copyimage: check requested slice early when cube maps are involved

The generalized check for the z-slice happens in 'check_region_bounds',
but this function requires the image pointer that is acquired in
`prepare_target_err`, therefore replace the assertion with a proper test.

v2: Also check for negative value (Brian Paul)

CC: mesa-stable

Signed-off-by: Gert Wollny <gert.wollny@collabora.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/25507>

src/mesa/main/copyimage.c

@@ -239,7 +239,11 @@ prepare_target_err(struct gl_context *ctx, GLuint name, GLenum target,
       if (target == GL_TEXTURE_CUBE_MAP) {
          int i;
 
-         assert(z < MAX_FACES);  /* should have been caught earlier */
+         if (z < 0 || z >= MAX_FACES) {
+            _mesa_error(ctx, GL_INVALID_VALUE,
+                        "glCopyImageSubData(cube face (%sZ = %d)", dbg_prefix, z);
+            return false;
+         }
 
          /* make sure all the cube faces are present */
          for (i = 0; i < depth; i++) {