quartznet/raylib
Watch
3
0
Fork
You've already forked raylib
 0
Code Issues Pull requests Releases 25 Activity

FIXED: ImageFromImage() heap-buffer-overflow on compressed formats

Browse source
This commit is contained in:
gummyniki 2026-07-17 21:39:26 +00:00
commit 233a0661a0
1 changed files with 18 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

28
src/rtextures.c
View file

@ -1230,23 +1230,31 @@ Image ImageFromImage(Image image, Rectangle rec)
{ {
Image result = { 0 }; Image result = { 0 };
// Security check to avoid program crash
if ((image.data == NULL) || (image.width == 0) || (image.height == 0)) return result;
// Basic rectangle validation: size smaller than image size // Basic rectangle validation: size smaller than image size
if ((rec.x >= 0) && (rec.y >= 0) && (rec.width > 0) && (rec.height > 0) && if ((rec.x >= 0) && (rec.y >= 0) && (rec.width > 0) && (rec.height > 0) &&
(((int)rec.x + (int)rec.width) <= image.width) && (((int)rec.x + (int)rec.width) <= image.width) &&
(((int)rec.y + (int)rec.height) <= image.height)) (((int)rec.y + (int)rec.height) <= image.height))
{ {
int bytesPerPixel = GetPixelDataSize(1, 1, image.format);
result.width = (int)rec.width; if (image.format >= PIXELFORMAT_COMPRESSED_DXT1_RGB) TRACELOG(LOG_WARNING, "IMAGE: Image manipulation not supported for compressed formats");
result.height = (int)rec.height; else
result.data = RL_CALLOC((int)rec.width*(int)rec.height*bytesPerPixel, 1); {
result.format = image.format; int bytesPerPixel = GetPixelDataSize(1, 1, image.format);
result.mipmaps = 1;
for (int y = 0; y < (int)rec.height; y++) result.width = (int)rec.width;
{ result.height = (int)rec.height;
memcpy(((unsigned char *)result.data) + y*(int)rec.width*bytesPerPixel, ((unsigned char *)image.data) + ((y + (int)rec.y)*image.width + (int)rec.x)*bytesPerPixel, (int)rec.width*bytesPerPixel); result.data = RL_CALLOC((int)rec.width*(int)rec.height*bytesPerPixel, 1);
} result.format = image.format;
result.mipmaps = 1;
for (int y = 0; y < (int)rec.height; y++)
{
memcpy(((unsigned char *)result.data) + y*(int)rec.width*bytesPerPixel, ((unsigned char *)image.data) + ((y + (int)rec.y)*image.width + (int)rec.x)*bytesPerPixel, (int)rec.width*bytesPerPixel);
}
}
} }
else TRACELOG(LOG_WARNING, "IMAGE: Rectangle provided for ImageToImage not valid"); else TRACELOG(LOG_WARNING, "IMAGE: Rectangle provided for ImageToImage not valid");