2 files changed, 20 insertions, 8 deletions

diff --git a/modules/bmp/image_loader_bmp.cpp b/modules/bmp/image_loader_bmp.cpp
index 171895ed24..bd8342e1aa 100644
--- a/modules/bmp/image_loader_bmp.cpp
+++ b/modules/bmp/image_loader_bmp.cpp
@@ -91,11 +91,13 @@ Error ImageLoaderBMP::convert_to_image(Ref<Image> p_image,
 		// the data width in case of 8/4/1 bit images
 		const uint32_t w = bits_per_pixel >= 24 ? width : width_bytes;
 		const uint8_t *line = p_buffer + (line_width * (height - 1));
+		const uint8_t *end_buffer = p_buffer + p_header.bmp_file_header.bmp_file_size - p_header.bmp_file_header.bmp_file_offset;
 
 		for (uint64_t i = 0; i < height; i++) {
 			const uint8_t *line_ptr = line;
 
 			for (unsigned int j = 0; j < w; j++) {
+				ERR_FAIL_COND_V(line_ptr >= end_buffer, ERR_FILE_CORRUPT);
 				switch (bits_per_pixel) {
 					case 1: {
 						uint8_t color_index = *line_ptr;
diff --git a/modules/bullet/soft_body_bullet.cpp b/modules/bullet/soft_body_bullet.cpp
index 94b7e0ce38..371800d8f3 100644
--- a/modules/bullet/soft_body_bullet.cpp
+++ b/modules/bullet/soft_body_bullet.cpp
@@ -190,22 +190,24 @@ void SoftBodyBullet::get_node_position(int p_node_index, Vector3 &r_position) co
 	}
 }
 
-void SoftBodyBullet::set_node_mass(int node_index, btScalar p_mass) {
+void SoftBodyBullet::set_node_mass(int p_node_index, btScalar p_mass) {
 	if (0 >= p_mass) {
-		pin_node(node_index);
+		pin_node(p_node_index);
 	} else {
-		unpin_node(node_index);
+		unpin_node(p_node_index);
 	}
 	if (bt_soft_body) {
-		bt_soft_body->setMass(node_index, p_mass);
+		ERR_FAIL_INDEX(p_node_index, bt_soft_body->m_nodes.size());
+		bt_soft_body->setMass(p_node_index, p_mass);
 	}
 }
 
-btScalar SoftBodyBullet::get_node_mass(int node_index) const {
+btScalar SoftBodyBullet::get_node_mass(int p_node_index) const {
 	if (bt_soft_body) {
-		return bt_soft_body->getMass(node_index);
+		ERR_FAIL_INDEX_V(p_node_index, bt_soft_body->m_nodes.size(), 1);
+		return bt_soft_body->getMass(p_node_index);
 	} else {
-		return -1 == search_node_pinned(node_index) ? 1 : 0;
+		return -1 == search_node_pinned(p_node_index) ? 1 : 0;
 	}
 }
 
@@ -418,17 +420,25 @@ void SoftBodyBullet::setup_soft_body() {
 
 	// Set pinned nodes
 	for (int i = pinned_nodes.size() - 1; 0 <= i; --i) {
-		bt_soft_body->setMass(pinned_nodes[i], 0);
+		const int node_index = pinned_nodes[i];
+		ERR_CONTINUE(0 > node_index || bt_soft_body->m_nodes.size() <= node_index);
+		bt_soft_body->setMass(node_index, 0);
 	}
 }
 
 void SoftBodyBullet::pin_node(int p_node_index) {
+	if (bt_soft_body) {
+		ERR_FAIL_INDEX(p_node_index, bt_soft_body->m_nodes.size());
+	}
 	if (-1 == search_node_pinned(p_node_index)) {
 		pinned_nodes.push_back(p_node_index);
 	}
 }
 
 void SoftBodyBullet::unpin_node(int p_node_index) {
+	if (bt_soft_body) {
+		ERR_FAIL_INDEX(p_node_index, bt_soft_body->m_nodes.size());
+	}
 	const int id = search_node_pinned(p_node_index);
 	if (-1 != id) {
 		pinned_nodes.remove(id);