A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10 via read_2004_section_revhistory ../../src/decode.c:3051.
Hi,
After fuzzing libredwg, I found the following bugs on the latest commit on master.
Command: ./dwgbmp $PoC

**1.NULL pointer dereference in read_2004_compressed_section ../../src/decode.c:2417**
POC: https://github.com/linhlhq/research/blob/master/PoCs/libreDWG_4c26d37/id:000012%2Csig:06%2Csrc:002489%2Cop:havoc%2Crep:16
```
=================================================================
==20486==ERROR: AddressSanitizer: SEGV on unknown address 0x62904165558b (pc 0x7fa1bce115c5 bp 0x7fff8e06b350 sp 0x7fff8e06aab8 T0)
==20486==The signal is caused by a READ memory access.
    #0 0x7fa1bce115c4  (/lib/x86_64-linux-gnu/libc.so.6+0xbb5c4)
    #1 0x7fa1bd55e6ce  (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x796ce)
    #2 0x5634364fc7b6 in memcpy /usr/include/x86_64-linux-gnu/bits/string_fortified.h:34
    #3 0x5634364fc7b6 in read_2004_compressed_section ../../src/decode.c:2417
    #4 0x563436ac5dd2 in read_2004_section_summary ../../src/decode.c:2785
    #5 0x563436ac5dd2 in decode_R2004 ../../src/decode.c:3352
    #6 0x563436ad208d in dwg_decode ../../src/decode.c:246
    #7 0x563436464fae in dwg_read_file ../../src/dwg.c:211
    #8 0x5634364639d0 in get_bmp ../../programs/dwgbmp.c:111
    #9 0x563436463066 in main ../../programs/dwgbmp.c:280
    #10 0x7fa1bcd77b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
    #11 0x5634364636c9 in _start (/home/user/linhlhq/libredwg/asan_build/programs/dwgbmp+0x28f6c9)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/lib/x86_64-linux-gnu/libc.so.6+0xbb5c4)
```
Several bugs found by fuzzing
This is a GitHub Issue
repo:libredwg
owner:LibreDWG
Title : Several bugs found by fuzzing
Issue date:

--- start body ---
Hi,
After fuzzing libredwg, I found the following bugs on the latest commit on master.
Command: ./dwgbmp $PoC

**1.NULL pointer dereference in read_2004_compressed_section ../../src/decode.c:2417**
POC: https://github.com/linhlhq/research/blob/master/PoCs/libreDWG_4c26d37/id:000012%2Csig:06%2Csrc:002489%2Cop:havoc%2Crep:16
```
=================================================================
==20486==ERROR: AddressSanitizer: SEGV on unknown address 0x62904165558b (pc 0x7fa1bce115c5 bp 0x7fff8e06b350 sp 0x7fff8e06aab8 T0)
==20486==The signal is caused by a READ memory access.
    #0 0x7fa1bce115c4  (/lib/x86_64-linux-gnu/libc.so.6+0xbb5c4)
    #1 0x7fa1bd55e6ce  (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x796ce)
    #2 0x5634364fc7b6 in memcpy /usr/include/x86_64-linux-gnu/bits/string_fortified.h:34
    #3 0x5634364fc7b6 in read_2004_compressed_section ../../src/decode.c:2417
    #4 0x563436ac5dd2 in read_2004_section_summary ../../src/decode.c:2785
    #5 0x563436ac5dd2 in decode_R2004 ../../src/decode.c:3352
    #6 0x563436ad208d in dwg_decode ../../src/decode.c:246
    #7 0x563436464fae in dwg_read_file ../../src/dwg.c:211
    #8 0x5634364639d0 in get_bmp ../../programs/dwgbmp.c:111
    #9 0x563436463066 in main ../../programs/dwgbmp.c:280
    #10 0x7fa1bcd77b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
    #11 0x5634364636c9 in _start (/home/user/linhlhq/libredwg/asan_build/programs/dwgbmp+0x28f6c9)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/lib/x86_64-linux-gnu/libc.so.6+0xbb5c4)
```
--- end body ---
