From 91c4a451efc1ac150afeb8a0275049cdc22bd26d Mon Sep 17 00:00:00 2001
From: Bambo-Borris <canyoufeelit4@gmail.com>
Date: Fri, 17 Jun 2022 18:04:43 +0100
Subject: [PATCH] Fix out of bounds read for `sf::Image::copy()` with bad
 `sourceRect`

---
 src/SFML/Graphics/Image.cpp | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/SFML/Graphics/Image.cpp b/src/SFML/Graphics/Image.cpp
index d17ccf45..2cec9000 100644
--- a/src/SFML/Graphics/Image.cpp
+++ b/src/SFML/Graphics/Image.cpp
@@ -177,6 +177,11 @@ void Image::copy(const Image& source, const Vector2u& dest, const IntRect& sourc
     if ((source.m_size.x == 0) || (source.m_size.y == 0) || (m_size.x == 0) || (m_size.y == 0))
         return;
 
+    // Make sure the sourceRect left & top  and the {left, top} + {width, height} within bounds
+    if (static_cast<unsigned int>(sourceRect.left) >= source.m_size.x || static_cast<unsigned int>(sourceRect.left + sourceRect.width) > source.m_size.x ||
+        static_cast<unsigned int>(sourceRect.top) >= source.m_size.y || static_cast<unsigned int>(sourceRect.top + sourceRect.height) > source.m_size.y)
+        return;
+
     // Adjust the source rectangle
     IntRect srcRect = sourceRect;
     if (srcRect.width == 0 || (srcRect.height == 0))