LibreDWG: unbounded allocation in pre-R13 DWG entity decoding

Overview

LibreDWG is a free C library to read and write DWG files. Prior to 0.14.8413, a crafted pre-R13 DWG can make decode_preR13_entities() in src/decode.c enter a nonterminating loop that allocates a new object each iteration. decode_preR13 in src/decode_r11.c computes size from the raw file-controlled entities_start and entities_end header bounds; the callee clamps end to dat->size but never recalculates size. At end of input, bit_read_RC and bit_read_RS stop advancing dat->byte, the overflow guard fails because end equals dat->size, and the no-advance check compares against oldpos saved before the loop instead of the previous iteration. This leaves repeated allocation of dwg->object entries until allocation fails or the process is OOM-killed, not merely a constant-memory CPU hang. The defect remains after the clamping and no-progress changes associated with the earlier issue 1131. Applications and tools calling dwg_read_file() on untrusted files, including dwg2dxf, dwgread and dwg2svg, can suffer denial of service when a user or automated pipeline opens a malformed file; no attacker credentials are required. This issue is fixed in repository nightly version 0.14.8413.

Affected

• libredwg < 0.14.8413

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.