1. Built-in checks on industry level.
2. Built-in checks on industry tiles.
3. NewGRF-defined checks on industry level.
4. NewGRF-defined checks on industry tiles.
If a NewGRF assigned neither "power" nor "dual-headed" properties,
then "railveh_type" defaulted to "singlehead-engine", while "power=0" said "it's a wagon".
Basically, you could setup an auto-replace in a group for trains
to replace a ship with another ship.
Most of the code is surprisingly okay with this, it is only the
group statistics that doesn't like this.
You could give a wagon in the chain to reverse (which makes no
functional sense ofc). In result, only parts of the vehicle were
reversing, leading to weird crashes.
The bug comes in two slices:
1) the functions never actually checked if "tile" was a depot tile.
This allowed executing the function on tile 0, where are the
things like shadows of aircrafts are.
2) BuildDepotVehicleList() first checked if a vehicle is in a depot
before checking if it was a primary vehicle. This is invalid
for aircraft.
Fixing the first hides the second, and fixing the second makes the
first non-exploitable. But, fixing both felt like the best thing
to do.
Height was a unsigned 32bit integer, where TileAddWrap uses a
signed 32bit integer for the height. In result, there was an
implicit cast from unsigned to signed, messing things up.
But looking at it from a functional perspective, allowing such
large values is not sensible. In fact, width is restricted to
just a 8bit integer. By changing height to a 8bit integer too,
the implicit cast will never make a positive value negative anymore.
It first checked if the vehicle was in the depot, which for some types
is only a valid action for the primary vehicle. Afterwards, it checked
if the vehicle was a primary vehicle.
Although it was checked that RoadType was not 63 (INVALID_ROADTYPE),
and all values lower than 63 are fine, it also allowed values higher
than 63. As the RoadType is a "byte", it could contain values up
to 255.
When you don't type an Enum, it is a signed value. To validate
if an Axis is valid, it is checked to be lower than AXIS_END. Which
is the case for any value below 0.
Peter Nelson
translators
Patric Stout
frosch
dP
Aaron Katzin
Loïc Guilloux
Tyler Trahan
Joel-Milligan
Niels Martin Hansen
glx22
SamuXarick
Nicolas Chappe
Jonathan G Rennison
Patric Stout