From 65bacf241bbec3d45e59836f88049d544a19377d Mon Sep 17 00:00:00 2001 From: Sandy Gutierrez Date: Thu, 16 Nov 2023 09:17:37 -0500 Subject: [PATCH] Merge pull request #84833 from jsjtxietian/add-protection-in-rich-text-label-add-image Add protection in `RichTextLabel.update_image` to prevent crash --- scene/gui/rich_text_label.cpp | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/scene/gui/rich_text_label.cpp b/scene/gui/rich_text_label.cpp index 30a468dfc56c..dd93376a2d5e 100644 --- a/scene/gui/rich_text_label.cpp +++ b/scene/gui/rich_text_label.cpp @@ -3207,6 +3207,9 @@ void RichTextLabel::add_image(const Ref &p_image, int p_width, int p_ ERR_FAIL_COND(p_image.is_null()); ERR_FAIL_COND(p_image->get_width() == 0); ERR_FAIL_COND(p_image->get_height() == 0); + ERR_FAIL_COND(p_width < 0); + ERR_FAIL_COND(p_height < 0); + ItemImage *item = memnew(ItemImage); if (p_region.has_area()) { @@ -3240,6 +3243,9 @@ void RichTextLabel::update_image(const Variant &p_key, BitField ERR_FAIL_COND(p_image->get_height() == 0); } + ERR_FAIL_COND(p_width < 0); + ERR_FAIL_COND(p_height < 0); + bool reshape = false; Item *it = main; @@ -3291,6 +3297,9 @@ void RichTextLabel::update_image(const Variant &p_key, BitField } } if ((p_mask & UPDATE_SIZE) || (p_mask & UPDATE_REGION) || (p_mask & UPDATE_TEXTURE)) { + ERR_FAIL_COND(item->image.is_null()); + ERR_FAIL_COND(item->image->get_width() == 0); + ERR_FAIL_COND(item->image->get_height() == 0); Size2 new_size = _get_image_size(item->image, item->rq_size.width, item->rq_size.height, item->region); if (item->size != new_size) { reshape = true;