forked from LibreDWG/libredwg
-
Notifications
You must be signed in to change notification settings - Fork 0
/
ChangeLog
25514 lines (17088 loc) · 723 KB
/
ChangeLog
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
Full history from the git log
-----------------------------
2022-02-06 Reini Urban <rurban@cpan.org>
Release 0.12.5
add a github release action helper
smoke also pull requests and tags (for the release)
avoid UNKNOWN.tar.gz on --depth 1 checkouts
2022-02-06 Reini Urban <rurban@cpan.org>
dwg_next_entity: fix immediate cycles
but we cannot yet detect non-immediate cycles, as from
illegal, fuzzed DWGs. See GH #345
bmp: better bounds-checks for wrong header_size
Fixes fuzzed GH #354 (Illegal DWG bmp preview)
encode: bounds-check remove_NOD_item
with illegal DWGs. Fixes GH #357
encode: protect from invalid ACDBPLACEHOLDER class_id
Fixes GH #359, a fuzzed DWG with ACDBPLACEHOLDER as 53 (STYLE)
encode: work on GH #364, #361 and #360
but no idea yet, how the hdl_dat stream overflows here.
all 3 cases the same problem in overlarge PLANESURFACE hdl_dat.
2022-02-05 Reini Urban <rurban@cpan.org>
indxf: more type protections
in dxf_tables_read for illegal/fuzzed input. Fixes GH #366
dxf: protect from wrong style type in SHAPE
from fuzzed DWGs. Fixes GH #373
indxf: fix double-free of LAYER.color.book_name
Fixes GH #383
fix free: -Wfree-nonheap-object of static arrays
dwg2SVG: null-deref GH #390
2022-02-04 Reini Urban <rurban@cpan.org>
decode_r2007: format nits
spec: face_modifier, BS cast for DXF
Fixes GH #396 warning
disarm cirrus FreeBSD smoker, no idea why it fails the tests.
fix decode_r2007 off-by-one dst buffer-overflow
We have one more byte to write to.
Detected only by fuzzing, Fixes GH #391 and #392 by @s1vona
outjson: fix JSON_END_REPEAT on early exit
several unstable objects need to exit a REPEAT BLOCK on errors.
fix that for json, e.g. with FIELD.ChildValue. Fixes GH #397
cleanup dwgwrite AFL left-overs
there is now a seperate main() for faster AFL fuzzing
2022-02-01 Reini Urban <rurban@cpan.org>
injson: protect from empty strings
No NULL deref. Fixes oss-fuzz #36901,
with json of '{}"AcDs"{"segments"[{"name"}]}('
2022-01-31 Reini Urban <rurban@cpan.org>
appveyor: update mingw deps as on github
dxf: improve convert_SAB_to_SAT1
for illegal DWGs. Fixes oss-fuzz #36728
spec: set LEADER.box_width DXF 41
needed for add_test LEADER dxf
fixes indxf for LEADER.
2022-01-31 Reini Urban <rurban@cpan.org>
indxf: stricter dxf import
2/3DPOINT* import only from matching DXF codes, not just
some irrelevant.
special-case clip_verts pairs (WIPEOUT, SPATIAL_FILTER, ...)
when the num_ value is set, do the vector alloc.
Fixes oss-fuzz #39025 with WIPEOUT.clip_verts
indxf now fails on unstable classes, where all DXF groups are known.
2022-01-31 Reini Urban <rurban@cpan.org>
indxf: fix common entity handles
don't mixup LWPOLYLINE points 390 with Entity plotstyle handle.
also do material and visualstyle handles (the last one only partially)
Fixes oss-fuzz #39025 with WIPEOUT.clip_verts
2022-01-30 Reini Urban <rurban@cpan.org>
in_json: invalid HANDLEs
here we can have invalid user-input, dont assert.
