A missing validation in OpenTTD before 1.3.3 allows remote attackers to cause a denial of service (crash) by forcefully crashing aircraft near the corner of the map. This triggers a corner case where data outside of the allocated map array is accessed (CVE-2013-6411).