Hi,
In release version 0.12.4, (also in the latest commit 45d2a29)

There is heap buffer-overflow in function bit_downconvert_CMC() in bits.c

**reproduce**
./configure --enable-release 
CFLAGS="-fsanitize=address" ./configure --enable-release 
make
./dwgrewrite [poc]

[heap-buffer-overflow-bit_downconvert_CMC.zip](https://github.com/LibreDWG/libredwg/files/6622011/heap-buffer-overflow-bit_downconvert_CMC.zip)

```c
AddressSanitizer: heap-buffer-overflow on address 0x60800000067c at pc 0x55afe2904dea bp 0x7ffef0aafa30 sp 0x7ffef0aafa20
READ of size 4 at 0x60800000067c thread T0
    #0 0x55afe2904de9 in bit_downconvert_CMC /home/chiba/libredwg-check/src/bits.c:2830
    #1 0x55afe2905597 in bit_write_CMC /home/chiba/libredwg-check/src/bits.c:2887
    #2 0x55afe4b411a3 in dwg_encode_entity /home/chiba/libredwg-check/src/common_entity_data.spec:176
    #3 0x55afe3b48880 in dwg_encode_TEXT /home/chiba/libredwg-check/src/dwg.spec:26
    #4 0x55afe4b353cc in dwg_encode_add_object /home/chiba/libredwg-check/src/encode.c:3517
    #5 0x55afe3b24eb6 in dwg_encode /home/chiba/libredwg-check/src/encode.c:2352
    #6 0x55afe28e078d in dwg_write_file /home/chiba/libredwg-check/src/dwg.c:429
    #7 0x55afe28dcf4f in main /home/chiba/libredwg-check/programs/dwgrewrite.c:349
    #8 0x7fc7861cc0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
    #9 0x55afe28dbbad in _start (/home/chiba/libredwg-check/asan-master/bin/dwgrewrite+0x207bad)

0x60800000067c is located 4 bytes to the right of 88-byte region [0x608000000620,0x608000000678)
allocated by thread T0 here:
    #0 0x7fc7865f3dc6 in calloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10ddc6)
    #1 0x55afe2ec16c5 in dwg_setup_UNKNOWN_OBJ /home/chiba/libredwg-check/src/dwg.spec:7005
    #2 0x55afe2ec1cb5 in dwg_decode_UNKNOWN_OBJ /home/chiba/libredwg-check/src/dwg.spec:7005
    #3 0x55afe34439b8 in dwg_decode_add_object /home/chiba/libredwg-check/src/decode.c:5900
    #4 0x55afe29a635f in read_2004_section_handles /home/chiba/libredwg-check/src/decode.c:2928
    #5 0x55afe29fffd0 in decode_R2004 /home/chiba/libredwg-check/src/decode.c:3778
    #6 0x55afe2908735 in dwg_decode /home/chiba/libredwg-check/src/decode.c:252
    #7 0x55afe28deb78 in dwg_read_file /home/chiba/libredwg-check/src/dwg.c:254
    #8 0x55afe28dcb44 in main /home/chiba/libredwg-check/programs/dwgrewrite.c:290
    #9 0x7fc7861cc0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/chiba/libredwg-check/src/bits.c:2830 in bit_downconvert_CMC
Shadow bytes around the buggy address:
  0x0c107fff8070: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
  0x0c107fff8080: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
  0x0c107fff8090: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
  0x0c107fff80a0: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
  0x0c107fff80b0: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
=>0x0c107fff80c0: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00[fa]
  0x0c107fff80d0: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
  0x0c107fff80e0: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
  0x0c107fff80f0: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
  0x0c107fff8100: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c107fff8110: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==2245880==ABORTING
```



heap-buffer-overflow in bit_downconvert_CMC in bits.c
This is a GitHub Issue
repo:libredwg
owner:LibreDWG
Title : heap-buffer-overflow in bit_downconvert_CMC in bits.c
Issue date:

--- start body ---
Hi,
In release version 0.12.4, (also in the latest commit 45d2a29)

There is heap buffer-overflow in function bit_downconvert_CMC() in bits.c

**reproduce**
./configure --enable-release 
CFLAGS="-fsanitize=address" ./configure --enable-release 
make
./dwgrewrite [poc]

[heap-buffer-overflow-bit_downconvert_CMC.zip](https://github.com/LibreDWG/libredwg/files/6622011/heap-buffer-overflow-bit_downconvert_CMC.zip)

```c
AddressSanitizer: heap-buffer-overflow on address 0x60800000067c at pc 0x55afe2904dea bp 0x7ffef0aafa30 sp 0x7ffef0aafa20
READ of size 4 at 0x60800000067c thread T0
    #0 0x55afe2904de9 in bit_downconvert_CMC /home/chiba/libredwg-check/src/bits.c:2830
    #1 0x55afe2905597 in bit_write_CMC /home/chiba/libredwg-check/src/bits.c:2887
    #2 0x55afe4b411a3 in dwg_encode_entity /home/chiba/libredwg-check/src/common_entity_data.spec:176
    #3 0x55afe3b48880 in dwg_encode_TEXT /home/chiba/libredwg-check/src/dwg.spec:26
    #4 0x55afe4b353cc in dwg_encode_add_object /home/chiba/libredwg-check/src/encode.c:3517
    #5 0x55afe3b24eb6 in dwg_encode /home/chiba/libredwg-check/src/encode.c:2352
    #6 0x55afe28e078d in dwg_write_file /home/chiba/libredwg-check/src/dwg.c:429
    #7 0x55afe28dcf4f in main /home/chiba/libredwg-check/programs/dwgrewrite.c:349
    #8 0x7fc7861cc0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
    #9 0x55afe28dbbad in _start (/home/chiba/libredwg-check/asan-master/bin/dwgrewrite+0x207bad)

0x60800000067c is located 4 bytes to the right of 88-byte region [0x608000000620,0x608000000678)
allocated by thread T0 here:
    #0 0x7fc7865f3dc6 in calloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10ddc6)
    #1 0x55afe2ec16c5 in dwg_setup_UNKNOWN_OBJ /home/chiba/libredwg-check/src/dwg.spec:7005
    #2 0x55afe2ec1cb5 in dwg_decode_UNKNOWN_OBJ /home/chiba/libredwg-check/src/dwg.spec:7005
    #3 0x55afe34439b8 in dwg_decode_add_object /home/chiba/libredwg-check/src/decode.c:5900
    #4 0x55afe29a635f in read_2004_section_handles /home/chiba/libredwg-check/src/decode.c:2928
    #5 0x55afe29fffd0 in decode_R2004 /home/chiba/libredwg-check/src/decode.c:3778
    #6 0x55afe2908735 in dwg_decode /home/chiba/libredwg-check/src/decode.c:252
    #7 0x55afe28deb78 in dwg_read_file /home/chiba/libredwg-check/src/dwg.c:254
    #8 0x55afe28dcb44 in main /home/chiba/libredwg-check/programs/dwgrewrite.c:290
    #9 0x7fc7861cc0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/chiba/libredwg-check/src/bits.c:2830 in bit_downconvert_CMC
Shadow bytes around the buggy address:
  0x0c107fff8070: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
  0x0c107fff8080: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
  0x0c107fff8090: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
  0x0c107fff80a0: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
  0x0c107fff80b0: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
=>0x0c107fff80c0: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00[fa]
  0x0c107fff80d0: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
  0x0c107fff80e0: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
  0x0c107fff80f0: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
  0x0c107fff8100: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c107fff8110: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==2245880==ABORTING
```



--- end body ---
