Hello!

I found this recently, there is a similar one currently open but the call stack is different so I am reporting.

Regards

[bit_read_RC.zip](https://github.com/LibreDWG/libredwg/files/10471135/bit_read_RC.zip)

```
./dwgread

 AddressSanitizer: heap-buffer-overflow on address 0x6220000000ff at pc 0x7ffff5e560c5 bp 0x7fffffffbf70 sp 0x7fffffffbf68
READ of size 1 at 0x6220000000ff thread T0
    #0 0x7ffff5e560c4 in bit_read_RC /home/fmunozs/fuzz/libredwg/src/bits.c:320:10
    #1 0x7ffff5e560c4 in bit_read_RS /home/fmunozs/fuzz/libredwg/src/bits.c:380:11
    #2 0x7ffff5f24b30 in decode_preR13_entities /home/fmunozs/fuzz/libredwg/src/decode.c:6251:17
    #3 0x7ffff60d3864 in decode_preR13 /home/fmunozs/fuzz/libredwg/src/decode_r11.c:873:12
    #4 0x7ffff5e7778e in dwg_decode /home/fmunozs/fuzz/libredwg/src/decode.c:213:17
    #5 0x7ffff60fb8cb in dwg_read_file /home/fmunozs/fuzz/libredwg/src/dwg.c:255:11
    #6 0x555555670e8a in main /home/fmunozs/fuzz/libredwg/programs/dwgread.c
    #7 0x7ffff598628f  (/usr/lib/libc.so.6+0x2328f) (BuildId: 1e94beb079e278ac4f2c8bce1f53091548ea1584)
    #8 0x7ffff5986349 in __libc_start_main (/usr/lib/libc.so.6+0x23349) (BuildId: 1e94beb079e278ac4f2c8bce1f53091548ea1584)
    #9 0x555555577224 in _start /build/glibc/src/glibc/csu/../sysdeps/x86_64/start.S:115

0x6220000000ff is located 1 bytes to the left of 5257-byte region [0x622000000100,0x622000001589)
allocated by thread T0 here:
    #0 0x55555562c451 in __interceptor_calloc (/home/fmunozs/fuzz/libredwg/dwgread+0xd8451) (BuildId: fe467d4f4b88476b09aa33545596727c586b1ec3)
    #1 0x7ffff60facd9 in dat_read_file /home/fmunozs/fuzz/libredwg/src/dwg.c:91:33
    #2 0x7ffff60fb798 in dwg_read_file /home/fmunozs/fuzz/libredwg/src/dwg.c:248:15
    #3 0x555555670e8a in main /home/fmunozs/fuzz/libredwg/programs/dwgread.c
    #4 0x7ffff598628f  (/usr/lib/libc.so.6+0x2328f) (BuildId: 1e94beb079e278ac4f2c8bce1f53091548ea1584)

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/fmunozs/fuzz/libredwg/src/bits.c:320:10 in bit_read_RC
Shadow bytes around the buggy address:
  0x0c447fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c447fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c447fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c447fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c447fff8000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c447fff8010: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa[fa]
  0x0c447fff8020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c447fff8030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c447fff8040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c447fff8050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c447fff8060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

``` 
AddressSanitizer: heap-buffer-overflow /libredwg/src/bits.c:320:10 in bit_read_RC
This is a GitHub Issue
repo:libredwg
owner:LibreDWG
Title : AddressSanitizer: heap-buffer-overflow /libredwg/src/bits.c:320:10 in bit_read_RC
Issue date:

--- start body ---
Hello!

I found this recently, there is a similar one currently open but the call stack is different so I am reporting.

Regards

[bit_read_RC.zip](https://github.com/LibreDWG/libredwg/files/10471135/bit_read_RC.zip)

```
./dwgread

 AddressSanitizer: heap-buffer-overflow on address 0x6220000000ff at pc 0x7ffff5e560c5 bp 0x7fffffffbf70 sp 0x7fffffffbf68
READ of size 1 at 0x6220000000ff thread T0
    #0 0x7ffff5e560c4 in bit_read_RC /home/fmunozs/fuzz/libredwg/src/bits.c:320:10
    #1 0x7ffff5e560c4 in bit_read_RS /home/fmunozs/fuzz/libredwg/src/bits.c:380:11
    #2 0x7ffff5f24b30 in decode_preR13_entities /home/fmunozs/fuzz/libredwg/src/decode.c:6251:17
    #3 0x7ffff60d3864 in decode_preR13 /home/fmunozs/fuzz/libredwg/src/decode_r11.c:873:12
    #4 0x7ffff5e7778e in dwg_decode /home/fmunozs/fuzz/libredwg/src/decode.c:213:17
    #5 0x7ffff60fb8cb in dwg_read_file /home/fmunozs/fuzz/libredwg/src/dwg.c:255:11
    #6 0x555555670e8a in main /home/fmunozs/fuzz/libredwg/programs/dwgread.c
    #7 0x7ffff598628f  (/usr/lib/libc.so.6+0x2328f) (BuildId: 1e94beb079e278ac4f2c8bce1f53091548ea1584)
    #8 0x7ffff5986349 in __libc_start_main (/usr/lib/libc.so.6+0x23349) (BuildId: 1e94beb079e278ac4f2c8bce1f53091548ea1584)
    #9 0x555555577224 in _start /build/glibc/src/glibc/csu/../sysdeps/x86_64/start.S:115

0x6220000000ff is located 1 bytes to the left of 5257-byte region [0x622000000100,0x622000001589)
allocated by thread T0 here:
    #0 0x55555562c451 in __interceptor_calloc (/home/fmunozs/fuzz/libredwg/dwgread+0xd8451) (BuildId: fe467d4f4b88476b09aa33545596727c586b1ec3)
    #1 0x7ffff60facd9 in dat_read_file /home/fmunozs/fuzz/libredwg/src/dwg.c:91:33
    #2 0x7ffff60fb798 in dwg_read_file /home/fmunozs/fuzz/libredwg/src/dwg.c:248:15
    #3 0x555555670e8a in main /home/fmunozs/fuzz/libredwg/programs/dwgread.c
    #4 0x7ffff598628f  (/usr/lib/libc.so.6+0x2328f) (BuildId: 1e94beb079e278ac4f2c8bce1f53091548ea1584)

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/fmunozs/fuzz/libredwg/src/bits.c:320:10 in bit_read_RC
Shadow bytes around the buggy address:
  0x0c447fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c447fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c447fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c447fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c447fff8000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c447fff8010: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa[fa]
  0x0c447fff8020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c447fff8030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c447fff8040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c447fff8050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c447fff8060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

``` 
--- end body ---

A heap buffer overflow vulnerability in the bit_read_RC function of LibreDWG can lead to potential memory corruption and application crashes. This issue occurs when the function attempts to read beyond the allocated memory, which can be exploited by an attacker to execute arbitrary code or cause a Denial of Service (DoS).