## Affected version 

the latest commit: https://github.com/LibreDWG/libredwg/tree/45d2a290c65ed691be0901ba2b2ef51044e07a16 and 0.12.4

## What's the problem?


A stack buffer overflow was discovered in dwg_dynapi_entity_value in gen-dynapi.pl.

ASAN report:

```
==2500853==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fffffffbfa8 at pc 0x00000049718a bp 0x7fffffffbc10 sp 0x7fffffffb3d8
WRITE of size 72 at 0x7fffffffbfa8 thread T0
    #0 0x497189 in __asan_memcpy /src/llvm-project-12.0.0.src/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3
    #1 0xd738f2 in memcpy /usr/include/x86_64-linux-gnu/bits/string_fortified.h:34:10
    #2 0xd738f2 in dwg_dynapi_entity_value /src/libredwg/src/gen-dynapi.pl:2766:7
    #3 0x1a8df9d in new_object /src/libredwg/src/in_dxf.c:11220:23
    #4 0x1a78816 in dxf_objects_read /src/libredwg/src/in_dxf.c:12301:22
    #5 0x1a6d0f9 in dwg_read_dxf /src/libredwg/src/in_dxf.c:12838:23
    #6 0x4cb82a in dxf_read_file /src/libredwg/src/dwg.c:381:13
    #7 0x4c91c4 in main /src/libredwg/programs/dxf2dwg.c:312:15
    #8 0x7ffff7c580b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
    #9 0x41c40d in _start (/mnt/disk/out/libredwg/programs_asan/dxf2dwg+0x41c40d)

Address 0x7fffffffbfa8 is located in stack of thread T0 at offset 680 in frame
    #0 0x1a81d3f in new_object /src/libredwg/src/in_dxf.c:8772

  This frame has 51 object(s):
    [32, 112) 'ctrlname' (line 8778)
    [144, 224) 'subclass' (line 8779)
    [256, 512) 'text' (line 8780)
    [576, 580) 'j' (line 8788)
    [592, 596) 'k' (line 8788)
    [608, 612) 'l' (line 8788)
    [624, 626) 'flag' (line 8793)
    [640, 641) 'scale_flag' (line 8794)
    [656, 680) 'pt' (line 8795)
    [720, 721) 'is_xref_ref' (line 8950) <== Memory access at offset 680 partially underflows this variable
    [736, 744) 'width_factor' (line 8966) <== Memory access at offset 680 partially underflows this variable
    [768, 776) 'hdls' (line 9115)
    [800, 804) 'num_entries' (line 9116)
    [816, 824) 'handle12421' (line 9158)
    [848, 856) 'inserts' (line 9423)
    [880, 884) 'num_inserts' (line 9425)
    [896, 900) 'revision_major' (line 9671)
    [912, 914) 'revision_minor1' (line 9672)
    [928, 930) 'revision_minor2' (line 9673)
    [944, 953) 'revision_bytes' (line 9674)
    [976, 1015) 'revision_guid' (line 9678)
    [1056, 1068) 'u13998' (line 9680)
    [1088, 1089) 'bit' (line 9734)
    [1104, 1106) 'ver' (line 9838)
    [1120, 1122) 'ver14611' (line 9849)
    [1136, 1184) 'color15069' (line 10024)
    [1216, 1217) 'linewt15544' (line 10202)
    [1232, 1233) 'dataflags' (line 10302)
    [1248, 1328) 'key' (line 10403)
    [1360, 1364) 'num_clip_verts' (line 10792)
    [1376, 1384) 'clip_verts' (line 10793)
    [1408, 1416) 'pts' (line 10865)
    [1440, 1480) 'fieldname' (line 10930)
    [1520, 1528) 'ang' (line 10988)
    [1552, 1560) 'd2t' (line 11006)
    [1584, 1592) 'ref17657' (line 11019)
    [1616, 1664) 'color17910' (line 11128)
    [1696, 1697) 'z_is_zero' (line 11273)
    [1712, 1720) 'matrix' (line 11295)
    [1744, 1748) 'unique' (line 11325)
    [1760, 1768) 'ref18480' (line 11339)
    [1792, 1800) 'ref18507' (line 11359)
    [1824, 1840) 'pt2' (line 11401)
    [1856, 1904) 'color18693' (line 11428)
    [1936, 1944) 'handle18831' (line 11479)
    [1968, 1969) 'flags' (line 11513)
    [1984, 1985) 'flags18957' (line 11528)
    [2000, 2001) 'flags18978' (line 11543)
    [2016, 2024) 'ptr' (line 11583)
    [2048, 2056) 'ang19733' (line 11803)
    [2080, 2088) 'ang19780' (line 11815)
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow /src/llvm-project-12.0.0.src/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy
Shadow bytes around the buggy address:
  0x10007fff77a0: f1 f1 f1 f1 00 00 00 00 00 00 00 00 00 00 f2 f2
  0x10007fff77b0: f2 f2 00 00 00 00 00 00 00 00 00 00 f2 f2 f2 f2
  0x10007fff77c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff77d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff77e0: f2 f2 f2 f2 f2 f2 f2 f2 04 f2 04 f2 04 f2 02 f2
=>0x10007fff77f0: 01 f2 00 00 00[f2]f2 f2 f2 f2 f8 f2 f8 f2 f2 f2
  0x10007fff7800: f8 f2 f2 f2 f8 f2 f8 f2 f2 f2 f8 f2 f2 f2 f8 f2
  0x10007fff7810: f8 f2 f8 f2 f8 f2 f8 f8 f2 f2 f8 f8 f8 f8 f8 f2
  0x10007fff7820: f2 f2 f2 f2 f8 f8 f2 f2 f8 f2 f8 f2 f8 f2 f8 f8
  0x10007fff7830: f8 f8 f8 f8 f2 f2 f2 f2 f8 f2 f8 f2 f8 f8 f8 f8
  0x10007fff7840: f8 f8 f8 f8 f8 f8 f2 f2 f2 f2 f8 f2 f8 f2 f2 f2
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==2500853==ABORTING
```


