From de341f1d860ce3d342f1acdd4a5ce023361a3651 Mon Sep 17 00:00:00 2001
From: Ted John <ted@brambles.org>
Date: Sat, 15 Oct 2016 20:57:29 +0100
Subject: [PATCH] Fix td6_reset_trailing_elements

Only one byte, 0xFF terminates the track elements rather than a track element with a type of 0xFF.
---
 src/ride/track_design.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/src/ride/track_design.c b/src/ride/track_design.c
index 9034968dd6..f37399f063 100644
--- a/src/ride/track_design.c
+++ b/src/ride/track_design.c
@@ -315,15 +315,13 @@ static void td6_reset_trailing_elements(rct_track_td6 * td6)
 		while (mazeElement->all != 0) {
 			mazeElement++;
 		}
-		mazeElement++;
-		lastElement = mazeElement;
+		lastElement = (void *)((uintptr_t)mazeElement + 1);
 	} else {
 		rct_td6_track_element * trackElement = (rct_td6_track_element *)td6->elements;
 		while (trackElement->type != 0xFF) {
 			trackElement++;
 		}
-		trackElement++;
-		lastElement = trackElement;
+		lastElement = (void *)((uintptr_t)trackElement + 1);
 	}
 	size_t trailingSize = td6->elementsSize - (size_t)((uintptr_t)lastElement - (uintptr_t)td6->elements);
 	memset(lastElement, 0xFF, trailingSize);