From be073b46daa9b70102e6299588f43454a35e46cf Mon Sep 17 00:00:00 2001
From: PeterN <peter@fuzzle.org>
Date: Sat, 20 Apr 2019 02:34:25 +0100
Subject: [PATCH] Fix: Bounds check access to railtype_map. (#7529)

---
 src/newgrf.cpp | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/newgrf.cpp b/src/newgrf.cpp
index 7e4ba801d7..20408394ee 100644
--- a/src/newgrf.cpp
+++ b/src/newgrf.cpp
@@ -5478,7 +5478,8 @@ static void RailTypeMapSpriteGroup(ByteReader *buf, uint8 idcount)
 {
 	uint8 *railtypes = AllocaM(uint8, idcount);
 	for (uint i = 0; i < idcount; i++) {
-		railtypes[i] = _cur.grffile->railtype_map[buf->ReadByte()];
+		uint8 id = buf->ReadByte();
+		railtypes[i] = id < RAILTYPE_END ? _cur.grffile->railtype_map[id] : INVALID_RAILTYPE;
 	}
 
 	uint8 cidcount = buf->ReadByte();