NEVERHOOD: Fix invalid memory access in navigation scenes

When a new Smacker is opened, the old Smacker surface is deleted
and a new one is created. Therefore, it has to be removed from the
scene and the new one has to be added.

1 files changed, 9 insertions, 2 deletions

diff --git a/engines/neverhood/navigationscene.cpp b/engines/neverhood/navigationscene.cpp
index d802322858..9752ee618c 100644
--- a/engines/neverhood/navigationscene.cpp
+++ b/engines/neverhood/navigationscene.cpp
@@ -69,7 +69,7 @@ int NavigationScene::getNavigationAreaType() {
 void NavigationScene::update() {
 	if (_smackerFileHash != 0) {
 		showMouse(false);
-		_smackerPlayer->open(_smackerFileHash, false);
+		openSmacker(_smackerFileHash, false);
 		_vm->_screen->clear();
 		_vm->_screen->setSmackerDecoder(_smackerPlayer->getSmackerDecoder());
 		_smackerDone = false;
@@ -92,7 +92,7 @@ void NavigationScene::update() {
 			_vm->_soundMan->setTwoSoundsPlayFlag(false);
 			_vm->_soundMan->setSoundThreePlayFlag(false);
 			_smackerDone = false;
-			_smackerPlayer->open(navigationItem.fileHash, true);
+			openSmacker(navigationItem.fileHash, true);
 			_vm->_screen->clear();
 			_vm->_screen->setSmackerDecoder(_smackerPlayer->getSmackerDecoder());
 			sendMessage(_parentModule, 0x100A, _navigationIndex);
@@ -101,6 +101,13 @@ void NavigationScene::update() {
 	Scene::update();
 }
 
+void NavigationScene::openSmacker(uint32 fileHash, bool keepLastFrame) {
+	// The old Smacker surface is deleted when a new Smacker is opened.
+	removeSurface(_smackerPlayer->getSurface());
+	_smackerPlayer->open(fileHash, keepLastFrame);
+	addSurface(_smackerPlayer->getSurface());
+}
+
 uint32 NavigationScene::handleMessage(int messageNum, const MessageParam &param, Entity *sender) {
 	switch (messageNum) {
 	case 0x0000: