## Affected version
the lastest version https://github.com/LibreDWG/libredwg/tree/0.12.4.4348

## What's the problem?

A heap-buffer-overflow was discovered  in function copy_bytes  in decode_r2007.c
ASAN report:
```
=================================================================
==4110248==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7f036a28ab02 at pc 0x55f47c191f4d bp 0x7ffe1452e290 sp 0x7ffe1452e280
WRITE of size 1 at 0x7f036a28ab02 thread T0
    #0 0x55f47c191f4c in copy_bytes /libredwg/src/decode_r2007.c:228
    #1 0x55f47c1984e0 in decompress_r2007 /libredwg/src/decode_r2007.c:550
    #2 0x55f47c19939f in read_data_page /libredwg/src/decode_r2007.c:730
    #3 0x55f47c199f5d in read_data_section /libredwg/src/decode_r2007.c:820
    #4 0x55f47c1a44b5 in read_2007_section_handles /libredwg/src/decode_r2007.c:1639
    #5 0x55f47c1f2f3d in read_r2007_meta_data /libredwg/src/decode_r2007.c:2395
    #6 0x55f47b74f4b1 in decode_R2007 /libredwg/src/decode.c:3843
    #7 0x55f47b653ebb in dwg_decode /libredwg/src/decode.c:248
    #8 0x55f47b62a3e2 in dwg_read_file /libredwg/src/dwg.c:254
    #9 0x55f47b625af0 in main /libredwg/programs/dwg2SVG.c:975
    #10 0x7f036cedb0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
    #11 0x55f47b61cc0d in _start (/libredwg/fuzz/asan+0x209c0d)

0x7f036a28ab02 is located 0 bytes to the right of 197378-byte region [0x7f036a25a800,0x7f036a28ab02)
allocated by thread T0 here:
    #0 0x7f036d302dc6 in calloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10ddc6)
    #1 0x55f47c1996cc in read_data_section /libredwg/src/decode_r2007.c:776
    #2 0x55f47c1a44b5 in read_2007_section_handles /libredwg/src/decode_r2007.c:1639
    #3 0x55f47c1f2f3d in read_r2007_meta_data /libredwg/src/decode_r2007.c:2395
    #4 0x55f47b74f4b1 in decode_R2007 /libredwg/src/decode.c:3843
    #5 0x55f47b653ebb in dwg_decode /libredwg/src/decode.c:248
    #6 0x55f47b62a3e2 in dwg_read_file /libredwg/src/dwg.c:254
    #7 0x55f47b625af0 in main /libredwg/programs/dwg2SVG.c:975
    #8 0x7f036cedb0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)

SUMMARY: AddressSanitizer: heap-buffer-overflow /libredwg/src/decode_r2007.c:228 in copy_bytes
Shadow bytes around the buggy address:
  0x0fe0ed449510: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fe0ed449520: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fe0ed449530: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fe0ed449540: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fe0ed449550: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0fe0ed449560:[02]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0fe0ed449570: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0fe0ed449580: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0fe0ed449590: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0fe0ed4495a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0fe0ed4495b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==4110248==ABORTING


```
## Compile command

CC="afl-clang-lto" CFLAGS="-g -fsanitize=address" ./configure --enable-release --disable-shared && make

## How can we reproduce the issue?

./dwg2SVG [poc]

POC file:
[id_000001,sig_06,src_007112,time_55136584,op_flip4,pos_64098.zip](https://github.com/LibreDWG/libredwg/files/7074994/id_000001.sig_06.src_007112.time_55136584.op_flip4.pos_64098.zip)



A heap-buffer-overflow in function copy_bytes  in decode_r2007.c
This is a GitHub Issue
repo:libredwg
owner:LibreDWG
Title : A heap-buffer-overflow in function copy_bytes  in decode_r2007.c
Issue date:

--- start body ---
## Affected version
the lastest version https://github.com/LibreDWG/libredwg/tree/0.12.4.4348

## What's the problem?

A heap-buffer-overflow was discovered  in function copy_bytes  in decode_r2007.c
ASAN report:
```
=================================================================
==4110248==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7f036a28ab02 at pc 0x55f47c191f4d bp 0x7ffe1452e290 sp 0x7ffe1452e280
WRITE of size 1 at 0x7f036a28ab02 thread T0
    #0 0x55f47c191f4c in copy_bytes /libredwg/src/decode_r2007.c:228
    #1 0x55f47c1984e0 in decompress_r2007 /libredwg/src/decode_r2007.c:550
    #2 0x55f47c19939f in read_data_page /libredwg/src/decode_r2007.c:730
    #3 0x55f47c199f5d in read_data_section /libredwg/src/decode_r2007.c:820
    #4 0x55f47c1a44b5 in read_2007_section_handles /libredwg/src/decode_r2007.c:1639
    #5 0x55f47c1f2f3d in read_r2007_meta_data /libredwg/src/decode_r2007.c:2395
    #6 0x55f47b74f4b1 in decode_R2007 /libredwg/src/decode.c:3843
    #7 0x55f47b653ebb in dwg_decode /libredwg/src/decode.c:248
    #8 0x55f47b62a3e2 in dwg_read_file /libredwg/src/dwg.c:254
    #9 0x55f47b625af0 in main /libredwg/programs/dwg2SVG.c:975
    #10 0x7f036cedb0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
    #11 0x55f47b61cc0d in _start (/libredwg/fuzz/asan+0x209c0d)

0x7f036a28ab02 is located 0 bytes to the right of 197378-byte region [0x7f036a25a800,0x7f036a28ab02)
allocated by thread T0 here:
    #0 0x7f036d302dc6 in calloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10ddc6)
    #1 0x55f47c1996cc in read_data_section /libredwg/src/decode_r2007.c:776
    #2 0x55f47c1a44b5 in read_2007_section_handles /libredwg/src/decode_r2007.c:1639
    #3 0x55f47c1f2f3d in read_r2007_meta_data /libredwg/src/decode_r2007.c:2395
    #4 0x55f47b74f4b1 in decode_R2007 /libredwg/src/decode.c:3843
    #5 0x55f47b653ebb in dwg_decode /libredwg/src/decode.c:248
    #6 0x55f47b62a3e2 in dwg_read_file /libredwg/src/dwg.c:254
    #7 0x55f47b625af0 in main /libredwg/programs/dwg2SVG.c:975
    #8 0x7f036cedb0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)

SUMMARY: AddressSanitizer: heap-buffer-overflow /libredwg/src/decode_r2007.c:228 in copy_bytes
Shadow bytes around the buggy address:
  0x0fe0ed449510: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fe0ed449520: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fe0ed449530: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fe0ed449540: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fe0ed449550: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0fe0ed449560:[02]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0fe0ed449570: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0fe0ed449580: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0fe0ed449590: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0fe0ed4495a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0fe0ed4495b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==4110248==ABORTING


```
## Compile command

CC="afl-clang-lto" CFLAGS="-g -fsanitize=address" ./configure --enable-release --disable-shared && make

## How can we reproduce the issue?

./dwg2SVG [poc]

POC file:
[id_000001,sig_06,src_007112,time_55136584,op_flip4,pos_64098.zip](https://github.com/LibreDWG/libredwg/files/7074994/id_000001.sig_06.src_007112.time_55136584.op_flip4.pos_64098.zip)



--- end body ---

A heap-buffer-overflow vulnerability in the function copy_bytes in decode_r2007.c of LibreDWG version 0.12.4.4348 allows attackers to potentially exploit the application by providing specially crafted DWG files, leading to memory corruption and application crashes.