# Description   

heap-buffer-overflow in function decode_preR13_section_chk at decode_r11.c:225

# Version
```
git log
commit d11e3c5b1c003174072732e1b2276b793af5dac8 (HEAD -> master, tag: 0.12.5.5028, origin/smoke/some_mc0_support, origin/master, origin/HEAD)
Author: Reini Urban <rurban@cpan.org>
Date:   Mon Jan 30 08:59:21 2023 +0100

```

# Steps to reproduce

```
apt install jing libjaxp1.3-java libbatik-java libavalon-framework-java

git clone https://github.com/LibreDWG/libredwg.git

export CFLAGS="-g -O0 -lpthread -fsanitize=address"
export CXXFLAGS="-g -O0 -lpthread -fsanitize=address"
export LDFLAGS="-fsanitize=address"

cd libredwg
sh ./autogen.sh
./configure --enable-release --enable-trace --disable-shared
make -j
```

```
cd programs
./dwg2dxf -b -m ./poc_hbo02.bin -o /dev/null
Reading DWG file ./poc_hbo02.bin
=================================================================
==1717723==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x618000000404 at pc 0x000000a6e9ce bp 0x7fffffffbb60 sp 0x7fffffffbb58
READ of size 4 at 0x618000000404 thread T0
    #0 0xa6e9cd in decode_preR13_section_chk /home/fuzz/libredwg/src/decode_r11.c:225:3
    #1 0xa4386e in decode_preR13 /home/fuzz/libredwg/src/decode_r11.c:966:7
    #2 0x515eae in dwg_decode /home/fuzz/libredwg/src/decode.c:217:17
    #3 0x4ce9c3 in dwg_read_file /home/fuzz/libredwg/src/dwg.c:255:11
    #4 0x4cb903 in main /home/fuzz/libredwg/programs/dwg2dxf.c:258:15
    #5 0x7ffff7c49082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16
    #6 0x41d4bd in _start (/home/fuzz/libredwg/programs/dwg2dxf+0x41d4bd)

0x618000000404 is located 4 bytes to the right of 896-byte region [0x618000000080,0x618000000400)
allocated by thread T0 here:
    #0 0x498892 in calloc (/home/fuzz/libredwg/programs/dwg2dxf+0x498892)
    #1 0x4efea5 in dwg_sections_init /home/fuzz/libredwg/src/dwg.c:3123:42
    #2 0xd1ac10 in dwg_add_Document /home/fuzz/libredwg/src/dwg_api.c:22109:11
    #3 0xa4002e in decode_preR13 /home/fuzz/libredwg/src/decode_r11.c:721:12
    #4 0x515eae in dwg_decode /home/fuzz/libredwg/src/decode.c:217:17
    #5 0x4ce9c3 in dwg_read_file /home/fuzz/libredwg/src/dwg.c:255:11
    #6 0x4cb903 in main /home/fuzz/libredwg/programs/dwg2dxf.c:258:15
    #7 0x7ffff7c49082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/fuzz/libredwg/src/decode_r11.c:225:3 in decode_preR13_section_chk
Shadow bytes around the buggy address:
  0x0c307fff8030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c307fff8040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c307fff8050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c307fff8060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c307fff8070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c307fff8080:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c307fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c307fff80a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c307fff80b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c307fff80c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c307fff80d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==1717723==ABORTING
```

# POC

[poc_hbo02.bin](https://github.com/JieyongMa/poc/raw/main/libredwg/poc_hbo02.bin)


# Impact
This vulnerability is capable of crashing software, bypass protection mechanism, modify of memory, and successful exploitation may lead to code execution.
 

heap-buffer-overflow in function decode_preR13_section_chk at decode_r11.c:225
This is a GitHub Issue
repo:libredwg
owner:LibreDWG
Title : heap-buffer-overflow in function decode_preR13_section_chk at decode_r11.c:225
Issue date:

--- start body ---
# Description   

heap-buffer-overflow in function decode_preR13_section_chk at decode_r11.c:225

# Version
```
git log
commit d11e3c5b1c003174072732e1b2276b793af5dac8 (HEAD -> master, tag: 0.12.5.5028, origin/smoke/some_mc0_support, origin/master, origin/HEAD)
Author: Reini Urban <rurban@cpan.org>
Date:   Mon Jan 30 08:59:21 2023 +0100

```

# Steps to reproduce

```
apt install jing libjaxp1.3-java libbatik-java libavalon-framework-java

git clone https://github.com/LibreDWG/libredwg.git

export CFLAGS="-g -O0 -lpthread -fsanitize=address"
export CXXFLAGS="-g -O0 -lpthread -fsanitize=address"
export LDFLAGS="-fsanitize=address"

cd libredwg
sh ./autogen.sh
./configure --enable-release --enable-trace --disable-shared
make -j
```

```
cd programs
./dwg2dxf -b -m ./poc_hbo02.bin -o /dev/null
Reading DWG file ./poc_hbo02.bin
=================================================================
==1717723==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x618000000404 at pc 0x000000a6e9ce bp 0x7fffffffbb60 sp 0x7fffffffbb58
READ of size 4 at 0x618000000404 thread T0
    #0 0xa6e9cd in decode_preR13_section_chk /home/fuzz/libredwg/src/decode_r11.c:225:3
    #1 0xa4386e in decode_preR13 /home/fuzz/libredwg/src/decode_r11.c:966:7
    #2 0x515eae in dwg_decode /home/fuzz/libredwg/src/decode.c:217:17
    #3 0x4ce9c3 in dwg_read_file /home/fuzz/libredwg/src/dwg.c:255:11
    #4 0x4cb903 in main /home/fuzz/libredwg/programs/dwg2dxf.c:258:15
    #5 0x7ffff7c49082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16
    #6 0x41d4bd in _start (/home/fuzz/libredwg/programs/dwg2dxf+0x41d4bd)

0x618000000404 is located 4 bytes to the right of 896-byte region [0x618000000080,0x618000000400)
allocated by thread T0 here:
    #0 0x498892 in calloc (/home/fuzz/libredwg/programs/dwg2dxf+0x498892)
    #1 0x4efea5 in dwg_sections_init /home/fuzz/libredwg/src/dwg.c:3123:42
    #2 0xd1ac10 in dwg_add_Document /home/fuzz/libredwg/src/dwg_api.c:22109:11
    #3 0xa4002e in decode_preR13 /home/fuzz/libredwg/src/decode_r11.c:721:12
    #4 0x515eae in dwg_decode /home/fuzz/libredwg/src/decode.c:217:17
    #5 0x4ce9c3 in dwg_read_file /home/fuzz/libredwg/src/dwg.c:255:11
    #6 0x4cb903 in main /home/fuzz/libredwg/programs/dwg2dxf.c:258:15
    #7 0x7ffff7c49082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/fuzz/libredwg/src/decode_r11.c:225:3 in decode_preR13_section_chk
Shadow bytes around the buggy address:
  0x0c307fff8030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c307fff8040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c307fff8050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c307fff8060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c307fff8070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c307fff8080:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c307fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c307fff80a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c307fff80b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c307fff80c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c307fff80d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==1717723==ABORTING
```

# POC

[poc_hbo02.bin](https://github.com/JieyongMa/poc/raw/main/libredwg/poc_hbo02.bin)


# Impact
This vulnerability is capable of crashing software, bypass protection mechanism, modify of memory, and successful exploitation may lead to code execution.
 

--- end body ---
