## Affected version 

[the latest commit](https://github.com/LibreDWG/libredwg/commit/4c210bbae04957b7d4aba55aee8dca42337f8d47) and 0.12.4

## What's the problem?


A heap buffer overflow was discovered in dwg_section_wtype in dwg.c:1663.

ASAN report:

```
./dwgread ./tests_64206
=================================================================
==9487==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffd7f8d5f78 at pc 0x0000004ce5e4 bp 0x7ffd7f8d5f30 sp 0x7ffd7f8d5f28
WRITE of size 1 at 0x7ffd7f8d5f78 thread T0
    #0 0x4ce5e3 in dwg_section_wtype /root/fuzz/libredwg/src/dwg.c:1663:17
    #1 0xc85dfc in read_sections_map /root/fuzz/libredwg/src/decode_r2007.c:966:23
    #2 0xc83bd6 in read_r2007_meta_data /root/fuzz/libredwg/src/decode_r2007.c:2367:18
    #3 0x4f9fcc in decode_R2007 /root/fuzz/libredwg/src/decode.c:3836:11
    #4 0x4e49ab in dwg_decode /root/fuzz/libredwg/src/decode.c:248:29
    #5 0x4c75cc in dwg_read_file /root/fuzz/libredwg/src/dwg.c:254:11
    #6 0x4c5d47 in main /root/fuzz/libredwg/programs/dwgread.c
    #7 0x7f3d92d0483f in __libc_start_main /build/glibc-S7Ft5T/glibc-2.23/csu/../csu/libc-start.c:291
    #8 0x41ba58 in _start (/root/fuzz/pocs/dwgread+0x41ba58)

Address 0x7ffd7f8d5f78 is located in stack of thread T0 at offset 56 in frame
    #0 0x4ce3ef in dwg_section_wtype /root/fuzz/libredwg/src/dwg.c:1652

  This frame has 1 object(s):
    [32, 56) 'name' (line 1654) <== Memory access at offset 56 overflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow /root/fuzz/libredwg/src/dwg.c:1663:17 in dwg_section_wtype
Shadow bytes around the buggy address:
  0x10002ff12b90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10002ff12ba0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10002ff12bb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10002ff12bc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10002ff12bd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x10002ff12be0: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00[f3]
  0x10002ff12bf0: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00
  0x10002ff12c00: 00 00 00 00 f1 f1 f1 f1 00 f3 f3 f3 00 00 00 00
  0x10002ff12c10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10002ff12c20: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00
  0x10002ff12c30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==9487==ABORTING
```


## Compile command

```
CC="clang" CFLAGS="-O1 -g -fsanitize=address" ./configure --enable-release --disable-shared && make
```

## How can we reproduce the issue?

```
unzip tests_64206.zip
dwgread ./tests_64206
```
POC file :  [tests_64206.zip](https://github.com/LibreDWG/libredwg/files/6606924/tests_64206.zip)

stack-buffer-overflow in dwg_section_wtype in dwg.c:1663
This is a GitHub Issue
repo:libredwg
owner:LibreDWG
Title : stack-buffer-overflow in dwg_section_wtype in dwg.c:1663
Issue date:

--- start body ---
## Affected version 

[the latest commit](https://github.com/LibreDWG/libredwg/commit/4c210bbae04957b7d4aba55aee8dca42337f8d47) and 0.12.4

## What's the problem?


A heap buffer overflow was discovered in dwg_section_wtype in dwg.c:1663.

ASAN report:

```
./dwgread ./tests_64206
=================================================================
==9487==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffd7f8d5f78 at pc 0x0000004ce5e4 bp 0x7ffd7f8d5f30 sp 0x7ffd7f8d5f28
WRITE of size 1 at 0x7ffd7f8d5f78 thread T0
    #0 0x4ce5e3 in dwg_section_wtype /root/fuzz/libredwg/src/dwg.c:1663:17
    #1 0xc85dfc in read_sections_map /root/fuzz/libredwg/src/decode_r2007.c:966:23
    #2 0xc83bd6 in read_r2007_meta_data /root/fuzz/libredwg/src/decode_r2007.c:2367:18
    #3 0x4f9fcc in decode_R2007 /root/fuzz/libredwg/src/decode.c:3836:11
    #4 0x4e49ab in dwg_decode /root/fuzz/libredwg/src/decode.c:248:29
    #5 0x4c75cc in dwg_read_file /root/fuzz/libredwg/src/dwg.c:254:11
    #6 0x4c5d47 in main /root/fuzz/libredwg/programs/dwgread.c
    #7 0x7f3d92d0483f in __libc_start_main /build/glibc-S7Ft5T/glibc-2.23/csu/../csu/libc-start.c:291
    #8 0x41ba58 in _start (/root/fuzz/pocs/dwgread+0x41ba58)

Address 0x7ffd7f8d5f78 is located in stack of thread T0 at offset 56 in frame
    #0 0x4ce3ef in dwg_section_wtype /root/fuzz/libredwg/src/dwg.c:1652

  This frame has 1 object(s):
    [32, 56) 'name' (line 1654) <== Memory access at offset 56 overflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow /root/fuzz/libredwg/src/dwg.c:1663:17 in dwg_section_wtype
Shadow bytes around the buggy address:
  0x10002ff12b90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10002ff12ba0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10002ff12bb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10002ff12bc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10002ff12bd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x10002ff12be0: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00[f3]
  0x10002ff12bf0: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00
  0x10002ff12c00: 00 00 00 00 f1 f1 f1 f1 00 f3 f3 f3 00 00 00 00
  0x10002ff12c10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10002ff12c20: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00
  0x10002ff12c30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==9487==ABORTING
```


## Compile command

```
CC="clang" CFLAGS="-O1 -g -fsanitize=address" ./configure --enable-release --disable-shared && make
```

## How can we reproduce the issue?

```
unzip tests_64206.zip
dwgread ./tests_64206
```
POC file :  [tests_64206.zip](https://github.com/LibreDWG/libredwg/files/6606924/tests_64206.zip)

--- end body ---

A stack buffer overflow vulnerability was discovered in the function dwg_section_wtype in dwg.c at line 1663 of LibreDWG. This vulnerability can be exploited by providing a specially crafted DWG file, leading to potential arbitrary code execution or denial of service. The AddressSanitizer report indicates that the overflow occurs when writing beyond the allocated stack memory for the variable 'name'.