**System info**
Ubuntu x86_64, clang 12.0
version: libredwg-0.12.5.6588

**Command line**
./dwg2dxf poc

**Poc**
poc:[poc](https://github.com/SEU-SSL/Poc/blob/main/libredwg/id_000194%2Csig_11%2Csrc_063760%2Cop_havoc%2Crep_4)

**AddressSanitizer output**
==3732380==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6120000008c1 at pc 0x000000506583 bp 0x7ffc0a951650 sp 0x7ffc0a951648
READ of size 1 at 0x6120000008c1 thread T0
 #0 0x506582 in bit_TV_to_utf8_codepage /src/libredwg-crash/src/bits.c:3200:15
 #1 0x505560 in bit_TV_to_utf8 /src/libredwg-crash/src/bits.c
 #2 0x6a5deb in dwg_decode_LAYOUT_private /src/libredwg-crash/src/./dwg.spec:5560:3
 #3 0x5daa04 in dwg_decode_LAYOUT /src/libredwg-crash/src/./dwg.spec:5556:1
 #4 0x5daa04 in dwg_decode_add_object /src/libredwg-crash/src/decode.c:5518:17
 #5 0x510892 in decode_R13_R2000 /src/libredwg-crash/src/decode.c:834:19
 #6 0x510892 in dwg_decode /src/libredwg-crash/src/decode.c:231:12
 #7 0x4cb1f6 in dwg_read_file /src/libredwg-crash/src/dwg.c:268:11
 #8 0x4c92a5 in main /src/libredwg-crash/programs/dwg2dxf.c:261:15
 #9 0x7f7be09ac082 in __libc_start_main /build/glibc-BHL3KM/glibc-2.31/csu/../csu/libc-start.c:308:16
 #10 0x41c48d in _start (/src/libredwg-crash/programs/dwg2dxf+0x41c48d)

0x6120000008c1 is located 0 bytes to the right of 257-byte region [0x6120000007c0,0x6120000008c1)
allocated by thread T0 here:
 #0 0x49734d in malloc (/src/libredwg-crash/programs/dwg2dxf+0x49734d)
 #1 0x4faaf1 in bit_read_TV /src/libredwg-crash/src/bits.c:1778:28

SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg-crash/src/bits.c:3200:15 in bit_TV_to_utf8_codepage
Shadow bytes around the buggy address:
 0x0c247fff80c0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
 0x0c247fff80d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 0x0c247fff80e0: 00 00 00 00 00 00 00 00 01 fa fa fa fa fa fa fa
 0x0c247fff80f0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
 0x0c247fff8100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c247fff8110: 00 00 00 00 00 00 00 00[01]fa fa fa fa fa fa fa
 0x0c247fff8120: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 0x0c247fff8130: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 0x0c247fff8140: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 0x0c247fff8150: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 0x0c247fff8160: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

Shadow byte legend (one shadow byte represents 8 application bytes):
 Addressable: 00
 Partially addressable: 01 02 03 04 05 06 07
 Heap left redzone: fa
 Freed heap region: fd
 Stack left redzone: f1
 Stack mid redzone: f2
 Stack right redzone: f3
 Stack after return: f5
 Stack use after scope: f8
 Global redzone: f9
 Global init order: f6
 Poisoned by user: f7
 Container overflow: fc
 Array cookie: ac
 Intra object redzone: bb
 ASan internal: fe
 Left alloca redzone: ca
 Right alloca redzone: cb
 Shadow gap: cc
==3732380==ABORTING
heap-buffer-overflow exists in the function bit_TV_to_utf8_codepage in bits.c
This is a GitHub Issue
repo:libredwg
owner:LibreDWG
Title : heap-buffer-overflow exists in the function bit_TV_to_utf8_codepage in bits.c
Issue date:

--- start body ---
**System info**
Ubuntu x86_64, clang 12.0
version: libredwg-0.12.5.6588

**Command line**
./dwg2dxf poc

**Poc**
poc:[poc](https://github.com/SEU-SSL/Poc/blob/main/libredwg/id_000194%2Csig_11%2Csrc_063760%2Cop_havoc%2Crep_4)

**AddressSanitizer output**
==3732380==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6120000008c1 at pc 0x000000506583 bp 0x7ffc0a951650 sp 0x7ffc0a951648
READ of size 1 at 0x6120000008c1 thread T0
 #0 0x506582 in bit_TV_to_utf8_codepage /src/libredwg-crash/src/bits.c:3200:15
 #1 0x505560 in bit_TV_to_utf8 /src/libredwg-crash/src/bits.c
 #2 0x6a5deb in dwg_decode_LAYOUT_private /src/libredwg-crash/src/./dwg.spec:5560:3
 #3 0x5daa04 in dwg_decode_LAYOUT /src/libredwg-crash/src/./dwg.spec:5556:1
 #4 0x5daa04 in dwg_decode_add_object /src/libredwg-crash/src/decode.c:5518:17
 #5 0x510892 in decode_R13_R2000 /src/libredwg-crash/src/decode.c:834:19
 #6 0x510892 in dwg_decode /src/libredwg-crash/src/decode.c:231:12
 #7 0x4cb1f6 in dwg_read_file /src/libredwg-crash/src/dwg.c:268:11
 #8 0x4c92a5 in main /src/libredwg-crash/programs/dwg2dxf.c:261:15
 #9 0x7f7be09ac082 in __libc_start_main /build/glibc-BHL3KM/glibc-2.31/csu/../csu/libc-start.c:308:16
 #10 0x41c48d in _start (/src/libredwg-crash/programs/dwg2dxf+0x41c48d)

0x6120000008c1 is located 0 bytes to the right of 257-byte region [0x6120000007c0,0x6120000008c1)
allocated by thread T0 here:
 #0 0x49734d in malloc (/src/libredwg-crash/programs/dwg2dxf+0x49734d)
 #1 0x4faaf1 in bit_read_TV /src/libredwg-crash/src/bits.c:1778:28

SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg-crash/src/bits.c:3200:15 in bit_TV_to_utf8_codepage
Shadow bytes around the buggy address:
 0x0c247fff80c0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
 0x0c247fff80d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 0x0c247fff80e0: 00 00 00 00 00 00 00 00 01 fa fa fa fa fa fa fa
 0x0c247fff80f0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
 0x0c247fff8100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c247fff8110: 00 00 00 00 00 00 00 00[01]fa fa fa fa fa fa fa
 0x0c247fff8120: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 0x0c247fff8130: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 0x0c247fff8140: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 0x0c247fff8150: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 0x0c247fff8160: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

Shadow byte legend (one shadow byte represents 8 application bytes):
 Addressable: 00
 Partially addressable: 01 02 03 04 05 06 07
 Heap left redzone: fa
 Freed heap region: fd
 Stack left redzone: f1
 Stack mid redzone: f2
 Stack right redzone: f3
 Stack after return: f5
 Stack use after scope: f8
 Global redzone: f9
 Global init order: f6
 Poisoned by user: f7
 Container overflow: fc
 Array cookie: ac
 Intra object redzone: bb
 ASan internal: fe
 Left alloca redzone: ca
 Right alloca redzone: cb
 Shadow gap: cc
==3732380==ABORTING
--- end body ---
