CVE-2019-20913 (published 2020-07-16T18:15Z)

An issue was discovered in GNU LibreDWG through 0.9.3. Crafted input will lead to a heap-based buffer over-read in dwg_encode_entity in common_entity_data.spec.

Severity: MEDIUM
CVSS v2 base score: 5.8 (AV:N/AC:M/Au:N/C:P/I:N/A:P)
CVSS v3 base score: 8.1, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/LibreDWG/libredwg
commit_details: repo_url: https://github.com/LibreDWG/libredwg
author: Reini Urban
author_date: 2020-01-02 07:53:11+01:00
msg: add DEBUGGING_CLASS_CPP

and use it for TABLECONTENT.
This is more stable than CLASS_DXF in cases when
TABLE is mixed up with TABLECONTENT. See e.g.
GH #178, where it fixes the heap_overflow2 case.
repository: repo_url: https://github.com/LibreDWG/libredwg
repo_name: LibreDWG/libredwg
description: Official mirror of libredwg. With CI hooks and nightly releases. PR's ok
repo_language: C
owner: LibreDWG
file_changes: filename: classes.inc
change_type: ModificationType.MODIFY
diff: @@ -53,10 +53,12 @@
 # define DEBUGGING_DXF(action, name)                 ALLOW_DXF(action, name)
 # define DEBUGGING_CLASS(action, name)               UNSTABLE_CLASS(action, name)
 # define DEBUGGING_CLASS_DXF(action, name, _dxfname) UNSTABLE_CLASS_DXF(action, name, _dxfname)
+# define DEBUGGING_CLASS_CPP(action, name, _cppname) UNSTABLE_CLASS_CPP(action, name, _cppname)
 #else
 # define DEBUGGING_DXF(action, name)                 DISALLOW_DXF(action, name)
 # define DEBUGGING_CLASS(action, name)               UNHANDLED_CLASS(action, name)
 # define DEBUGGING_CLASS_DXF(action, name, _dxfname) UNHANDLED_CLASS_DXF(action, name, _dxfname)
+# define DEBUGGING_CLASS_CPP(action, name, _cppname) UNHANDLED_CLASS_CPP(action, name, _cppname)
 #endif
 
 //#define _DWG_FUNC_N(action,name) dwg_ ## action ## _ ## name
@@ -123,7 +125,7 @@
         obj->dxfname = (char*) #_name; \
         obj->fixedtype = DWG_TYPE_##_name; \
       } \
-      return DEBUGGING_DXF(action, name) DWG_FUNC_N(action,_name)(dat, obj); \
+      return DEBUGGING_DXF(action, name) DWG_FUNC_N(action,_name) (dat, obj); \
     }
 #define UNHANDLED_CLASS(action, _name) \
   if (klass->dxfname && strEQc (klass->dxfname, #_name)) \
@@ -132,9 +134,7 @@
       if (strEQc (_STR(action), "decode") || !memcmp (_STR(action), "in", 2)) { \
         obj->name = (char*) #_name; \
         obj->dxfname = (char*) #_name; \
-        /*obj->fixedtype = DWG_TYPE_##_name; */ \
       } \
-      /* return dwg_##action_##_name(dat, obj); */ \
       return DWG_ERR_UNHANDLEDCLASS; \
     }
 #define UNHANDLED_CLASS_DXF(action, _name, _dxfname) \
@@ -144,9 +144,17 @@
       if (strEQc (_STR(action), "decode") || !memcmp (_STR(action), "in", 2)) { \
         obj->name = (char*) #_name; \
         obj->dxfname = (char*) #_dxfname; \
-        /*obj->fixedtype = DWG_TYPE_##_name; */ \
       } \
-      /* return dwg_##action_##name(dat, obj); */ \
+      return DWG_ERR_UNHANDLEDCLASS; \
+    }
+#define UNHANDLED_CLASS_CPP(action, _name, _cppname) \
+  if (klass->cppname && strEQc (klass->cppname, #_cppname)) \
+    { \
+      WARN_UNHANDLED_CLASS; \
+      if (strEQc (_STR(action), "decode") || !memcmp (_STR(action), "in", 2)) { \
+        obj->name = (char*) #_name; \
+        obj->dxfname = (char*) #_name; \
+      } \
       return DWG_ERR_UNHANDLEDCLASS; \
     }
 
@@ -170,9 +178,9 @@
   STABLE_CLASS    (ACTION, IMAGEDEF)
   STABLE_CLASS    (ACTION, IMAGEDEF_REACTOR)
   STABLE_CLASS    (ACTION, LAYER_INDEX)
-  STABLE_CLASS    (ACTION, LAYOUT)
+  STABLE_CLASS    (ACTION, LAYOUT) // TODO bottom_margin nan
   STABLE_CLASS    (ACTION, LWPOLYLINE)
-  STABLE_CLASS    (ACTION, MLEADERSTYLE)
+  STABLE_CLASS    (ACTION, MLEADERSTYLE) // TODO block_rotation nan
   STABLE_CLASS    (ACTION, OBJECTCONTEXTDATA)
   STABLE_CLASS_CPP(ACTION, OBJECTCONTEXTDATA, AcDbObjectContextData)
   STABLE_CLASS_DXF(ACTION, PLACEHOLDER, ACDBPLACEHOLDER)
@@ -219,8 +227,8 @@
   DEBUGGING_CLASS     (ACTION, REVOLVEDSURFACE)   /*ent */
   DEBUGGING_CLASS     (ACTION, SWEPTSURFACE)      /*ent */
   DEBUGGING_CLASS_DXF (ACTION, TABLE, ACAD_TABLE) /*ent, r2010+ needs subclassing */
-  DEBUGGING_CLASS     (ACTION, ARC_DIMENSION) //ent
-  DEBUGGING_CLASS     (ACTION, TABLECONTENT) //wrong values
+  DEBUGGING_CLASS     (ACTION, ARC_DIMENSION)     /*ent */
+  DEBUGGING_CLASS_CPP (ACTION, TABLECONTENT, AcDbTableContent)
   DEBUGGING_CLASS     (ACTION, TABLEGEOMETRY) //wrong geom_data
   DEBUGGING_CLASS     (ACTION, CELLSTYLEMAP) //broken
   DEBUGGING_CLASS     (ACTION, MATERIAL)     //working on

programming_language: C
filename: dec_macros.h
change_type: ModificationType.MODIFY
diff: @@ -1236,8 +1236,8 @@
       obj_dat = *dat;                                                         \
       hdl_dat = *dat;                                                         \
       str_dat = *dat;                                                         \
-      error                                                                   \
-          = dwg_decode_##token##_private (&obj_dat, &hdl_dat, &str_dat, obj); \
+      error = dwg_decode_##token##_private (&obj_dat, &hdl_dat, &str_dat,     \
+                                            obj);                             \
     }                                                                         \
     else { error = dwg_decode_##token##_private (dat, dat, dat, obj); }       \
     return error;                                                             \

programming_language: C