Hi,
In release version 0.12.4, (also in the latest commit 45d2a290)

There is  heap use after free in function bit_read_RC() in bits.c 


**reproduce**
```
./configure --enable-release 
CFLAGS="-fsanitize=address" ./configure --enable-release 
make
./dwgrewrite [poc]
```
[uaf_read_RC.zip](https://github.com/LibreDWG/libredwg/files/6616813/uaf_read_RC.zip)


```c
AddressSanitizer: heap-use-after-free on address 0x7feefc1eb800 at pc 0x55f04fcd05dd bp 0x7ffcfd0c1430 sp 0x7ffcfd0c1420
READ of size 1 at 0x7feefc1eb800 thread T0
    #0 0x55f04fcd05dc in bit_read_RC /home/chiba/libredwg-check/src/bits.c:316
    #1 0x55f04fce552f in bit_copy_chain /home/chiba/libredwg-check/src/bits.c:3326
    #2 0x55f050ef00c6 in obj_flush_hdlstream /home/chiba/libredwg-check/src/encode.c:784
    #3 0x55f051a9d1dd in dwg_encode_PLANESURFACE_private /home/chiba/libredwg-check/src/dwg.spec:8832
    #4 0x55f051a83183 in dwg_encode_PLANESURFACE /home/chiba/libredwg-check/src/dwg.spec:8818
    #5 0x55f051ef41f1 in dwg_encode_variable_type /home/chiba/libredwg-check/src/classes.inc:243
    #6 0x55f051f13dd1 in dwg_encode_add_object /home/chiba/libredwg-check/src/encode.c:3771
    #7 0x55f050f02eb6 in dwg_encode /home/chiba/libredwg-check/src/encode.c:2352
    #8 0x55f04fcbe78d in dwg_write_file /home/chiba/libredwg-check/src/dwg.c:429
    #9 0x55f04fcbaf4f in main /home/chiba/libredwg-check/programs/dwgrewrite.c:349
    #10 0x7fef0137f0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
    #11 0x55f04fcb9bad in _start (/home/chiba/libredwg-check/asan-master/bin/dwgrewrite+0x207bad)

0x7feefc1eb800 is located 0 bytes inside of 283648-byte region [0x7feefc1eb800,0x7feefc230c00)
freed by thread T0 here:
    #0 0x7fef017a6ffe in __interceptor_realloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dffe)
    #1 0x55f04fce4409 in bit_chain_alloc /home/chiba/libredwg-check/src/bits.c:3026
    #2 0x55f04fce53d8 in bit_copy_chain /home/chiba/libredwg-check/src/bits.c:3314
    #3 0x55f050ef00c6 in obj_flush_hdlstream /home/chiba/libredwg-check/src/encode.c:784
    #4 0x55f051a9d1dd in dwg_encode_PLANESURFACE_private /home/chiba/libredwg-check/src/dwg.spec:8832
    #5 0x55f051a83183 in dwg_encode_PLANESURFACE /home/chiba/libredwg-check/src/dwg.spec:8818
    #6 0x55f051ef41f1 in dwg_encode_variable_type /home/chiba/libredwg-check/src/classes.inc:243
    #7 0x55f051f13dd1 in dwg_encode_add_object /home/chiba/libredwg-check/src/encode.c:3771
    #8 0x55f050f02eb6 in dwg_encode /home/chiba/libredwg-check/src/encode.c:2352
    #9 0x55f04fcbe78d in dwg_write_file /home/chiba/libredwg-check/src/dwg.c:429
    #10 0x55f04fcbaf4f in main /home/chiba/libredwg-check/programs/dwgrewrite.c:349
    #11 0x7fef0137f0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)

previously allocated by thread T0 here:
    #0 0x7fef017a6ffe in __interceptor_realloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dffe)
    #1 0x55f04fce4409 in bit_chain_alloc /home/chiba/libredwg-check/src/bits.c:3026
    #2 0x55f051f12dda in dwg_encode_add_object /home/chiba/libredwg-check/src/encode.c:3490
    #3 0x55f050f02eb6 in dwg_encode /home/chiba/libredwg-check/src/encode.c:2352
    #4 0x55f04fcbe78d in dwg_write_file /home/chiba/libredwg-check/src/dwg.c:429
    #5 0x55f04fcbaf4f in main /home/chiba/libredwg-check/programs/dwgrewrite.c:349
    #6 0x7fef0137f0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)

SUMMARY: AddressSanitizer: heap-use-after-free /home/chiba/libredwg-check/src/bits.c:316 in bit_read_RC
Shadow bytes around the buggy address:
  0x0ffe5f8356b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0ffe5f8356c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0ffe5f8356d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0ffe5f8356e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0ffe5f8356f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0ffe5f835700:[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0ffe5f835710: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0ffe5f835720: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0ffe5f835730: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0ffe5f835740: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0ffe5f835750: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==434628==ABORTING

```




use after free in bit_read_RC in bits.c 
This is a GitHub Issue
repo:libredwg
owner:LibreDWG
Title : use after free in bit_read_RC in bits.c 
Issue date:

