(svn r24915) -Fix: Several out-of-bounds reads
This commit is contained in:
		@@ -163,13 +163,13 @@ static inline bool IsCargoInClass(CargoID c, CargoClass cc)
 | 
			
		||||
 * @param var Reference getting the cargospec.
 | 
			
		||||
 * @see CargoSpec
 | 
			
		||||
 */
 | 
			
		||||
#define FOR_ALL_SORTED_CARGOSPECS(var) for (uint8 index = 0; var = _sorted_cargo_specs[index], index < _sorted_cargo_specs_size; index++)
 | 
			
		||||
#define FOR_ALL_SORTED_CARGOSPECS(var) for (uint8 index = 0; index < _sorted_cargo_specs_size && (var = _sorted_cargo_specs[index], true) ; index++)
 | 
			
		||||
 | 
			
		||||
/**
 | 
			
		||||
 * Loop header for iterating over 'real' cargoes, sorted by name. Phony cargoes like regearing cargoes are skipped.
 | 
			
		||||
 * @param var Reference getting the cargospec.
 | 
			
		||||
 * @see CargoSpec
 | 
			
		||||
 */
 | 
			
		||||
#define FOR_ALL_SORTED_STANDARD_CARGOSPECS(var) for (uint8 index = 0; var = _sorted_cargo_specs[index], index < _sorted_standard_cargo_specs_size; index++)
 | 
			
		||||
#define FOR_ALL_SORTED_STANDARD_CARGOSPECS(var) for (uint8 index = 0; index < _sorted_standard_cargo_specs_size && (var = _sorted_cargo_specs[index], true); index++)
 | 
			
		||||
 | 
			
		||||
#endif /* CARGOTYPE_H */
 | 
			
		||||
 
 | 
			
		||||
@@ -200,7 +200,7 @@ struct HighScoreWindow : EndGameHighScoreBaseWindow {
 | 
			
		||||
};
 | 
			
		||||
 | 
			
		||||
static const NWidgetPart _nested_highscore_widgets[] = {
 | 
			
		||||
	NWidget(WWT_PANEL, COLOUR_END, WID_H_BACKGROUND), SetMinimalSize(641, 481), SetResize(1, 1), EndContainer(),
 | 
			
		||||
	NWidget(WWT_PANEL, COLOUR_BROWN, WID_H_BACKGROUND), SetMinimalSize(641, 481), SetResize(1, 1), EndContainer(),
 | 
			
		||||
};
 | 
			
		||||
 | 
			
		||||
static const WindowDesc _highscore_desc(
 | 
			
		||||
 
 | 
			
		||||
@@ -2063,12 +2063,12 @@ class LanguagePackGlyphSearcher : public MissingGlyphSearcher {
 | 
			
		||||
	{
 | 
			
		||||
		if (this->i >= TAB_COUNT) return NULL;
 | 
			
		||||
 | 
			
		||||
		const char *ret = _langpack_offs[_langtab_start[i] + j];
 | 
			
		||||
		const char *ret = _langpack_offs[_langtab_start[this->i] + this->j];
 | 
			
		||||
 | 
			
		||||
		this->j++;
 | 
			
		||||
		while (this->j >= _langtab_num[this->i] && this->i < TAB_COUNT) {
 | 
			
		||||
			i++;
 | 
			
		||||
			j = 0;
 | 
			
		||||
		while (this->i < TAB_COUNT && this->j >= _langtab_num[this->i]) {
 | 
			
		||||
			this->i++;
 | 
			
		||||
			this->j = 0;
 | 
			
		||||
		}
 | 
			
		||||
 | 
			
		||||
		return ret;
 | 
			
		||||
 
 | 
			
		||||
@@ -175,6 +175,8 @@ int GetWidgetFromPos(const Window *w, int x, int y)
 | 
			
		||||
 */
 | 
			
		||||
void DrawFrameRect(int left, int top, int right, int bottom, Colours colour, FrameFlags flags)
 | 
			
		||||
{
 | 
			
		||||
	assert(colour < COLOUR_END);
 | 
			
		||||
 | 
			
		||||
	uint dark         = _colour_gradient[colour][3];
 | 
			
		||||
	uint medium_dark  = _colour_gradient[colour][5];
 | 
			
		||||
	uint medium_light = _colour_gradient[colour][6];
 | 
			
		||||
 
 | 
			
		||||
		Reference in New Issue
	
	Block a user