# HG changeset patch
# User Darkvater <Darkvater@openttd.org>
# Date 1117468220 0
# Node ID ec266a8f43ef8cdb49fd4182812823ea80f31521
# Parent  5cc49449518bbb5f1db9606c3277f19a34d2b0e8
(svn r2384) - Fix: Check selling land and setting player colour. Also an extra map-bounds check for terraforming; inspired by the monkey (and Tron :) )

diff --git a/clear_cmd.c b/clear_cmd.c
--- a/clear_cmd.c
+++ b/clear_cmd.c
@@ -238,6 +238,9 @@
 
 	tile = TILE_FROM_XY(x,y);
 
+	/* Make an extra check for map-bounds cause we add tiles to the originating tile */
+	if (tile + TILE_XY(1,1) > MapSize()) return CMD_ERROR;
+
 	if (p1 & 1) {
 		if (!TerraformTileHeight(&ts, tile+TILE_XY(1,0),
 				TileHeight(tile + TILE_XY(1, 0)) + direction))
@@ -449,8 +452,9 @@
 
 	tile = TILE_FROM_XY(x,y);
 
-	if (!CheckTileOwnership(tile) && _current_player != OWNER_WATER)
-		return CMD_ERROR;
+	if (!IsTileType(tile, MP_UNMOVABLE) || _map5[tile] != 3) return CMD_ERROR;
+	if (!CheckTileOwnership(tile) && _current_player != OWNER_WATER) return CMD_ERROR;
+
 
 	if (!EnsureNoVehicle(tile)) return CMD_ERROR;
 
diff --git a/misc_cmd.c b/misc_cmd.c
--- a/misc_cmd.c
+++ b/misc_cmd.c
@@ -33,18 +33,21 @@
 int32 CmdSetPlayerColor(int x, int y, uint32 flags, uint32 p1, uint32 p2)
 {
 	Player *p, *pp;
+	byte colour = (byte)p2;
+
+	if (p2 >= 16) return CMD_ERROR; // max 16 colours
 
 	p = GetPlayer(_current_player);
 
 	/* Ensure no two companies have the same colour */
 	FOR_ALL_PLAYERS(pp) {
-		if (pp->is_active && pp != p && pp->player_color == (byte)p2)
+		if (pp->is_active && pp != p && pp->player_color == colour)
 			return CMD_ERROR;
 	}
 
 	if (flags & DC_EXEC) {
-		_player_colors[_current_player] = (byte)p2;
-		p->player_color = (byte)p2;
+		_player_colors[_current_player] = colour;
+		p->player_color = colour;
 		MarkWholeScreenDirty();
 	}
 	return 0;