Fixes oss-fuzz #39755
macos ci: enforce newer texinfo
see https://github.com/abo-abo/swiper/issues/457#issuecomment-203689787
also update mingw recipe (no autoreconf)
spec: fix 2 auxheader type warnings
RS -> RL
support --disable-json and --disable-dxf
in the various helpers. Actually needed for practical compilation times
encode: enforce limit of max obj->size
to avoid DDOS attacks. Fixes oss-fuzz #41021
We let the overlarge obj->size through, but we just need to skip it.
2022-01-29 Reini Urban <rurban@cpan.org>
dxf_fixup_string: optimize
remove dead code.
this fixes a valgrind error on dwg2dxf example_2004.dwg
Update cirrus freebsd to 13.0
with updated python 3.8
2021-10-11 Reinhard Urban <reinhard.urban@nubix.de>
-Wstringop-truncation with clang
2021-10-06 Reini Urban <rurban@cpan.org>
update for latest shellcheck
which came with new warnings
2021-10-06 Reinhard Urban <reinhard.urban@nubix.de>
mingw: fix github msys/mingw
This is msys, so check for ld, which is probed for.
2021-10-05 Reinhard Urban <reinhard.urban@nubix.de>
spec: fix dwgadd.example path
mingw: attempt to fix github msys/mingw action
on msys the compiler is just named gcc, without prefix.
but LD is searched for and thus has the mingw path prefix.
so msys, mingw cross and mingw works now again.
2021-10-03 Reini Urban <rurban@cpan.org>
fix dictionarywdflt unit-test
cloning_r14 is RL there
fix -Wstring-concatenation
detected by clang
Fix handle sizes calc. and encode under Windows GH #346
Handle corruption. Take the size of ulong, not a ptr.
Tested round-trips manually.
Fixes GH #346
2021-09-30 Reini Urban <rurban@cpan.org>
mingw64 cleanups
fix wrong mingw-w64 check with _FORTIFY_SOURCE to add -lssp
no double -lm in examples
2021-08-22 Reini Urban <rurban@cpan.org>
simplify alive.test on windows
make test sets .exe in PROGS correctly, but not standalone
2021-07-07 huhexiang <hhxnbw@163.com>
dwgread: fix r2004_file_header crc32 calculation error
2021-07-06 Reini Urban <rurban@cpan.org>
bit_chain_alloc: add blocks in page size
2021-06-28 Reini Urban <rurban@cpan.org>
add bit_chain_alloc_size
to allocate more than 1024 bytes in one swoop.
we could use while, but this is better.
needed eg for dwgrewrite, GH #364
2021-06-27 Reini Urban <rurban@cpan.org>
indxf: fix setting 10 to y (dxf+10, when dxf = 0)
e.g. ASSOC2DCONSTRAINTGROUP.workplane[3] with code 10.
Fixes GH #365, fuzzing only
indxf: gracefully handle DXF EOF inside CMC
Fixes GH #367, fuzzing only
convert_SAB_to_SAT1: check more invalid SAB overflows
with tag 14 subident also.
Fixes GH #368, fuzzing only.
dwg_handle_name: protect from strdup(NULL)
Fixes GH #369
spec: fix wrong VALUEPARAM allocation
values[] are inlined, not per pointer.
Detected by GH #370
bit_eq_T: handle null args
fixes GH #371
2021-06-26 Reini Urban <rurban@cpan.org>
spec: protect from less LWPOLYLINE widths than points
on outdxf with illegal DWGs. Fuzzing only. Fixes GH #372
indxf: one less dxf pair leak
the last one
indxf: check !pair in add_PERSUBENTMGR
Fixes fuzzing GH #376
spec: re-arrange MLEADER union fields a bit
so that wrong types from illegal DXF don't corrupt handles. txt vs blk.
They are now much better aligned.
Fixes GH #378
indxf: protect from overlarge counts
fail with invalid dxf when xcalloc fails.
fixes fuzzing GH #379
2021-06-24 Reini Urban <rurban@cpan.org>
indxf: missed a CHK_segs in add_HATCH
fixes GH #380, fuzzing only
indxf: abort on too many MULTILEADER groups 47
Fixes GH #381, fuzzing only
2021-06-21 Reini Urban <rurban@cpan.org>
auxheader: wrong maint_version_* fields and types
cast the types to silence warnings. fill both alt. variants of maint_version
acds: wrong AcDs.segments.signature type
macOS: require python 3.8 for gh actions
but python 3.8 on macOS has a wrong linker cfg, -Wl,-stack_size is illegal for
shared libs.
