raylib

9,718 commits 2 branches 25 tags 498 MiB

Author SHA1 Message Date

Author	SHA1	Message	Date
segv0x	ecd2b2ac10	[rtextures] Add bounds validation to GPU texture parsers (rltexgpu.h) All five GPU texture parsers (DDS, PKM, KTX, PVR, ASTC) accept a file_size parameter but never validate it against computed data sizes. This allows crafted files to trigger heap buffer overflow reads via memcpy and integer overflow in dimension calculations. Changes: - Validate file_size covers header before accessing header fields - Check computed data_size against remaining file data before memcpy - Validate attacker-controlled pointer offsets (KTX key_value_data_size, PVR metadata_size) before advancing file_data_ptr - Prevent integer overflow in width*height pixel count calculation (DDS) - Prevent division by zero in ASTC bpp calculation when blockX/blockY is 0	2026-04-08 18:08:06 +08:00
Ray	2c39703d13	RENAMED: `rl_gputex` to `rltexgpu`	2026-03-18 13:28:45 +01:00

segv0x

ecd2b2ac10

[rtextures] Add bounds validation to GPU texture parsers (rltexgpu.h)

All five GPU texture parsers (DDS, PKM, KTX, PVR, ASTC) accept a
file_size parameter but never validate it against computed data sizes.
This allows crafted files to trigger heap buffer overflow reads via
memcpy and integer overflow in dimension calculations.

Changes:
- Validate file_size covers header before accessing header fields
- Check computed data_size against remaining file data before memcpy
- Validate attacker-controlled pointer offsets (KTX key_value_data_size,
  PVR metadata_size) before advancing file_data_ptr
- Prevent integer overflow in width*height pixel count calculation (DDS)
- Prevent division by zero in ASTC bpp calculation when blockX/blockY is 0

2026-04-08 18:08:06 +08:00

Ray

2c39703d13

RENAMED: rl_gputex to rltexgpu

2026-03-18 13:28:45 +01:00

Renamed from src/external/rl_gputex.h (Previous history)