Heap buffer overflow vulnerability in LibreDWG versions v0.13.3.7571 up to v0.13.3.7835 allows a crafted DWG file to cause a Denial of Service (DoS) via the function decompressR2004section at decode.c.

LibreDWG is a free C library to read and write DWG files. Prior to 0.14, a specially crafted R13-R2000 DWG can trigger algorithmic resource exhaustion in decodeR13R2000 in src/decode.c. The class-decoding loop performs realloc on every iteration without a sanity check on numclasses. Manipulating that field forces an extremely slow allocation loop and denial of service when the file is parsed. Running the parser in a sandbox with memory limits is a workaround rather than a remediation. This issue is fixed in version 0.14.

LibreDWG is a free C library to read and write DWG files. Prior to 0.14.8413, a crafted pre-R13 DWG can make decodepreR13entities() in src/decode.c enter a nonterminating loop that allocates a new object each iteration. decodepreR13 in src/decoder11.c computes size from the raw file-controlled entitiesstart and entitiesend header bounds; the callee clamps end to dat->size but never recalculates size. At end of input, bitreadRC and bitreadRS stop advancing dat->byte, the overflow guard fails because end equals dat->size, and the no-advance check compares against oldpos saved before the loop instead of the previous iteration. This leaves repeated allocation of dwg->object entries until allocation fails or the process is OOM-killed, not merely a constant-memory CPU hang. The defect remains after the clamping and no-progress changes associated with the earlier issue 1131. Applications and tools calling dwgreadfile() on untrusted files, including dwg2dxf, dwgread and dwg2svg, can suffer denial of service when a user or automated pipeline opens a malformed file; no attacker credentials are required. This issue is fixed in repository nightly version 0.14.8413.

LibreDWG is a free C library to read and write DWG files. Prior to 0.14, a specially crafted R13-R2000 DWG can trigger algorithmic resource exhaustion in decodeR13R2000 in src/decode.c. The class-decoding loop performs realloc on every iteration without a sanity check on numclasses. Manipulating that field forces an extremely slow allocation loop and denial of service when the file is parsed. Running the parser in a sandbox with memory limits is a workaround rather than a remediation. This issue is fixed in version 0.14.

LibreDWG is a free C library to read and write DWG files. Prior to 0.14.8413, a crafted pre-R13 DWG can make decodepreR13entities() in src/decode.c enter a nonterminating loop that allocates a new object each iteration. decodepreR13 in src/decoder11.c computes size from the raw file-controlled entitiesstart and entitiesend header bounds; the callee clamps end to dat->size but never recalculates size. At end of input, bitreadRC and bitreadRS stop advancing dat->byte, the overflow guard fails because end equals dat->size, and the no-advance check compares against oldpos saved before the loop instead of the previous iteration. This leaves repeated allocation of dwg->object entries until allocation fails or the process is OOM-killed, not merely a constant-memory CPU hang. The defect remains after the clamping and no-progress changes associated with the earlier issue 1131. Applications and tools calling dwgreadfile() on untrusted files, including dwg2dxf, dwgread and dwg2svg, can suffer denial of service when a user or automated pipeline opens a malformed file; no attacker credentials are required. This issue is fixed in repository nightly version 0.14.8413.

LibreDWG is a free C library to read and write DWG files. Prior to 0.14, bitTVtoutf8() in src/bits.c can write to the caller-provided src buffer despite accepting const input. On an iconv() error other than E2BIG, the function frees its output buffer and passes the original input alias to bituexpand(), which expands or shrinks Unicode and multibyte escape sequences in place. If the input is a string literal, read-only mapping, or other immutable buffer, the write can cause a segmentation fault and denial of service; mutable caller-owned input can be unexpectedly modified before being returned. This affects applications that expose the conversion API to untrusted input under those conditions. Direct file-triggered exploitability through normal DWG decode/export paths remains unconfirmed because many TV strings are heap allocated by bitreadTV(). This issue is fixed in version 0.14.

LibreDWG is a free C library to read and write DWG files. Prior to 0.14, bitTVtoutf8() in src/bits.c can write to the caller-provided src buffer despite accepting const input. On an iconv() error other than E2BIG, the function frees its output buffer and passes the original input alias to bituexpand(), which expands or shrinks Unicode and multibyte escape sequences in place. If the input is a string literal, read-only mapping, or other immutable buffer, the write can cause a segmentation fault and denial of service; mutable caller-owned input can be unexpectedly modified before being returned. This affects applications that expose the conversion API to untrusted input under those conditions. Direct file-triggered exploitability through normal DWG decode/export paths remains unconfirmed because many TV strings are heap allocated by bitreadTV(). This issue is fixed in version 0.14.