2021-06-20 Reini Urban <rurban@cpan.org>
indxf: fix fuzzing overflow with illegal subclasses
disallow illegal subclasses, even with non-stable objects.
Fixes GH #385. Can only appear with fuzzed input
dxf: fix SAB_to_SAT1 overflow GH #384
with fuzzed input data. wrong size check for ltoa conversion
2021-06-16 Reini Urban <rurban@cpan.org>
decode_r2007: more fixes for invalid section size
Fixes GH #348. Check memcpy also with uncompressed pages.
Fuzzing (illegal DWG's) only.
2021-06-16 Reinhard Urban <reinhard.urban@nubix.de>
spec fixups
deleting /usr/share/man/man1/dwg* is not recommended. we dont reserve that
namespace for us alone
2021-06-16 Tadej Janež <tadej.j@nez.si>
Refactor Spec file for building RPM packages
2021-06-07 Reini Urban <rurban@cpan.org>
decode_r2007: fix for invalid section size
See GH #350. With fuzzing section->data_size might not fit
section_page->uncomp_size.
dwgread: fix --disable-write --disable-dxf build
dwg_section_wtype: fix fuzzing overflow
with illegal and overlong section names. Fixes GH #349, #352
section names cannot be longer than 24
2021-05-15 Reini Urban <rurban@cpan.org>
appveyor: revise fef6deb79 add -lssp to mingw
add -lssp explicitly, but someone (libtool?) strips it nevertheless.
enforce -fstack-protector on appveyor.
need our git.
2021-05-12 Reini Urban <rurban@cpan.org>
decode: non fatal illegal/unknown class
esp. with the case of Warning: Recover invalid offset
the object is often illegal.
Fixes the GH #338 regression.
decode: r2013 has larger max_decomp_size
for AppInfoHistory and SummaryInfo.
See GH #338
decode: improve performance for big DWG's
double the size of allocated objects per cycle, not linear by 128.
dramatically improves dwg decode performance for big DWG's.
2021-05-01 Reini Urban <rurban@cpan.org>
indxf: more NULL _ctrl->entries derefs
e.g. oss-fuzz issue 33447
2021-04-25 Reini Urban <rurban@cpan.org>
Disable broken compiler optimizations
See https://lore.kernel.org/lkml/CAHk-=wi_KeD1M-_-_SU_H92vJ-yNkDnAGhAS=RR1yNNGWKW+aA@mail.gmail.com/
fix mingw release: add missing dwgfilter and the pcre dlls
See GH #337
2021-04-18 Reini Urban <rurban@cpan.org>
configure: test syntax error (AM HAVE_CYGWIN)
add -lssp to mingw
started failing again, with only -fstack-protector and only on appveyor.
mingw with gh actions not.
configure: fix HAVE_ASAN_OR_LINUX AM_CONDITIONAL
needed for examples/Makefile.am
configure: invalid test -z args
Fix mingw %zu warnings
2021-04-17 Reini Urban <rurban@cpan.org>
hardcode codecov_io.sh
due to its recent breakin upstream
2021-04-09 Reini Urban <rurban@cpan.org>
cmake warnings
target redwg has PUBLIC_HEADER files but no PUBLIC_HEADER DESTINATION
install TARGETS given no LIBRARY DESTINATION for shared library target
See GH #333
2021-04-08 Reini Urban <rurban@cpan.org>
dwg2SVG: flush stdout
interestingly the libc does not flush stdout to pipes on process exit???
dwg2SVG: improve ELLIPSE
absolute rx and ry radii,
rotation is the sm_axis (normal vector).
Fixes GH #328
2021-04-08 Reini Urban <rurban@cpan.org>
build asan fuzzers only on request
fixes failing cygwin smokes. we could install asan on the smokers,
but we dont need it. only build it when requested.
