LibreDWG Heap Buffer Overflow Vulnerability Allowing Denial-of-Service

A heap buffer overflow vulnerability has been identified in LibreDWG versions 0.13.3.7571 prior to 0.13.3.7835. This vulnerability allows a crafted DWG file to cause a denial-of-service condition by triggering a segmentation fault in the application. The issue arises in the 'decompress_R2004_section' function within 'src/decode.c', where improper handling of data can lead to memory corruption and application crashes.

Impact

Exploitation of this vulnerability leads to a segmentation fault, causing a denial-of-service condition by crashing the application.

Reproduction

The vulnerability can be reproduced by compiling LibreDWG with the normal configuration or with a release flag enabled. After compiling, the 'dwgread' program can be run with a crafted DWG file that triggers the buffer overflow. The crash can be verified using AddressSanitizer, which will report a heap-buffer-overflow error.