From b2c0787c2decdee57901f7ecfb88358d8d79ef38 Mon Sep 17 00:00:00 2001
From: Ted John <ted@brambles.org>
Date: Tue, 17 Dec 2019 20:48:38 +0000
Subject: [PATCH] Fix #10389: Invalid read in vehicle_update_travelling
 (#10390)

---
 src/openrct2/ride/Vehicle.cpp | 19 ++++++++-----------
 1 file changed, 8 insertions(+), 11 deletions(-)

diff --git a/src/openrct2/ride/Vehicle.cpp b/src/openrct2/ride/Vehicle.cpp
index 4d83f6d63d..b99abb51cb 100644
--- a/src/openrct2/ride/Vehicle.cpp
+++ b/src/openrct2/ride/Vehicle.cpp
@@ -3102,19 +3102,16 @@ static bool vehicle_current_tower_element_is_top(rct_vehicle* vehicle)
 {
     TileElement* tileElement = map_get_track_element_at_of_type(
         vehicle->track_x, vehicle->track_y, vehicle->track_z / 8, vehicle->track_type >> 2);
-
-    if (tileElement->IsLastForTile())
+    if (tileElement != nullptr)
     {
-        return true;
-    }
-
-    while (!tileElement->IsLastForTile())
-    {
-        tileElement++;
-        if (tileElement->GetType() == TILE_ELEMENT_TYPE_TRACK
-            && tileElement->AsTrack()->GetTrackType() == TRACK_ELEM_TOWER_SECTION)
+        while (!tileElement->IsLastForTile())
         {
-            return false;
+            tileElement++;
+            if (tileElement->GetType() == TILE_ELEMENT_TYPE_TRACK
+                && tileElement->AsTrack()->GetTrackType() == TRACK_ELEM_TOWER_SECTION)
+            {
+                return false;
+            }
         }
     }
     return true;