From b55ed2e6685a675064cd489132f611897344ca47 Mon Sep 17 00:00:00 2001
From: rubidium <rubidium@openttd.org>
Date: Tue, 3 Mar 2009 20:33:57 +0000
Subject: [PATCH] (svn r15603) -Fix [FS#2696]: crash when using an
 extraordinarily large sprite as cursor.

---
 src/core/alloc_type.hpp | 9 +++++++++
 src/gfx.cpp             | 8 ++++----
 2 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/src/core/alloc_type.hpp b/src/core/alloc_type.hpp
index 887ba72370..b95fc79ee7 100644
--- a/src/core/alloc_type.hpp
+++ b/src/core/alloc_type.hpp
@@ -123,6 +123,15 @@ public:
 		}
 		return this->buffer;
 	}
+
+	/**
+	 * Get the currently allocated buffer.
+	 * @return the buffer
+	 */
+	FORCEINLINE const T *GetBuffer() const
+	{
+		return this->buffer;
+	}
 };
 
 /**
diff --git a/src/gfx.cpp b/src/gfx.cpp
index 07cb70bac1..a69654ca13 100644
--- a/src/gfx.cpp
+++ b/src/gfx.cpp
@@ -52,7 +52,7 @@ static int ReallyDoDrawString(const char *string, int x, int y, TextColour colou
 
 FontSize _cur_fontsize;
 static FontSize _last_fontsize;
-static uint8 _cursor_backup[64 * 64 * 4];
+static ReusableBuffer<uint8> _cursor_backup;
 
 /**
  * The rect for repaint.
@@ -1288,7 +1288,7 @@ void UndrawMouseCursor()
 	if (_cursor.visible) {
 		Blitter *blitter = BlitterFactoryBase::GetCurrentBlitter();
 		_cursor.visible = false;
-		blitter->CopyFromBuffer(blitter->MoveTo(_screen.dst_ptr, _cursor.draw_pos.x, _cursor.draw_pos.y), _cursor_backup, _cursor.draw_size.x, _cursor.draw_size.y);
+		blitter->CopyFromBuffer(blitter->MoveTo(_screen.dst_ptr, _cursor.draw_pos.x, _cursor.draw_pos.y), _cursor_backup.GetBuffer(), _cursor.draw_size.x, _cursor.draw_size.y);
 		_video_driver->MakeDirty(_cursor.draw_pos.x, _cursor.draw_pos.y, _cursor.draw_size.x, _cursor.draw_size.y);
 	}
 }
@@ -1337,10 +1337,10 @@ void DrawMouseCursor()
 	_cursor.draw_pos.y = y;
 	_cursor.draw_size.y = h;
 
-	assert(blitter->BufferSize(w, h) < (int)sizeof(_cursor_backup));
+	uint8 *buffer = _cursor_backup.Allocate(blitter->BufferSize(w, h));
 
 	/* Make backup of stuff below cursor */
-	blitter->CopyToBuffer(blitter->MoveTo(_screen.dst_ptr, _cursor.draw_pos.x, _cursor.draw_pos.y), _cursor_backup, _cursor.draw_size.x, _cursor.draw_size.y);
+	blitter->CopyToBuffer(blitter->MoveTo(_screen.dst_ptr, _cursor.draw_pos.x, _cursor.draw_pos.y), buffer, _cursor.draw_size.x, _cursor.draw_size.y);
 
 	/* Draw cursor on screen */
 	_cur_dpi = &_screen;