This needs no oss-fuzz build changes.
See GH #330
2021-04-08 Reini Urban <rurban@cpan.org>
Fix configure bashism
No string indexing in POSIX sh, for the new GPERF_VERSION check.
Broken with 0.12.4
Fixes GH #329
Thanks to Alexey Dokuchaev
2021-04-06 Reini Urban <rurban@cpan.org>
Release 0.12.4
See NEWS
Mostly fuzzing patches only.
dxf.test: honor --enable-release
indxf: calloc NULL strings only if no code 0
simplifies loop checks. code 0 must have a not-empty string values.
See oss-fuzz issue 32758 and 32950
2021-04-01 Reini Urban <rurban@cpan.org>
indxf: calloc NULL strings
empty string values are compared via strcmp and such.
rather calloc a \0 byte, and don't crash. in_dxf is way
too permissive, but we want to keep it that way.
But only needed in fuzzed DXF files so far.
Fixes oss-fuzz issue 32758
2021-04-01 Reini Urban <rurban@cpan.org>
indxf: reset j on non-vector fields
we have several special cases for vectors or pts, where we
need a global j counter. but when we set a single field, such as a
num_clip_verts 91 or such. then we need to reset j, otherwise
we could run into vector or pts overflows.
As in oss-fuzz issue 32755
2021-03-31 Reini Urban <rurban@cpan.org>
indxf; fix NULL-deref with illegal DXF
wrong points. Fixes oss-fuzz issue 32663
dim_blockname NULL-deref protection
found by oss-fuzz issue 32639, but not repro anymore
SHAPE spec: protect dxf from empty _ctrl->entries
NULL-deref. oss-fuzz issue 32627, but not repro.
See also oss-fuzz issue 32670.
2021-03-29 Reini Urban <rurban@cpan.org>
indxf: fix type unsafeties in dynapi set
dont just check for a known common field name, but also its valid types
before setting its defaults.
In particular scale can be not just 3BD_1, but also H or BD, 2BD.
grep '"scale"' ../src/dynapi.c
Fixes oss-fuzz issue 32604
2021-03-28 Reini Urban <rurban@cpan.org>
fix in_json created_by leak
should fix oss-fuzz issue 32408, which
has an empty reproducer, but code-review brought me to that
2021-03-26 Reini Urban <rurban@cpan.org>
try to fix more indxf leaks
but no
2021-03-25 Reini Urban <rurban@cpan.org>
indxf: protect from empty 3DSOLID 2 values
fail with Invalid revision_guid earlier.
Fixes oss-fuzz issue 32455
2021-03-24 Reini Urban <rurban@cpan.org>
spec: protect from NULL bit_eq_T args
only with fuzzed/corrupt DWGs. Fixes oss-fuzz issue 32397
2021-03-23 Reini Urban <rurban@cpan.org>
outdxfb: NULL-deref in dxfb_process_VERTEX
analog to outdxf. last_vertex might be NULL with broken objects (fuzzed).
Fixes oss-fuzz issue 32348
2021-03-23 Reini Urban <rurban@cpan.org>
encode: protect NULL bit_write_TF chain
With dwg_encode_xdata write a proper 0 size,
but with lengths < 128 just write the empty string.
Fixes oss-fuzz issue 32335, fuzzed dwgrewrite input only.
This usually happens with overflowing (corrupt) XRECORD input.
2021-03-20 Reini Urban <rurban@cpan.org>
fixup indxf use-after-free
from 3b47eb0fe81ab7ded5342208feac016076e0e668
dont just free the pair.
Detected by oss-fuzz issue 32275
2021-03-20 Reini Urban <rurban@cpan.org>
outdxf: protect cquote src overflow
fixes oss-fuzz issue 32251
2021-03-18 Reini Urban <rurban@cpan.org>
free: fix encode and possible leak in VBA_PROJECT
leak detected by oss-fuzz issue 32179, but unfort. oss-fuzz
produces an broken empty reproducer.
also fix the encoding case, where we used to have an empty obj->size.
this is much more important.
the leak might happen with a proper decode of VBA_PRODUCT.data
but bit_read_TF failing on overflow, whilst the VECTOR_CHKCOUNT
check passed. A reproducer would be really nice to fix this for
all fuzzed TF fields with variable len. This fix is just a hack.
