FIXED: ImageFromImage() heap-buffer-overflow on compressed formats (#5991)

Co-authored-by: gideons <gse@newspacesystems.com>

src/CMakeLists.txt

@@ -107,6 +107,20 @@ endif ()
 target_link_libraries(raylib PRIVATE $<BUILD_INTERFACE:${LIBS_PRIVATE}>)
 target_link_libraries(raylib PUBLIC ${LIBS_PUBLIC})
 
+# Static libraries must export their private link dependencies for installed consumers.
+# LINK_ONLY keeps those dependencies out of the compile interface.
+if (NOT BUILD_SHARED_LIBS)
+    set(raylib_install_private_libs ${LIBS_PRIVATE})
+
+    if (NOT glfw3_FOUND)
+        list(REMOVE_ITEM raylib_install_private_libs glfw)
+    endif()
+
+    foreach(lib IN LISTS raylib_install_private_libs)
+        target_link_libraries(raylib INTERFACE $<INSTALL_INTERFACE:$<LINK_ONLY:${lib}>>)
+    endforeach()
+endif()
+
 # Sets some compile time definitions for the pre-processor
 # If CUSTOMIZE_BUILD option is on you will not use config.h by default
 # and you will be able to select more build options

src/rcore.c

@@ -3608,7 +3608,7 @@ AutomationEventList LoadAutomationEventList(const char *fileName)
 
                             counter++;
                         }
-                        else TRACELOG(LOG_WARNING, "AUTOMATION: Event goes beyond automated list capacity (MAX: %i): %s", buffer, list.capacity);
+                        else TRACELOG(LOG_WARNING, "AUTOMATION: Event goes beyond automated list capacity (MAX: %u): %s", list.capacity, buffer);
                     } break;
                     default: break;
                 }

src/rtextures.c

@@ -1230,23 +1230,31 @@ Image ImageFromImage(Image image, Rectangle rec)
 {
     Image result = { 0 };
 
+    // Security check to avoid program crash
+    if ((image.data == NULL) || (image.width == 0) || (image.height == 0)) return result;
+
     // Basic rectangle validation: size smaller than image size
     if ((rec.x >= 0) && (rec.y >= 0) && (rec.width > 0) && (rec.height > 0) &&
         (((int)rec.x + (int)rec.width) <= image.width) &&
         (((int)rec.y + (int)rec.height) <= image.height))
     {
-        int bytesPerPixel = GetPixelDataSize(1, 1, image.format);
 
-        result.width = (int)rec.width;
+	if (image.format >= PIXELFORMAT_COMPRESSED_DXT1_RGB) TRACELOG(LOG_WARNING, "IMAGE: Image manipulation not supported for compressed formats");
-        result.height = (int)rec.height;
+	else
-        result.data = RL_CALLOC((int)rec.width*(int)rec.height*bytesPerPixel, 1);
+	{
-        result.format = image.format;
+            int bytesPerPixel = GetPixelDataSize(1, 1, image.format);
-        result.mipmaps = 1;
 
-        for (int y = 0; y < (int)rec.height; y++)
+            result.width = (int)rec.width;
-        {
+            result.height = (int)rec.height;
-            memcpy(((unsigned char *)result.data) + y*(int)rec.width*bytesPerPixel, ((unsigned char *)image.data) + ((y + (int)rec.y)*image.width + (int)rec.x)*bytesPerPixel, (int)rec.width*bytesPerPixel);
+            result.data = RL_CALLOC((int)rec.width*(int)rec.height*bytesPerPixel, 1);
-        }
+            result.format = image.format;
+            result.mipmaps = 1;
+
+            for (int y = 0; y < (int)rec.height; y++)
+            {
+                memcpy(((unsigned char *)result.data) + y*(int)rec.width*bytesPerPixel, ((unsigned char *)image.data) + ((y + (int)rec.y)*image.width + (int)rec.x)*bytesPerPixel, (int)rec.width*bytesPerPixel);
+            }
+	}
     }
     else TRACELOG(LOG_WARNING, "IMAGE: Rectangle provided for ImageToImage not valid");