From db24a55e365544cb17558a01714a16a7c4c0fe59 Mon Sep 17 00:00:00 2001
From: Marc Zinnschlag <marc@zpages.de>
Date: Sat, 7 Aug 2010 16:34:49 +0200
Subject: [PATCH] added sanity check for AddItem arguments

---
 apps/openmw/mwscript/containerextensions.cpp | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/apps/openmw/mwscript/containerextensions.cpp b/apps/openmw/mwscript/containerextensions.cpp
index dad88a7e17..c9601e5944 100644
--- a/apps/openmw/mwscript/containerextensions.cpp
+++ b/apps/openmw/mwscript/containerextensions.cpp
@@ -1,6 +1,8 @@
 
 #include "containerextensions.hpp"
 
+#include <stdexcept>
+
 #include <components/compiler/extensions.hpp>
 
 #include <components/interpreter/interpreter.hpp>
@@ -32,6 +34,9 @@ namespace MWScript
                     Interpreter::Type_Integer count = runtime[0].mInteger;
                     runtime.pop();
 
+                    if (count<0)
+                        throw std::runtime_error ("second argument for AddItem must be non-negative");
+
                     MWWorld::Ptr ptr = context.getReference();
 
                     MWWorld::ManualRef ref (context.getWorld().getStore(), item);
@@ -61,6 +66,9 @@ namespace MWScript
                     Interpreter::Type_Integer count = runtime[0].mInteger;
                     runtime.pop();
 
+                    if (count<0)
+                        throw std::runtime_error ("second argument for AddItem must be non-negative");
+
                     MWWorld::Ptr ptr = context.getWorld().getPtr (id, false);
 
                     MWWorld::ManualRef ref (context.getWorld().getStore(), item);