There is even a related testcase in to/2013/from_upcommons.upc.edu/DRAWINGS.dwg
with a proper detection ERROR: Invalid data size 7168. Need min.
7168 bits for TF, have 90 for VBA_PROJECT.
2021-03-18 Reini Urban <rurban@cpan.org>
outdxfb: More NULL-deref protections as in outdxf
fixes oss-fuzz issue 32171
2021-03-18 Reini Urban <rurban@cpan.org>
encode: disallow 3DSOLID num_blocks calculation
from block_size[]. this might overflow with fuzzed/malicious data.
all our input data (dwg. dxf, json) already sets num_blocks
to a correct value already.
Fixes oss-fuzz issue 32165 with dwgrewrite (broken block_sizes vector)
2021-03-18 Reini Urban <rurban@cpan.org>
clean more distcheck leftovers
indxf: fix leaks with invalid objects or sections
e.g. oss-fuzz issue 32094
2021-03-17 Reini Urban <rurban@cpan.org>
outdxf: uncondtionally zero-terminate cquote result
because we immediately use strlen on it, which is on the stack.
Fixes oss-fuzz issue 32112 (stack read overflow)
more zero-termination fixes
don't overflow when checking for zero-termination.
asan is strict there.
all our input paths enforce now zero-termination, so
don't check.
dat->chain[dat->size] must now always be 0. removed some weird
dxf special-case where it was dat->size+1.
gh action: -O1 asan times out. revert to -O0
2021-03-16 Reini Urban <rurban@cpan.org>
gh: add codecov.io integration, make distcheck
coveralls.io is a bit too troublesome with our gcov files.
Also add make distcheck, but only for --enable-release. And skip make check
there, otherwise we will fall in the 60min timeout. 28min for the
build, 8min for the check.
2021-03-16 Reini Urban <rurban@cpan.org>
indxf: improve fuzzer zero-termination
don't allow \n without \0 in DXF.
Fail earlier when the ASCII DXF buffer has none to avoid strtol overflows.
Fixes oss-fuzz issue 32022
Also clear errno before calling strtol.
2021-03-16 Reini Urban <rurban@cpan.org>
llvmfuzz_standalone: protect from illegal input args
accept only files.
ftell might return (long)-1, which will lead to an malloc error
2021-03-14 Reini Urban <rurban@cpan.org>
more bit_utf8_to_TV src overflow protections
commit 54fdafc75275f1848bcb4e79c0313b9a13a8b01b
introduced src overflow protection, but not really.
acctually check unprotected inc's.
Fixes oss-fuzz issue 32029
2021-03-13 Reini Urban <rurban@cpan.org>
decode preR13: fix overflow regressions
fuzzing only. crashes15 id 145
2021-03-12 Reini Urban <rurban@cpan.org>
encode: fix use-after-realloc in API_ADD_TABLE
There is a small window of opportunity to realloc the objs invalidating
ctrl.
Fixes oss-fuzz issue 31436.
decode: protect unsigned int overflow on wrong obj->size
only with fuzzed dwgs.
fixup llvmfuzz_standalone on non-linux
no weak linking on macOS nor Windows.
our mingw smokers have no sanitizers.
indxf: disable unused and leaking dxf_objs
add llvmfuzz_standalone for reproducers
esp. if we fixup missing zero-termination. yes, we do.
bogus oss-fuzz bug reports for 31419, et al
2021-03-11 Reini Urban <rurban@cpan.org>
indxf: pair -Wmaybe-uninitialized
2021-03-10 Reini Urban <rurban@cpan.org>
protect bit_utf8_to_TV src from overflow
fuzzing in_json only, everywhere else the src is big enough.
