Fix a crash in the TGA loader with malformed input

[hpvb]

Version for master.

[hpvb]

Thanks a lot to Carlos Ramirez Catano for reporting this bug. Attached are the files that show the issue.
poc-input.zip

[akien-mga]

Thanks!

[CarlosAndresRamirez]

Thank you guys for the quick response. This issue needed immediate attention.
Keep up the good work.

[akien-mga]

For the reference, the bug fixed by this PR was assigned those two CVEs:

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26825
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26826

[CarlosAndresRamirez]

Hello @hpvb @akien-mga
As Godot Engine is a leading open source project for game development, I was thinking it would be appropriate to provide some additional assurance to the community regarding quality and security best practices of the project. Recently, this is a key factor for companies/development teams when choosing their technology stack.

As an initial step the project could adopt something like https://securitytxt.org, do and document security reviews and other activities.

What do you think?
I am myself willing to support these initiatives.
Looking forward to hear your thoughts.

[Calinou]

@CarlosAndresRamirez As an update, we deployed security.txt on the Godot website: godotengine/godot-website#332

We're also adding a dedicated security contact email: godotengine/godot-website#365