Executing Image.load_tga_from_buffer crashes Godot

[qarmin]

Godot version

4.0.beta.custom_build. c51a427

System information

Ubuntu 22.04 - Nvidia GTX 970, Gnome shell 42 X11

Issue description

When executing

extends Node
func _process(delta):

	var temp_variable15362 = Image.new()
	temp_variable15362.load_tga_from_buffer(PackedByteArray([15, 0, 207, 173, 86, 228, 23, 13, 56, 20, 251, 76, 47, 186, 197, 86, 24, 47, 246, 11, 219, 204, 163, 69, 167]))

Godot crashes with this backtrace

modules/tga/image_loader_tga.cpp:279:32: runtime error: load of value 207, which is not a valid value for type 'tga_type_e'
modules/tga/image_loader_tga.cpp:279:81: runtime error: load of value 207, which is not a valid value for type 'tga_type_e'
modules/tga/image_loader_tga.cpp:279:126: runtime error: load of value 207, which is not a valid value for type 'tga_type_e'
modules/tga/image_loader_tga.cpp:280:35: runtime error: load of value 207, which is not a valid value for type 'tga_type_e'
modules/tga/image_loader_tga.cpp:280:84: runtime error: load of value 207, which is not a valid value for type 'tga_type_e'
modules/tga/image_loader_tga.cpp:281:35: runtime error: load of value 207, which is not a valid value for type 'tga_type_e'
modules/tga/image_loader_tga.cpp:281:87: runtime error: load of value 207, which is not a valid value for type 'tga_type_e'
modules/tga/image_loader_tga.cpp:283:17: runtime error: load of value 207, which is not a valid value for type 'tga_type_e'
=================================================================
==63142==ERROR: AddressSanitizer: negative-size-param: (size=-8)
    #0 0x7efcaafae3ff in __interceptor_memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:827
    #1 0x1d08d25d in FileAccessMemory::get_buffer(unsigned char*, unsigned long) const core/io/file_access_memory.cpp:146
    #2 0xb549e2a in ImageLoaderTGA::load_image(Ref<Image>, Ref<FileAccess>, BitField<ImageFormatLoader::LoaderFlags>, float) modules/tga/image_loader_tga.cpp:322
    #3 0xb54a96a in _tga_mem_loader_func modules/tga/image_loader_tga.cpp:369
    #4 0x1d1bda8f in Image::_load_from_buffer(Vector<unsigned char> const&, Ref<Image> (*)(unsigned char const*, int)) core/io/image.cpp:3752
    #5 0x1d1bca2e in Image::load_tga_from_buffer(Vector<unsigned char> const&) core/io/image.cpp:3707
    #6 0x1d27207c in void call_with_variant_args_ret_helper<__UnexistingClass, Error, Vector<unsigned char> const&, 0ul>(__UnexistingClass*, Error (__UnexistingClass::*)(Vector<unsigned char> const&), Variant const**, Variant&, Callable::CallError&, IndexSequence<0ul>) core/variant/binder_common.h:680
    #7 0x1d25beb6 in void call_with_variant_args_ret_dv<__UnexistingClass, Error, Vector<unsigned char> const&>(__UnexistingClass*, Error (__UnexistingClass::*)(Vector<unsigned char> const&), Variant const**, int, Variant&, Callable::CallError&, Vector<Variant> const&) core/variant/binder_common.h:493
    #8 0x1d2504e5 in MethodBindTR<Error, Vector<unsigned char> const&>::call(Object*, Variant const**, int, Callable::CallError&) core/object/method_bind.h:465
    #9 0x1e455896 in Object::callp(StringName const&, Variant const**, int, Callable::CallError&) core/object/object.cpp:733
    #10 0x1d91e496 in Variant::callp(StringName const&, Variant const**, int, Variant&, Callable::CallError&) core/variant/variant_call.cpp:1048
    #11 0x5f3ce9a in GDScriptFunction::call(GDScriptInstance*, Variant const**, int, Callable::CallError&, GDScriptFunction::CallState*) modules/gdscript/gdscript_vm.cpp:1555
    #12 0x59462b8 in GDScriptInstance::callp(StringName const&, Variant const**, int, Callable::CallError&) modules/gdscript/gdscript.cpp:1629
    #13 0x1328826e in bool Node::_gdvirtual__process_call<false>(double) scene/main/node.h:238
    #14 0x131ef490 in Node::_notification(int) scene/main/node.cpp:56
    #15 0x465ec09 in Node::_notificationv(int, bool) scene/main/node.h:45
    #16 0x1e456dea in Object::notification(int, bool) core/object/object.cpp:790
    #17 0x1334cf23 in SceneTree::_notify_group_pause(StringName const&, int) scene/main/scene_tree.cpp:868
    #18 0x1333f6df in SceneTree::process(double) scene/main/scene_tree.cpp:466
    #19 0x2881a16 in Main::iteration() main/main.cpp:3137
    #20 0x2699e41 in OS_LinuxBSD::run() platform/linuxbsd/os_linuxbsd.cpp:772
    #21 0x26771ab in main platform/linuxbsd/godot_linuxbsd.cpp:72
    #22 0x7efcaa43cd8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #23 0x7efcaa43ce3f in __libc_start_main_impl ../csu/libc-start.c:392
    #24 0x2676c34 in _start (/usr/bin/godot4s+0x2676c34)

0x604000fd6ec1 is located 1 bytes to the right of 48-byte region [0x604000fd6e90,0x604000fd6ec0)
allocated by thread T0 here:
    #0 0x7efcab028867 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
    #1 0x1cc5a54f in Memory::alloc_static(unsigned long, bool) core/os/memory.cpp:75
    #2 0x3d73296 in Error CowData<unsigned char>::resize<false>(int) core/templates/cowdata.h:288
    #3 0x3c7396d in Vector<unsigned char>::resize(int) core/templates/vector.h:91
    #4 0x1df295db in VariantConstructorFromArray<Vector<unsigned char> >::validated_construct(Variant*, Variant const**) core/variant/variant_construct.h:502
    #5 0x5f39ba5 in GDScriptFunction::call(GDScriptInstance*, Variant const**, int, Callable::CallError&, GDScriptFunction::CallState*) modules/gdscript/gdscript_vm.cpp:1426
    #6 0x59462b8 in GDScriptInstance::callp(StringName const&, Variant const**, int, Callable::CallError&) modules/gdscript/gdscript.cpp:1629
    #7 0x1328826e in bool Node::_gdvirtual__process_call<false>(double) scene/main/node.h:238
    #8 0x131ef490 in Node::_notification(int) scene/main/node.cpp:56
    #9 0x465ec09 in Node::_notificationv(int, bool) scene/main/node.h:45
    #10 0x1e456dea in Object::notification(int, bool) core/object/object.cpp:790
    #11 0x1334cf23 in SceneTree::_notify_group_pause(StringName const&, int) scene/main/scene_tree.cpp:868
    #12 0x1333f6df in SceneTree::process(double) scene/main/scene_tree.cpp:466
    #13 0x2881a16 in Main::iteration() main/main.cpp:3137
    #14 0x2699e41 in OS_LinuxBSD::run() platform/linuxbsd/os_linuxbsd.cpp:772
    #15 0x26771ab in main platform/linuxbsd/godot_linuxbsd.cpp:72
    #16 0x7efcaa43cd8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

SUMMARY: AddressSanitizer: negative-size-param ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:827 in __interceptor_memcpy
==63142==ABORTING

This example was found by Godot fuzzer - Qarminer, so it is quite unlikelly that this code could be used in real project, but still this should be handled gracefully.

Steps to reproduce

Above

Minimal reproduction project

No response