Commit 3edfe194 added a `gamepad >= 0` lower-bound check to
GetGamepadAxisCount() and GetGamepadName(), but six sibling functions
were left with only the upper-bound check (`gamepad < MAX_GAMEPADS`).
A negative signed int passes that check and triggers out-of-bounds
access on CORE.Input.Gamepad.ready[gamepad] and related arrays (UB in C).
Apply the same `(gamepad >= 0) &&` guard added in 3edfe194 to:
- IsGamepadAvailable
- IsGamepadButtonPressed
- IsGamepadButtonDown
- IsGamepadButtonReleased
- IsGamepadButtonUp
- GetGamepadAxisMovement
* [rcore] Bounds-check gamepad index in GetGamepadAxisCount() and GetGamepadName()
Both public getters indexed CORE.Input.Gamepad.axisCount[gamepad] / .name[gamepad]
with an unvalidated gamepad argument -- an out-of-bounds read for gamepad < 0 or
gamepad >= MAX_GAMEPADS. Every sibling gamepad accessor (IsGamepadAvailable,
IsGamepadButton*, GetGamepadAxisMovement) already guards the index; add the same
check, returning a safe default (0 / NULL).
* Refactor GetGamepadName/GetGamepadAxisCount to single-return pattern
---------
Co-authored-by: Brandon Arrendondo <brandon.arrendondo@bissell.com>
The MAX_TEXT_BUFFER_LENGTH guard present in TextReplace()/TextInsert() was
missing here, so the three strncpy() calls could write past the 1024-byte
static buffer for long inputs. Add the same length check before copying.
Co-authored-by: Brandon Arrendondo <brandon.arrendondo@bissell.com>
The RL_MAX_MATRIX_STACK_SIZE check logged an error but did not return, so
RLGL.State.stack[stackCounter] = *currentMatrix still executed when the stack
was full -- writing one element past stack[RL_MAX_MATRIX_STACK_SIZE] and
corrupting the adjacent RLGL.State members (stackCounter, etc.). rlPopMatrix()
already guards the symmetric underflow case; add the missing early return.
Co-authored-by: Brandon Arrendondo <brandon.arrendondo@bissell.com>