--- start body ---
Hi,
In release version 0.12.4, (also in the latest commit 45d2a290)

There is  heap use after free in function bit_read_RC() in bits.c 


**reproduce**
```
./configure --enable-release 
CFLAGS="-fsanitize=address" ./configure --enable-release 
make
./dwgrewrite [poc]
```
[uaf_read_RC.zip](https://github.com/LibreDWG/libredwg/files/6616813/uaf_read_RC.zip)


```c
AddressSanitizer: heap-use-after-free on address 0x7feefc1eb800 at pc 0x55f04fcd05dd bp 0x7ffcfd0c1430 sp 0x7ffcfd0c1420
READ of size 1 at 0x7feefc1eb800 thread T0
    #0 0x55f04fcd05dc in bit_read_RC /home/chiba/libredwg-check/src/bits.c:316
    #1 0x55f04fce552f in bit_copy_chain /home/chiba/libredwg-check/src/bits.c:3326
    #2 0x55f050ef00c6 in obj_flush_hdlstream /home/chiba/libredwg-check/src/encode.c:784
    #3 0x55f051a9d1dd in dwg_encode_PLANESURFACE_private /home/chiba/libredwg-check/src/dwg.spec:8832
    #4 0x55f051a83183 in dwg_encode_PLANESURFACE /home/chiba/libredwg-check/src/dwg.spec:8818
    #5 0x55f051ef41f1 in dwg_encode_variable_type /home/chiba/libredwg-check/src/classes.inc:243
    #6 0x55f051f13dd1 in dwg_encode_add_object /home/chiba/libredwg-check/src/encode.c:3771
    #7 0x55f050f02eb6 in dwg_encode /home/chiba/libredwg-check/src/encode.c:2352
    #8 0x55f04fcbe78d in dwg_write_file /home/chiba/libredwg-check/src/dwg.c:429
    #9 0x55f04fcbaf4f in main /home/chiba/libredwg-check/programs/dwgrewrite.c:349
    #10 0x7fef0137f0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
    #11 0x55f04fcb9bad in _start (/home/chiba/libredwg-check/asan-master/bin/dwgrewrite+0x207bad)

0x7feefc1eb800 is located 0 bytes inside of 283648-byte region [0x7feefc1eb800,0x7feefc230c00)
freed by thread T0 here:
    #0 0x7fef017a6ffe in __interceptor_realloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dffe)
    #1 0x55f04fce4409 in bit_chain_alloc /home/chiba/libredwg-check/src/bits.c:3026
    #2 0x55f04fce53d8 in bit_copy_chain /home/chiba/libredwg-check/src/bits.c:3314
    #3 0x55f050ef00c6 in obj_flush_hdlstream /home/chiba/libredwg-check/src/encode.c:784
    #4 0x55f051a9d1dd in dwg_encode_PLANESURFACE_private /home/chiba/libredwg-check/src/dwg.spec:8832
    #5 0x55f051a83183 in dwg_encode_PLANESURFACE /home/chiba/libredwg-check/src/dwg.spec:8818
    #6 0x55f051ef41f1 in dwg_encode_variable_type /home/chiba/libredwg-check/src/classes.inc:243
    #7 0x55f051f13dd1 in dwg_encode_add_object /home/chiba/libredwg-check/src/encode.c:3771
    #8 0x55f050f02eb6 in dwg_encode /home/chiba/libredwg-check/src/encode.c:2352
    #9 0x55f04fcbe78d in dwg_write_file /home/chiba/libredwg-check/src/dwg.c:429
    #10 0x55f04fcbaf4f in main /home/chiba/libredwg-check/programs/dwgrewrite.c:349
    #11 0x7fef0137f0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)

previously allocated by thread T0 here:
    #0 0x7fef017a6ffe in __interceptor_realloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dffe)
    #1 0x55f04fce4409 in bit_chain_alloc /home/chiba/libredwg-check/src/bits.c:3026
    #2 0x55f051f12dda in dwg_encode_add_object /home/chiba/libredwg-check/src/encode.c:3490
    #3 0x55f050f02eb6 in dwg_encode /home/chiba/libredwg-check/src/encode.c:2352
    #4 0x55f04fcbe78d in dwg_write_file /home/chiba/libredwg-check/src/dwg.c:429
    #5 0x55f04fcbaf4f in main /home/chiba/libredwg-check/programs/dwgrewrite.c:349
    #6 0x7fef0137f0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)

SUMMARY: AddressSanitizer: heap-use-after-free /home/chiba/libredwg-check/src/bits.c:316 in bit_read_RC
Shadow bytes around the buggy address:
  0x0ffe5f8356b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0ffe5f8356c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0ffe5f8356d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0ffe5f8356e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0ffe5f8356f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0ffe5f835700:[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0ffe5f835710: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0ffe5f835720: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0ffe5f835730: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0ffe5f835740: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0ffe5f835750: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==434628==ABORTING

```




--- end body ---
