From 306a8eec586656fd41e905f73da33a9a0409e56c Mon Sep 17 00:00:00 2001
From: jsjtxietian <jsjtxietian@outlook.com>
Date: Mon, 13 Nov 2023 16:19:17 +0800
Subject: [PATCH] Add protection in RichTextLabel.update_image to prevent crash

---
 scene/gui/rich_text_label.cpp | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/scene/gui/rich_text_label.cpp b/scene/gui/rich_text_label.cpp
index 30a468dfc56c..dd93376a2d5e 100644
--- a/scene/gui/rich_text_label.cpp
+++ b/scene/gui/rich_text_label.cpp
@@ -3207,6 +3207,9 @@ void RichTextLabel::add_image(const Ref<Texture2D> &p_image, int p_width, int p_
 	ERR_FAIL_COND(p_image.is_null());
 	ERR_FAIL_COND(p_image->get_width() == 0);
 	ERR_FAIL_COND(p_image->get_height() == 0);
+	ERR_FAIL_COND(p_width < 0);
+	ERR_FAIL_COND(p_height < 0);
+
 	ItemImage *item = memnew(ItemImage);
 
 	if (p_region.has_area()) {
@@ -3240,6 +3243,9 @@ void RichTextLabel::update_image(const Variant &p_key, BitField<ImageUpdateMask>
 		ERR_FAIL_COND(p_image->get_height() == 0);
 	}
 
+	ERR_FAIL_COND(p_width < 0);
+	ERR_FAIL_COND(p_height < 0);
+
 	bool reshape = false;
 
 	Item *it = main;
@@ -3291,6 +3297,9 @@ void RichTextLabel::update_image(const Variant &p_key, BitField<ImageUpdateMask>
 					}
 				}
 				if ((p_mask & UPDATE_SIZE) || (p_mask & UPDATE_REGION) || (p_mask & UPDATE_TEXTURE)) {
+					ERR_FAIL_COND(item->image.is_null());
+					ERR_FAIL_COND(item->image->get_width() == 0);
+					ERR_FAIL_COND(item->image->get_height() == 0);
 					Size2 new_size = _get_image_size(item->image, item->rq_size.width, item->rq_size.height, item->region);
 					if (item->size != new_size) {
 						reshape = true;