From b18d053a184f8f785a8bba194c637d4f8a22fa2e Mon Sep 17 00:00:00 2001
From: Ted John <ted@brambles.org>
Date: Sat, 1 Oct 2016 17:33:30 +0100
Subject: [PATCH] Fix #4511: Crash, invalid scrolling mode for banner

Do not attempt to draw banners with an invalid scrolling mode. Some custom objects use 255 for scrolling mode as they don't actually have scrolling text.
---
 src/drawing/drawing.h          | 2 ++
 src/drawing/scrolling_text.c   | 4 +++-
 src/paint/map_element/banner.c | 4 ++++
 3 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/src/drawing/drawing.h b/src/drawing/drawing.h
index cbab3b8eb3..b1da60712f 100644
--- a/src/drawing/drawing.h
+++ b/src/drawing/drawing.h
@@ -122,6 +122,8 @@ typedef struct rct_palette {
 
 #define PALETTE_TO_G1_OFFSET_COUNT 144
 
+#define MAX_SCROLLING_TEXT_MODES 38
+
 extern sint16 gCurrentFontSpriteBase;
 extern uint16 gCurrentFontFlags;
 
diff --git a/src/drawing/scrolling_text.c b/src/drawing/scrolling_text.c
index baa43b2072..b5597b9ead 100644
--- a/src/drawing/scrolling_text.c
+++ b/src/drawing/scrolling_text.c
@@ -1365,7 +1365,7 @@ static const sint16 _scrollpos37[] = {
 	-1,
 };
 
-static const sint16* _scrollPositions[38] = {
+static const sint16* _scrollPositions[MAX_SCROLLING_TEXT_MODES] = {
 	_scrollpos0,
 	_scrollpos1,
 	_scrollpos2,
@@ -1416,6 +1416,8 @@ static const sint16* _scrollPositions[38] = {
  */
 int scrolling_text_setup(rct_string_id stringId, uint16 scroll, uint16 scrollingMode)
 {
+	assert(scrollingMode < MAX_SCROLLING_TEXT_MODES);
+
 	rct_drawpixelinfo* dpi = unk_140E9A8;
 
 	if (dpi->zoom_level != 0) return SPR_SCROLLING_TEXT_DEFAULT;
diff --git a/src/paint/map_element/banner.c b/src/paint/map_element/banner.c
index 5a6d239045..81c7df4744 100644
--- a/src/paint/map_element/banner.c
+++ b/src/paint/map_element/banner.c
@@ -83,6 +83,10 @@ void banner_paint(uint8 direction, int height, rct_map_element* map_element)
 	if (direction >= 2 || (map_element->flags & MAP_ELEMENT_FLAG_GHOST)) return;
 
 	uint16 scrollingMode = banner_scenery->banner.scrolling_mode;
+	if (scrollingMode >= MAX_SCROLLING_TEXT_MODES) {
+		return;
+	}
+
 	scrollingMode += direction;
 
 	set_format_arg(0, uint32, 0);