From dd94b087c4c812e34aa383122519246a79a171e7 Mon Sep 17 00:00:00 2001
From: Rubidium <rubidium@openttd.org>
Date: Sun, 14 May 2023 21:13:24 +0200
Subject: [PATCH] Fix: multiplication result converted to larger type

Technically unlikely to happen, though uint16 * uint16 get promoted to int and
then stored as uint64; similarly uint * uint16 remains uint and gets stored as
uint64. In both cases the value can get truncated before the change to uint64.

(cherry picked from commit 4a6fdc829331dddd4045d9ad91db972ad4083095)
---
 src/cargopacket.cpp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/cargopacket.cpp b/src/cargopacket.cpp
index 7fabe9a697..6cdae96021 100644
--- a/src/cargopacket.cpp
+++ b/src/cargopacket.cpp
@@ -337,7 +337,7 @@ void CargoList<Tinst, Tcont>::RemoveFromCache(const CargoPacket *cp, uint count)
 {
 	dbg_assert(count <= cp->count);
 	this->count                 -= count;
-	this->cargo_days_in_transit -= cp->days_in_transit * count;
+	this->cargo_days_in_transit -= static_cast<uint64_t>(cp->days_in_transit) * count;
 }
 
 /**
@@ -349,7 +349,7 @@ template <class Tinst, class Tcont>
 void CargoList<Tinst, Tcont>::AddToCache(const CargoPacket *cp)
 {
 	this->count                 += cp->count;
-	this->cargo_days_in_transit += cp->days_in_transit * cp->count;
+	this->cargo_days_in_transit += static_cast<uint64_t>(cp->days_in_transit) * cp->count;
 }
 
 /** Invalidates the cached data and rebuilds it. */