());
z -= 2;
goto foundNextPath;
}
} while (!(tileElement++)->IsLastForTile());
}
break;
foundNextPath:
@@ -1371,18 +1374,21 @@ void footpath_update_queue_chains()
continue;
TileElement* tileElement = map_get_first_element_at(location.x, location.y);
do
if (tileElement != nullptr)
{
if (tileElement->GetType() != TILE_ELEMENT_TYPE_ENTRANCE)
continue;
if (tileElement->AsEntrance()->GetEntranceType() != ENTRANCE_TYPE_RIDE_ENTRANCE)
continue;
if (tileElement->AsEntrance()->GetRideIndex() != rideIndex)
continue;
do
{
if (tileElement->GetType() != TILE_ELEMENT_TYPE_ENTRANCE)
continue;
if (tileElement->AsEntrance()->GetEntranceType() != ENTRANCE_TYPE_RIDE_ENTRANCE)
continue;
if (tileElement->AsEntrance()->GetRideIndex() != rideIndex)
continue;
uint8_t direction = tileElement->GetDirectionWithOffset(2);
footpath_chain_ride_queue(rideIndex, i, location.x << 5, location.y << 5, tileElement, direction);
} while (!(tileElement++)->IsLastForTile());
uint8_t direction = tileElement->GetDirectionWithOffset(2);
footpath_chain_ride_queue(rideIndex, i, location.x << 5, location.y << 5, tileElement, direction);
} while (!(tileElement++)->IsLastForTile());
}
}
}
}