From a76a76a4b5228e2230926368e4903372d6a4448e Mon Sep 17 00:00:00 2001
From: Ted John <ted@brambles.org>
Date: Thu, 5 May 2016 21:41:46 +0100
Subject: [PATCH] prevent crash when TD6s have less than 4 bytes

---
 src/ride/track_design.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/ride/track_design.c b/src/ride/track_design.c
index 220fbeccf3..c67e8ff8c8 100644
--- a/src/ride/track_design.c
+++ b/src/ride/track_design.c
@@ -79,6 +79,12 @@ rct_track_td6 *track_design_open(const utf8 *path)
 	if (file != NULL) {
 		// Read whole file into a buffer
 		size_t bufferLength = (size_t)SDL_RWsize(file);
+		if (bufferLength < 4) {
+			log_error("Invalid track file: %s.", path);
+			SDL_RWclose(file);
+			return false;
+		}
+
 		uint8 *buffer = (uint8*)malloc(bufferLength);
 		if (buffer == NULL) {
 			log_error("Unable to allocate memory for track design file.");