Fixes oss-fuzz issue 31878
Update NEWS, README
dxfb: same protections as in dxf
for fuzzing input
add old gperf support
needed for macOS CI target, which wants to generate dxfclasses.c
with a gperf 3.0
outdxfb: resolve wrong ref->obj handles
check against wrong ref->obj.
enable llvmfuzz for outdxfb.
2021-03-09 Reini Urban <rurban@cpan.org>
Prepare NEWS for 0.12.4
indxf: better dxf_skip_ws overflow protection
May fix oss-fuzz issue 31789, but not repro
outdxf: forgot a LAYER_CONTROL entries case
NULL-deref.
Fixes oss-fuzz issue 31873
decode: protect bit_read_BB_noadv
analog to bit_read_BB.
Fixes oss-fuzz issue 31591
encode: fix write_DD for scale
for INSERT. allow 1e-12 variance in equality check.
Fixes GH #326
2021-03-09 Reini Urban <rurban@cpan.org>
encode: check if strings zero-terminate
and re-calc the bitsize and size if changed.
generally all dwg's created with r2004+ have zero-terminated strings,
before not.
Now the testcase with ./rw ../test/issues/gh326/Test_DWG_2000.dwg
causes just 63 errors, not 187 anymore.
See GH #326
2021-03-08 Reini Urban <rurban@cpan.org>
encode: add LOG_POS to strings
decode: log used Section Page Map address
2021-03-08 Reini Urban <rurban@cpan.org>
decode: initialize bit_read_fixed on dat overflow
Fixes GH #321.
NULL dereference in header_variables_dxf.spec:26
Thanks to @zodf0055980 for the analysis.
2021-03-08 Reini Urban <rurban@cpan.org>
encode: avoid hdl_dat double-free
In case of an handle overflow, such as num_reactors.
Fixes oss-fuzz issue 31724.
2021-03-06 Reini Urban <rurban@cpan.org>
llvmfuzz: copy if JSON
because we temp. zero-terminate strings in the JSON.
Fixes oss-fuzz issue 31660, and kills libfuzzer performance.
more decode_3dsolid fuzzing protections
TF returns on overflow, but does not clear block_size.
Fixes oss-fuzz issue 31657
outdxf: some NULL-deref protections
with empty table entries.
Fixes oss-fuzz issue 31656
outdxf: protect stack-allocated string
from overflow at strlen.
Should fix oss-fuzz issue 31647, but not locally repro
decode: fix harmless klass->appname leak
fixes oss-fuzz issue 31564
More FORMAT_RC -Wformat cast warnings
this time for encode
more decode_3dsolid fuzzing NULL deref
better fix for oss-fuzz issue 31533
blocks_size needs to be reset also when TF overflows.
Fix some FORMAT_RC -Wformat cast warnings
from calc. int, and without optimization in COMMON_TABLE_FLAGS (Layer).
Seems problematic, but we want to be warnings free to catch real errors.
decode_preR13: more PREP_TABLE protections
fixes GH #325 heap overflow
2021-03-06 Reini Urban <rurban@cpan.org>
more encode bitsize fixups needed
all entities with a DD type have no stable bitsizes.
need to recalc it there too. Eg LWPOLYLINE with example_2000
on dwgrewrite.
also recalc size on was_bitsize_set
2021-03-05 Reini Urban <rurban@cpan.org>
encode: fix bitsize recalculation
not just on unknown size/bitsize (DXF), also on JSON
import and on rewrite across versions we need to recalc both sizes.
e.g. on rewrite from r2004+ we miss the is_xdic_missing bit in all objects
leading to an off-by-one bitsize.
See GH #322
2021-03-03 Reini Urban <rurban@cpan.org>
Major outdxfb bugfix: write code 0 pairs
outdxfb: fix table NULL-derefs
Fixes GH #324, fuzzed by @zodf0055980.
Analog to ascii dxf
thumbnail: more bounds-checks
protect from invalid header_size and BMP size.
Fixes GH #323, fuzzed by @zodf0055980
more decode bounds-checking
when the common entity already overflowed, dont parse further.
such as e.g. with EED overflow.
