mirrors/raylib
1
0
Fork 0
mirror of https://github.com/raysan5/raylib.git synced 2026-07-31 04:38:54 +00:00
Code Issues Packages Projects Releases Wiki Activity

FIXED: ImageFromImage() heap-buffer-overflow on compressed formats (#5991)

Browse Source
This commit is contained in:
Mierenik
2026-07-18 00:22:35 +03:00
committed by GitHub
parent aa088e42d1
commit 5b1445b381
1 changed files with 18 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
src/rtextures.c
View File

@@ -1230,23 +1230,31 @@ Image ImageFromImage(Image image, Rectangle rec)
{
Image result = { 0 };
// Security check to avoid program crash
if ((image.data == NULL) || (image.width == 0) || (image.height == 0)) return result;
// Basic rectangle validation: size smaller than image size
if ((rec.x >= 0) && (rec.y >= 0) && (rec.width > 0) && (rec.height > 0) &&
(((int)rec.x + (int)rec.width) <= image.width) &&
(((int)rec.y + (int)rec.height) <= image.height))
{
int bytesPerPixel = GetPixelDataSize(1, 1, image.format);
result.width = (int)rec.width;
result.height = (int)rec.height;
result.data = RL_CALLOC((int)rec.width*(int)rec.height*bytesPerPixel, 1);
result.format = image.format;
result.mipmaps = 1;
if (image.format >= PIXELFORMAT_COMPRESSED_DXT1_RGB) TRACELOG(LOG_WARNING, "IMAGE: Image manipulation not supported for compressed formats");
else
{
int bytesPerPixel = GetPixelDataSize(1, 1, image.format);
for (int y = 0; y < (int)rec.height; y++)
{
memcpy(((unsigned char *)result.data) + y*(int)rec.width*bytesPerPixel, ((unsigned char *)image.data) + ((y + (int)rec.y)*image.width + (int)rec.x)*bytesPerPixel, (int)rec.width*bytesPerPixel);
}
result.width = (int)rec.width;
result.height = (int)rec.height;
result.data = RL_CALLOC((int)rec.width*(int)rec.height*bytesPerPixel, 1);
result.format = image.format;
result.mipmaps = 1;
for (int y = 0; y < (int)rec.height; y++)
{
memcpy(((unsigned char *)result.data) + y*(int)rec.width*bytesPerPixel, ((unsigned char *)image.data) + ((y + (int)rec.y)*image.width + (int)rec.x)*bytesPerPixel, (int)rec.width*bytesPerPixel);
}
}
}
else TRACELOG(LOG_WARNING, "IMAGE: Rectangle provided for ImageToImage not valid");