Add parameter checkes to FileAccess get_buffer functions

fix #46540

7 files changed, 19 insertions, 3 deletions

diff --git a/core/io/file_access_compressed.cpp b/core/io/file_access_compressed.cpp
index 9ec2b27e88..ade4b2c1ac 100644
--- a/core/io/file_access_compressed.cpp
+++ b/core/io/file_access_compressed.cpp
@@ -286,8 +286,10 @@ uint8_t FileAccessCompressed::get_8() const {
 }
 
 int FileAccessCompressed::get_buffer(uint8_t *p_dst, int p_length) const {
-	ERR_FAIL_COND_V_MSG(!f, 0, "File must be opened before use.");
-	ERR_FAIL_COND_V_MSG(writing, 0, "File has not been opened in read mode.");
+	ERR_FAIL_COND_V(!p_dst, -1);
+	ERR_FAIL_COND_V(p_length < 0, -1);
+	ERR_FAIL_COND_V_MSG(!f, -1, "File must be opened before use.");
+	ERR_FAIL_COND_V_MSG(writing, -1, "File has not been opened in read mode.");
 
 	if (at_end) {
 		read_eof = true;
diff --git a/core/io/file_access_encrypted.cpp b/core/io/file_access_encrypted.cpp
index 8b4c57ce64..133ec18762 100644
--- a/core/io/file_access_encrypted.cpp
+++ b/core/io/file_access_encrypted.cpp
@@ -237,7 +237,9 @@ uint8_t FileAccessEncrypted::get_8() const {
 }
 
 int FileAccessEncrypted::get_buffer(uint8_t *p_dst, int p_length) const {
-	ERR_FAIL_COND_V_MSG(writing, 0, "File has not been opened in read mode.");
+	ERR_FAIL_COND_V(!p_dst, -1);
+	ERR_FAIL_COND_V(p_length < 0, -1);
+	ERR_FAIL_COND_V_MSG(writing, -1, "File has not been opened in read mode.");
 
 	int to_copy = MIN(p_length, data.size() - pos);
 	for (int i = 0; i < to_copy; i++) {
diff --git a/core/io/file_access_memory.cpp b/core/io/file_access_memory.cpp
index 04270de77f..4bab8c1d3d 100644
--- a/core/io/file_access_memory.cpp
+++ b/core/io/file_access_memory.cpp
@@ -138,6 +138,8 @@ uint8_t FileAccessMemory::get_8() const {
 }
 
 int FileAccessMemory::get_buffer(uint8_t *p_dst, int p_length) const {
+	ERR_FAIL_COND_V(!p_dst, -1);
+	ERR_FAIL_COND_V(p_length < 0, -1);
 	ERR_FAIL_COND_V(!data, -1);
 
 	int left = length - pos;
diff --git a/core/io/file_access_network.cpp b/core/io/file_access_network.cpp
index 97838fd14c..e09c3552ef 100644
--- a/core/io/file_access_network.cpp
+++ b/core/io/file_access_network.cpp
@@ -366,6 +366,9 @@ void FileAccessNetwork::_queue_page(int p_page) const {
 }
 
 int FileAccessNetwork::get_buffer(uint8_t *p_dst, int p_length) const {
+	ERR_FAIL_COND_V(!p_dst, -1);
+	ERR_FAIL_COND_V(p_length < 0, -1);
+
 	//bool eof=false;
 	if (pos + p_length > total_size) {
 		eof_flag = true;
diff --git a/core/io/file_access_pack.cpp b/core/io/file_access_pack.cpp
index faf4fca14f..17d54e5cb6 100644
--- a/core/io/file_access_pack.cpp
+++ b/core/io/file_access_pack.cpp
@@ -299,6 +299,9 @@ uint8_t FileAccessPack::get_8() const {
 }
 
 int FileAccessPack::get_buffer(uint8_t *p_dst, int p_length) const {
+	ERR_FAIL_COND_V(!p_dst, -1);
+	ERR_FAIL_COND_V(p_length < 0, -1);
+
 	if (eof) {
 		return 0;
 	}
diff --git a/core/io/file_access_zip.cpp b/core/io/file_access_zip.cpp
index 01f9337a80..5364125abb 100644
--- a/core/io/file_access_zip.cpp
+++ b/core/io/file_access_zip.cpp
@@ -303,6 +303,8 @@ uint8_t FileAccessZip::get_8() const {
 }
 
 int FileAccessZip::get_buffer(uint8_t *p_dst, int p_length) const {
+	ERR_FAIL_COND_V(!p_dst, -1);
+	ERR_FAIL_COND_V(p_length < 0, -1);
 	ERR_FAIL_COND_V(!zfile, -1);
 	at_eof = unzeof(zfile);
 	if (at_eof) {
diff --git a/core/os/file_access.cpp b/core/os/file_access.cpp
index 5a3df88619..e3a84732dc 100644
--- a/core/os/file_access.cpp
+++ b/core/os/file_access.cpp
@@ -368,6 +368,8 @@ Vector<String> FileAccess::get_csv_line(const String &p_delim) const {
 }
 
 int FileAccess::get_buffer(uint8_t *p_dst, int p_length) const {
+	ERR_FAIL_COND_V(!p_dst, -1);
+	ERR_FAIL_COND_V(p_length < 0, -1);
 	int i = 0;
 	for (i = 0; i < p_length && !eof_reached(); i++) {
 		p_dst[i] = get_8();