Fixes oss-fuzz issue 31576
acds: bounds-check invalid AcDs segment offset
leading to heap-overflows with corrupt/fuzzed input data.
Fixes GH #320, thanks to Yuan @zodf0055980 from Taiwan for fuzzing.
2021-03-01 Reini Urban <rurban@cpan.org>
decode_r2007: fail earlier with illegal system page data
to avoid integer overflow in rounded calcs.
Better fix for oss-fuzz issue 31574
geojson: protect dwg_geojson_object
with broken object, without parent (dwg)
Fixes oss-fuzz issue 31542
fix decode_3dsolid fuzzing NULL deref
in case of an empty encr_sat_data[] block.
Fixes oss-fuzz issue 31533
2021-02-28 Reini Urban <rurban@cpan.org>
llvmfuzz: set out_dat versions and opts
dwg_read_dxf: set the opts here.
needed for proper unicode conversions.
as in our converters.
bump copyright years to 2021
2021-02-28 Reini Urban <rurban@cpan.org>
encode: fix hdl_dat leak on errors
when we have to return early within dwg.spec, such as HATCH errors
and don't cleanup with DWG_OBJECT_END.
Fixes oss-fuzz issue 31456
2021-02-28 Reini Urban <rurban@cpan.org>
VBA_PROJECT: ignore overlarge data_size
which could lead to DDOS from malicious input,
but mostly only pleasing fuzzers.
Fixes oss-fuzz issue 31462
2021-02-28 Reini Urban <rurban@cpan.org>
llvmfuzz: fix leaks on input errors
See e.g. oss-fuzz issue 31422
we skip leak detection with libfuzzer, but not with honggfuzz.
note that in_dxf still leaks heavily, a known limitation.
so we'd need to skip leak checks with honggfuzz also, or disable in_dxf there.
fix encode_3dsolid num_blocks calculation
not default to 100. take the number from the block_size array.
Fixes oss-fuzz issue 31470 heap-buffer-overflow
encode: fix fuzzing buffer overflow
Fixes oss-fuzz issue 31516
detected by llvmfuzz
2021-02-28 Reini Urban <rurban@cpan.org>
llvmfuzz: enforce fuzzer data NULL-termination
this is a workaround for a libfuzzer limitation.
strtol or sscanf need a NULL-terminated buffer, or at least \n
terminated.
otherwise it reports buffer overflows.
in real-code we enforce that in our input funcs.
Fixes oss-fuzz issues 31450, 31419, 31454.
2021-02-27 Reini Urban <rurban@cpan.org>
indxf: break earlier
ensure NULL-termination in dat_read_stream
for sscanf, strtol and friends with asan.
Fixes oss-fuzz issue 31454
2021-02-26 Reini Urban <rurban@cpan.org>
dwgadd: fix pspace command
Closes GH #319, thanks to @chensccode
encode: protect more API_ADD_TABLE cases
Might fix oss-fuzz issue 31436
outdxf: wrong usage of strncat
fix dxf_CMC overflows.
detected by llvmfuzz
outdxf: more dxf_tables_write NULL ptr protections
might fix oss-fuzz Null-dereference READ · dxf_tables_write issue
decode_r2007: protect from invalid repeat_count
signed integer overflow with invalid input.
fixes oss-fuzz issue 31432
encode: fix dat->chain[pvzadr] overflow
fixes oss-fuzz issue 31426
decode: check decode_R13_2000 invalid classes
fixes oss-fuzz issue 31425.
outdxf: more cquote protection
Fixes oss-fuzz Heap-buffer-overflow READ 1, issue 31416
tested with 0.12.3.4139
This bug was introduced with 0.10.1.3125
dwgadd/fuzz: fix wrong sscanf usage
need the secure variant. esp. on windows
fix some windows format warnings
fix -Wold-style-definition
minor make release-web fixups
2021-02-26 Reini Urban <rurban@cpan.org>
Release 0.12.3
Fix manual and release-web targets.
