All five GPU texture parsers (DDS, PKM, KTX, PVR, ASTC) accept a
file_size parameter but never validate it against computed data sizes.
This allows crafted files to trigger heap buffer overflow reads via
memcpy and integer overflow in dimension calculations.
Changes:
- Validate file_size covers header before accessing header fields
- Check computed data_size against remaining file data before memcpy
- Validate attacker-controlled pointer offsets (KTX key_value_data_size,
PVR metadata_size) before advancing file_data_ptr
- Prevent integer overflow in width*height pixel count calculation (DDS)
- Prevent division by zero in ASTC bpp calculation when blockX/blockY is 0
https://github.com/raysan5/raylib/pull/5720#issuecomment-4187113099
In this comment, it was pointed out that LibraryConfigurations.cmake
still tries to find and link egl, gbm, and glesv2, even when using the
software renderer is it not necessary.
This patch addresses that.
After RGFW update to 2.0.0-dev in fbd83cafc7, RGFW_window_setIcon api has changed -- not it takes pixel format enum instead of number of channels. On raylib side it was still passing 4 (number of channels in rgba) which is enum value for BGRA8. Instead we have to pass 2 now (RGFW_formatRGBA8 = 2).
- Added zig-pkg directory to gitignore
- Brought min zig version to recent nightly release these improvements
were completed on
- For linux build, only add rglfw.c if the platform is glfw
- Add a None option to the LinuxDisplayBackend
- Fixed xcode-frameworks dependency and update to using most recent
commit hash
Redesign has been conditioned by the usage of those functions on `rexm`, `rpc` and other tools; for many use cases a static buffer is enough and way more comfortable to use.
ADDED: `TextInsertAlloc()`, `TextReplaceAlloc()`, `TextReplaceBetweenAlloc()`, alternatives with internal allocations
