Add protection in RichTextLabel.update_image to prevent crash

[jsjtxietian]

Fixes #84739

[bruvzg]

While widht and height should not be negative, and this change is fine, I'm not sure why it would cause a crash.

Relevant line: ret.width = p_image->get_width() * p_height / p_image->get_height();.

I would suspect crash reason is missing ERR_FAIL_COND(p_image.is_null()); check in the update_image. It's done only if UPDATE_TEXTURE flag is set, but _get_image_size which is reading the image is also called if UPDATE_SIZE or UPDATE_REGION is set.

diff --git a/scene/gui/rich_text_label.cpp b/scene/gui/rich_text_label.cpp
index 30a468dfc5..e8adce897a 100644
--- a/scene/gui/rich_text_label.cpp
+++ b/scene/gui/rich_text_label.cpp
@@ -3291,6 +3291,9 @@ void RichTextLabel::update_image(const Variant &p_key, BitField<ImageUpdateMask>
 					}
 				}
 				if ((p_mask & UPDATE_SIZE) || (p_mask & UPDATE_REGION) || (p_mask & UPDATE_TEXTURE)) {
+					ERR_FAIL_COND(item->image.is_null());
+					ERR_FAIL_COND(item->image->get_width() == 0);
+					ERR_FAIL_COND(item->image->get_height() == 0);
 					Size2 new_size = _get_image_size(item->image, item->rq_size.width, item->rq_size.height, item->region);
 					if (item->size != new_size) {
 						reshape = true;

[akien-mga]

Thanks!