From 2fc6e75a8147d10f5854882f61f0983a05e258a2 Mon Sep 17 00:00:00 2001
From: tomrus88 <tomrus88@gmail.com>
Date: Sun, 19 Apr 2009 11:03:20 +0400
Subject: [PATCH] Fixed item buy packets. Thanks to yad02 for reporting. Fixed
 client disconnect when boarding transport (by yad02 and woweur).

---
 src/game/ItemHandler.cpp  | 16 ++++++++--------
 src/game/WorldSession.cpp |  6 ++++--
 2 files changed, 12 insertions(+), 10 deletions(-)

diff --git a/src/game/ItemHandler.cpp b/src/game/ItemHandler.cpp
index f78f77dfe..0dec43d54 100644
--- a/src/game/ItemHandler.cpp
+++ b/src/game/ItemHandler.cpp
@@ -663,28 +663,28 @@ void WorldSession::HandleBuybackItem(WorldPacket & recv_data)
 
 void WorldSession::HandleBuyItemInSlotOpcode( WorldPacket & recv_data )
 {
-    CHECK_PACKET_SIZE(recv_data,8+4+8+1+1);
+    CHECK_PACKET_SIZE(recv_data,8+4+4+8+1+4);
 
     sLog.outDebug(  "WORLD: Received CMSG_BUY_ITEM_IN_SLOT" );
     uint64 vendorguid, bagguid;
-    uint32 item;
-    uint8 slot, count;
+    uint32 item, slot, count;
+    uint8 bagslot;
 
-    recv_data >> vendorguid >> item >> bagguid >> slot >> count;
+    recv_data >> vendorguid >> item  >> slot >> bagguid >> bagslot >> count;
 
     GetPlayer()->BuyItemFromVendor(vendorguid,item,count,bagguid,slot);
 }
 
 void WorldSession::HandleBuyItemOpcode( WorldPacket & recv_data )
 {
-    CHECK_PACKET_SIZE(recv_data,8+4+1+1);
+    CHECK_PACKET_SIZE(recv_data,8+4+4+4+1);
 
     sLog.outDebug(  "WORLD: Received CMSG_BUY_ITEM" );
     uint64 vendorguid;
-    uint32 item;
-    uint8 count, unk1;
+    uint32 item, slot, count;
+    uint8 unk1;
 
-    recv_data >> vendorguid >> item >> count >> unk1;
+    recv_data >> vendorguid >> item >> slot >> count >> unk1;
 
     GetPlayer()->BuyItemFromVendor(vendorguid,item,count,NULL_BAG,NULL_SLOT);
 }
diff --git a/src/game/WorldSession.cpp b/src/game/WorldSession.cpp
index 26c1e2a22..32b43056d 100644
--- a/src/game/WorldSession.cpp
+++ b/src/game/WorldSession.cpp
@@ -636,8 +636,10 @@ void WorldSession::ReadMovementInfo(WorldPacket &data, MovementInfo *mi)
 
     if(mi->flags & MOVEMENTFLAG_ONTRANSPORT)
     {
-        CHECK_PACKET_SIZE(data, data.rpos()+8+4+4+4+4+4+1);
-        data >> mi->t_guid;
+        if(!data.readPackGUID(mi->t_guid))
+            return;
+
+        CHECK_PACKET_SIZE(data, data.rpos()+4+4+4+4+4+1);
         data >> mi->t_x;
         data >> mi->t_y;
         data >> mi->t_z;