2021-02-25 Reini Urban <rurban@cpan.org>
encode: fix null-deref in DISABLE_NODSTYLE
with empty NOD entries.
detected by llvmfuzz
fix outdxf overflow with Invalid shift-jis sequence \M+1xxxxxx
detected by llvmfuzz
indxf: abstract Premature DXF end to SAFER_STRTOL
indxf: harden Premature DXF end errors
we can assume there will always be a final " 0\nEOF" string.
other string stream offset with r2010 Beta 2 samples.
Fixes GH #318
WIP wrong string stream hisize offsets
with Gator Beta 2 samples. See GH #318
to/2010/from_knowledge.autodesk.com/
outdxf: handle invalid SAB abort
detected by llvmfuzz
outdxf logging: avoid wrong bitsize position overflow
detected by llvmfuzz
outdxf: fix crash with stale VERTEX
fail with empty last_vertex.
detected by llvmfuzz
outdxf: protect empty tio.entity
detected by llvmfuzz
indxf: hard error on invalid dxf pair
before we simply returned 0 (or NAN) on invalid dxf pairs.
now we set the stream to the end to force an early exit.
2021-02-24 Reini Urban <rurban@cpan.org>
indxf: protect dwg_read_dxf the same as dxf_read_file
check if input size is too small, and if it's not a DWG.
llvmfuzz used the latter, which was not repro with dxf2dwg.
encode: convert assert address to error
fix bit_eq_TU for NULL args
or conversion trouble.
detected by llvmfuzz
LTYPE: protect against empty strings_area
detected via llvmfuzz
injson: fix TFFx buffer-overflow
write max TFF size.
detected via llvmfuzz
encode: protect object dat pos 0 overwrites
don't assert, fail.
detected via llvmfuzz
decode: Size underflow for R2004_Header
detected by llvmfuzz
fix injson double-free
created_by is static
detected via llvmfuzz
outdxf: protect dxf_CMC string overflows
with fuzzing. llvmfuzz
2021-02-23 Reini Urban <rurban@cpan.org>
prelim. NEWS for next patch release
geojson: add PAIR_Sc for non-null values
2021-02-23 Reini Urban <rurban@cpan.org>
abstract TU_to_int for ubsan access
which was totally wrong in some cases. but only with ubsan or
HAVE_ALIGNED_ACCESS_REQUIRED.
fix out_json print_wcquote for unaligned/UBSAN strings.
2021-02-23 Reini Urban <rurban@cpan.org>
llvmfuzz: close the null file-handle
running out of it
Fix dwg2dxf uppercase extension problem
GH #311, esp on Windows
indxf: detect dxf_read_* premature DXF end
A DXF line must end with \n.
detected via llvmfuzz
indxf: fix add_HATCH overflow logic, wrong hdl_idx check
detected via llvmfuzz
bit_TU_to_utf8_len: fix heap overflow
force string being delimited.
deteced by llvmfuzz
indxf: fix 3DSOLID overallocation
detected via llvmfuzz
indxf: fix MTEXT text running lines, DXF 3
detected via llvmfuzz
dwgfuzz: add honggfuzz and llvmfuzz instructions
See GH #317
add suggested __attribute__ ((noreturn)) to examples/dwgadd
clang -Wmissing-noreturn
some libfuzzer assertions. see llvmfuzz
2021-02-23 Reini Urban <rurban@cpan.org>
protect invalid geojson input
via llvmfuzz.
cd .build-clang
m -C src && \
clang -I../src -Isrc -g -O3 -fsanitize=address,fuzzer ../examples/llvmfuzz.c -Lsrc/.libs -lredwg;
LD_LIBRARY_PATH=src/.libs ./a.out -detect_leaks=0 -rss_limit_mb=8000 -timeout=4000 ../test/test-data/
2021-02-23 Reini Urban <rurban@cpan.org>
replace prelim fuzz_dwg_decode.c with llvmfuzz.c
with proper coverage
2021-02-23 davkor <david@adalogics.com>
Added initial fuzzer for OSS-Fuzz integration.