CVE-2026-62250: LibreDWG: unbounded allocation in pre-R13 DWG entity decoding

LibreDWG is a free C library to read and write DWG files. Prior to 0.14.8413, a crafted pre-R13 DWG can make decodepreR13entities() in src/decode.c enter a nonterminating loop that allocates a new object each iteration. decodepreR13 in src/decoder11.c computes size from the raw file-controlled entitiesstart and entitiesend header bounds; the callee clamps end to dat->size but never recalculates size. At end of input, bitreadRC and bitreadRS stop advancing dat->byte, the overflow guard fails because end equals dat->size, and the no-advance check compares against oldpos saved before the loop instead of the previous iteration. This leaves repeated allocation of dwg->object entries until allocation fails or the process is OOM-killed, not merely a constant-memory CPU hang. The defect remains after the clamping and no-progress changes associated with the earlier issue 1131. Applications and tools calling dwgreadfile() on untrusted files, including dwg2dxf, dwgread and dwg2svg, can suffer denial of service when a user or automated pipeline opens a malformed file; no attacker credentials are required. This issue is fixed in repository nightly version 0.14.8413.