## Compile command

```
CC="clang" CFLAGS="-O1 -g -fsanitize=address" ./configure --enable-release --disable-shared && make
```

## How can we reproduce the issue?

```
unzip tests_64237.zip
dxf2dwg ./tests_64237 -o /dev/null
```
POC file :  
[tests_64237.zip](https://github.com/LibreDWG/libredwg/files/6629621/tests_64237.zip)


Stack-buffer-overflow in dwg_dynapi_entity_value in gen-dynapi.pl
This is a GitHub Issue
repo:libredwg
owner:LibreDWG
Title : Stack-buffer-overflow in dwg_dynapi_entity_value in gen-dynapi.pl
Issue date:

--- start body ---
## Affected version 

the latest commit: https://github.com/LibreDWG/libredwg/tree/45d2a290c65ed691be0901ba2b2ef51044e07a16 and 0.12.4

## What's the problem?


A stack buffer overflow was discovered in dwg_dynapi_entity_value in gen-dynapi.pl.

ASAN report:

```
==2500853==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fffffffbfa8 at pc 0x00000049718a bp 0x7fffffffbc10 sp 0x7fffffffb3d8
WRITE of size 72 at 0x7fffffffbfa8 thread T0
    #0 0x497189 in __asan_memcpy /src/llvm-project-12.0.0.src/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3
    #1 0xd738f2 in memcpy /usr/include/x86_64-linux-gnu/bits/string_fortified.h:34:10
    #2 0xd738f2 in dwg_dynapi_entity_value /src/libredwg/src/gen-dynapi.pl:2766:7
    #3 0x1a8df9d in new_object /src/libredwg/src/in_dxf.c:11220:23
    #4 0x1a78816 in dxf_objects_read /src/libredwg/src/in_dxf.c:12301:22
    #5 0x1a6d0f9 in dwg_read_dxf /src/libredwg/src/in_dxf.c:12838:23
    #6 0x4cb82a in dxf_read_file /src/libredwg/src/dwg.c:381:13
    #7 0x4c91c4 in main /src/libredwg/programs/dxf2dwg.c:312:15
    #8 0x7ffff7c580b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
    #9 0x41c40d in _start (/mnt/disk/out/libredwg/programs_asan/dxf2dwg+0x41c40d)

Address 0x7fffffffbfa8 is located in stack of thread T0 at offset 680 in frame
    #0 0x1a81d3f in new_object /src/libredwg/src/in_dxf.c:8772

  This frame has 51 object(s):
    [32, 112) 'ctrlname' (line 8778)
    [144, 224) 'subclass' (line 8779)
    [256, 512) 'text' (line 8780)
    [576, 580) 'j' (line 8788)
    [592, 596) 'k' (line 8788)
    [608, 612) 'l' (line 8788)
    [624, 626) 'flag' (line 8793)
    [640, 641) 'scale_flag' (line 8794)
    [656, 680) 'pt' (line 8795)
    [720, 721) 'is_xref_ref' (line 8950) <== Memory access at offset 680 partially underflows this variable
    [736, 744) 'width_factor' (line 8966) <== Memory access at offset 680 partially underflows this variable
    [768, 776) 'hdls' (line 9115)
    [800, 804) 'num_entries' (line 9116)
    [816, 824) 'handle12421' (line 9158)
    [848, 856) 'inserts' (line 9423)
    [880, 884) 'num_inserts' (line 9425)
    [896, 900) 'revision_major' (line 9671)
