NEVERHOOD: Fix invalid memory access in navigation scenes

When a new Smacker is opened, the old Smacker surface is deleted
and a new one is created. Therefore, it has to be removed from the
scene and the new one has to be added.

2 files changed, 10 insertions, 2 deletions

diff --git a/engines/neverhood/navigationscene.cpp b/engines/neverhood/navigationscene.cpp
index d802322858..9752ee618c 100644
--- a/engines/neverhood/navigationscene.cpp
+++ b/engines/neverhood/navigationscene.cpp
@@ -69,7 +69,7 @@ int NavigationScene::getNavigationAreaType() {
 void NavigationScene::update() {
 	if (_smackerFileHash != 0) {
 		showMouse(false);
-		_smackerPlayer->open(_smackerFileHash, false);
+		openSmacker(_smackerFileHash, false);
 		_vm->_screen->clear();
 		_vm->_screen->setSmackerDecoder(_smackerPlayer->getSmackerDecoder());
 		_smackerDone = false;
@@ -92,7 +92,7 @@ void NavigationScene::update() {
 			_vm->_soundMan->setTwoSoundsPlayFlag(false);
 			_vm->_soundMan->setSoundThreePlayFlag(false);
 			_smackerDone = false;
-			_smackerPlayer->open(navigationItem.fileHash, true);
+			openSmacker(navigationItem.fileHash, true);
 			_vm->_screen->clear();
 			_vm->_screen->setSmackerDecoder(_smackerPlayer->getSmackerDecoder());
 			sendMessage(_parentModule, 0x100A, _navigationIndex);
@@ -101,6 +101,13 @@ void NavigationScene::update() {
 	Scene::update();
 }
 
+void NavigationScene::openSmacker(uint32 fileHash, bool keepLastFrame) {
+	// The old Smacker surface is deleted when a new Smacker is opened.
+	removeSurface(_smackerPlayer->getSurface());
+	_smackerPlayer->open(fileHash, keepLastFrame);
+	addSurface(_smackerPlayer->getSurface());
+}
+
 uint32 NavigationScene::handleMessage(int messageNum, const MessageParam &param, Entity *sender) {
 	switch (messageNum) {
 	case 0x0000:
diff --git a/engines/neverhood/navigationscene.h b/engines/neverhood/navigationscene.h
index ebe9a3597c..767b3f5d20 100644
--- a/engines/neverhood/navigationscene.h
+++ b/engines/neverhood/navigationscene.h
@@ -50,6 +50,7 @@ protected:
 	bool _leaveSceneAfter;
 	const byte *_itemsTypes;
 	void update();
+	void openSmacker(uint32 fileHash, bool keepLastFrame);
 	uint32 handleMessage(int messageNum, const MessageParam &param, Entity *sender);
 	void createMouseCursor();
 	void handleNavigation(const NPoint &mousePos);