From 0decc3e09433dd480862dbe608c04fec26c00795 Mon Sep 17 00:00:00 2001
From: yexo <yexo@openttd.org>
Date: Fri, 3 Sep 2010 23:04:02 +0000
Subject: (svn r20731) -Fix (r20739): SmallVector did not have an assignment
 operator, causing invalid memory reads / double free

---
 src/core/smallvec_type.hpp | 10 +++++++++-
 src/landscape.cpp          |  2 +-
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/src/core/smallvec_type.hpp b/src/core/smallvec_type.hpp
index d64f4a744..89b12d5f5 100644
--- a/src/core/smallvec_type.hpp
+++ b/src/core/smallvec_type.hpp
@@ -36,12 +36,20 @@ protected:
 public:
 	SmallVector() : data(NULL), items(0), capacity(0) { }
 
-	template<uint X>
+	template <uint X>
 	SmallVector(const SmallVector<T, X> &other) : data(NULL), items(0), capacity(0)
 	{
 		MemCpyT<T>(this->Append(other.Length()), other.Begin(), other.Length());
 	}
 
+	template <uint X>
+	SmallVector &operator=(const SmallVector<T, X> &other)
+	{
+		this->Reset();
+		MemCpyT<T>(this->Append(other.Length()), other.Begin(), other.Length());
+		return *this;
+	}
+
 	~SmallVector()
 	{
 		free(this->data);
diff --git a/src/landscape.cpp b/src/landscape.cpp
index f3bcaa263..e6c5bd5df 100644
--- a/src/landscape.cpp
+++ b/src/landscape.cpp
@@ -638,7 +638,7 @@ CommandCost CmdClearArea(TileIndex tile, DoCommandFlag flags, uint32 p1, uint32
 
 	for (int x = sx; x <= ex; ++x) {
 		for (int y = sy; y <= ey; ++y) {
-			SmallVector<TileArea, 1> object_areas = _cleared_object_areas;
+			SmallVector<TileArea, 1> object_areas(_cleared_object_areas);
 			CommandCost ret = DoCommand(TileXY(x, y), 0, 0, flags & ~DC_EXEC, CMD_LANDSCAPE_CLEAR);
 			_cleared_object_areas = object_areas;
 			if (ret.Failed()) {
-- 
cgit v1.2.3-54-g00ecf