A heap based buffer overflow issue exists in GNU LibreDWG 0.10.2641 via htmlwescape ../../programs/escape.c:97.
Hi,
After fuzzing libredwg, I found the following bugs on the latest commit on master.
Command: ./dwg2SVG $PoC
**1.NULL pointer dereference in htmlescape ../../programs/escape.c:29**
POC: https://github.com/linhlhq/research/blob/master/PoCs/libreDWG_7b9cb829/id:000013%2Csig:06%2Csrc:000000%2Cop:flip1%2Cpos:46417
ASAN says:
```
=================================================================
==19607==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f433bb56646 bp 0x7ffed1176670 sp 0x7ffed1175de8 T0)
==19607==The signal is caused by a READ memory access.
==19607==Hint: address points to the zero page.
    #0 0x7f433bb56645  (/lib/x86_64-linux-gnu/libc.so.6+0xb1645)
    #1 0x7f433c28557b  (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x5157b)
    #2 0x55950b27cdd4 in htmlescape ../../programs/escape.c:29
    #3 0x55950b27abb5 in output_TEXT ../../programs/dwg2SVG.c:113
    #4 0x55950b27abb5 in output_object ../../programs/dwg2SVG.c:312
    #5 0x55950b27abb5 in output_BLOCK_HEADER ../../programs/dwg2SVG.c:371
    #6 0x55950b278477 in output_SVG ../../programs/dwg2SVG.c:411
    #7 0x55950b278477 in main ../../programs/dwg2SVG.c:525
    #8 0x7f433bac6b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
    #9 0x55950b278d19 in _start (/home/user/linhlhq/libredwg/asan_build/programs/dwg2SVG+0x27ad19)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/lib/x86_64-linux-gnu/libc.so.6+0xb1645)
==19607==ABORTING
```
Several bugs found by fuzzing
This is a GitHub Issue
repo:libredwg
owner:LibreDWG
Title : Several bugs found by fuzzing
Issue date:

--- start body ---
Hi,
After fuzzing libredwg, I found the following bugs on the latest commit on master.
Command: ./dwg2SVG $PoC
**1.NULL pointer dereference in htmlescape ../../programs/escape.c:29**
POC: https://github.com/linhlhq/research/blob/master/PoCs/libreDWG_7b9cb829/id:000013%2Csig:06%2Csrc:000000%2Cop:flip1%2Cpos:46417
ASAN says:
```
=================================================================
==19607==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f433bb56646 bp 0x7ffed1176670 sp 0x7ffed1175de8 T0)
==19607==The signal is caused by a READ memory access.
==19607==Hint: address points to the zero page.
    #0 0x7f433bb56645  (/lib/x86_64-linux-gnu/libc.so.6+0xb1645)
    #1 0x7f433c28557b  (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x5157b)
    #2 0x55950b27cdd4 in htmlescape ../../programs/escape.c:29
    #3 0x55950b27abb5 in output_TEXT ../../programs/dwg2SVG.c:113
    #4 0x55950b27abb5 in output_object ../../programs/dwg2SVG.c:312
    #5 0x55950b27abb5 in output_BLOCK_HEADER ../../programs/dwg2SVG.c:371
    #6 0x55950b278477 in output_SVG ../../programs/dwg2SVG.c:411
    #7 0x55950b278477 in main ../../programs/dwg2SVG.c:525
    #8 0x7f433bac6b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
    #9 0x55950b278d19 in _start (/home/user/linhlhq/libredwg/asan_build/programs/dwg2SVG+0x27ad19)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/lib/x86_64-linux-gnu/libc.so.6+0xb1645)
==19607==ABORTING
```
--- end body ---

A NULL pointer dereference vulnerability in the htmlescape function of LibreDWG can lead to a segmentation fault when processing specially crafted DWG files. This issue was identified through fuzz testing, indicating that the application does not properly handle null pointers, which could be exploited to crash the application or potentially execute arbitrary code.