CVE-2023-36273

LibreDWG is a free C library to read and write DWG files. Prior to 0.14, a specially crafted R13-R2000 DWG can trigger algorithmic resource exhaustion in decode_R13_R2000 in src/decode.c. The class-decoding loop performs realloc on every iteration without a sanity check on num_classes; manipulating that field forces an extremely slow allocation loop and denial of service when the file is parsed. Running the parser in a sandbox with memory limits is a workaround rather than a remediation. This issue is fixed in version 0.14.

LibreDWG is a free C library to read and write DWG files. Prior to 0.14.8413, a crafted pre-R13 DWG can make decode_preR13_entities() in src/decode.c enter a nonterminating loop that allocates a new object each iteration. decode_preR13 in src/decode_r11.c computes size from the raw file-controlled entities_start and entities_end header bounds; the callee clamps end to dat->size but never recalculates size. At end of input, bit_read_RC and bit_read_RS stop advancing dat->byte, the overflow guard fails, and the no-advance check compares against oldpos saved before the loop. This leaves repeated allocation of dwg->object entries until allocation fails or the process is OOM-killed. The defect is fixed in version 0.14.8413.

LibreDWG is a free C library to read and write DWG files. Prior to 0.14, `bit_TV_to_utf8()` in `src/bits.c` can write to the caller-provided `src` buffer despite accepting const input. On an `iconv()` error other than `E2BIG`, the function frees its output buffer and passes the original input alias to `bit_u_expand()`, which can cause a segmentation fault and denial of service or unexpected modification of mutable input.

LibreDWG versions 0.11 to 0.12.5 were found to contain a heap buffer overflow in the function bit_write_TF in bits.c.

Versions of LibreDWG from 0.10 to 0.12.5 were found to contain a heap buffer overflow vulnerability in the function bit_utf8_to_TU in bits.c.

LibreDWG versions 0.10 to 0.12.5 were found to contain a heap buffer overflow in the function bit_wcs2nlen at bits.c.