    [912, 914) 'revision_minor1' (line 9672)
    [928, 930) 'revision_minor2' (line 9673)
    [944, 953) 'revision_bytes' (line 9674)
    [976, 1015) 'revision_guid' (line 9678)
    [1056, 1068) 'u13998' (line 9680)
    [1088, 1089) 'bit' (line 9734)
    [1104, 1106) 'ver' (line 9838)
    [1120, 1122) 'ver14611' (line 9849)
    [1136, 1184) 'color15069' (line 10024)
    [1216, 1217) 'linewt15544' (line 10202)
    [1232, 1233) 'dataflags' (line 10302)
    [1248, 1328) 'key' (line 10403)
    [1360, 1364) 'num_clip_verts' (line 10792)
    [1376, 1384) 'clip_verts' (line 10793)
    [1408, 1416) 'pts' (line 10865)
    [1440, 1480) 'fieldname' (line 10930)
    [1520, 1528) 'ang' (line 10988)
    [1552, 1560) 'd2t' (line 11006)
    [1584, 1592) 'ref17657' (line 11019)
    [1616, 1664) 'color17910' (line 11128)
    [1696, 1697) 'z_is_zero' (line 11273)
    [1712, 1720) 'matrix' (line 11295)
    [1744, 1748) 'unique' (line 11325)
    [1760, 1768) 'ref18480' (line 11339)
    [1792, 1800) 'ref18507' (line 11359)
    [1824, 1840) 'pt2' (line 11401)
    [1856, 1904) 'color18693' (line 11428)
    [1936, 1944) 'handle18831' (line 11479)
    [1968, 1969) 'flags' (line 11513)
    [1984, 1985) 'flags18957' (line 11528)
    [2000, 2001) 'flags18978' (line 11543)
    [2016, 2024) 'ptr' (line 11583)
    [2048, 2056) 'ang19733' (line 11803)
    [2080, 2088) 'ang19780' (line 11815)
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow /src/llvm-project-12.0.0.src/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy
Shadow bytes around the buggy address:
  0x10007fff77a0: f1 f1 f1 f1 00 00 00 00 00 00 00 00 00 00 f2 f2
  0x10007fff77b0: f2 f2 00 00 00 00 00 00 00 00 00 00 f2 f2 f2 f2
  0x10007fff77c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff77d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff77e0: f2 f2 f2 f2 f2 f2 f2 f2 04 f2 04 f2 04 f2 02 f2
=>0x10007fff77f0: 01 f2 00 00 00[f2]f2 f2 f2 f2 f8 f2 f8 f2 f2 f2
  0x10007fff7800: f8 f2 f2 f2 f8 f2 f8 f2 f2 f2 f8 f2 f2 f2 f8 f2
  0x10007fff7810: f8 f2 f8 f2 f8 f2 f8 f8 f2 f2 f8 f8 f8 f8 f8 f2
  0x10007fff7820: f2 f2 f2 f2 f8 f8 f2 f2 f8 f2 f8 f2 f8 f2 f8 f8
  0x10007fff7830: f8 f8 f8 f8 f2 f2 f2 f2 f8 f2 f8 f2 f8 f8 f8 f8
  0x10007fff7840: f8 f8 f8 f8 f8 f8 f2 f2 f2 f2 f8 f2 f8 f2 f2 f2
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==2500853==ABORTING
```


## Compile command

```
CC="clang" CFLAGS="-O1 -g -fsanitize=address" ./configure --enable-release --disable-shared && make
```

## How can we reproduce the issue?

```
unzip tests_64237.zip
dxf2dwg ./tests_64237 -o /dev/null
```
POC file :  
[tests_64237.zip](https://github.com/LibreDWG/libredwg/files/6629621/tests_64237.zip)


--- end body ---
