Skip to content

NULL pointer dereference in DXF parser, HATCH code 93 #1468

Closed

Description

@eldstal

Steps to reproduce or sample file

  1. Unzip and load the attached proof of concept file in LibreCAD 2.2.0-rc3

Cause

The std::shared_ptr DRW_Hatch::loop is written to when loading a HATCH entity with code 93. If this occurs before a code 92, the pointer is still NULL, leading to a crash.

Impact

Denial of service.

Proposed Mitigation

Ensure that DRW_Hatch::loop is not NULL before dereferencing at drw_entities.cpp:1808

Operating System and LibreCAD version info

Version: 2.2.0-rc3
Compiler: GNU GCC 7.3.0
Compiled on: Nov 29 2021
Qt Version: 5.12.4
Boost Version: 1.65.1
System: Windows 10 (10.0)

Activity

  1. added a commit that references this issue on Dec 19, 2021
  2. added
    bugAn error which causes unexpected or unintended results
    on Dec 19, 2021
  3. added a commit that references this issue on Jan 4, 2022
  4. lordofbikes commented on Jan 4, 2022

    @lordofbikes
    Member

    fixed with #1469

  5. eldstal commented on Jan 25, 2022

    @eldstal
    ContributorAuthor

    This vulnerability has been assigned CVE-2021-45343.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugAn error which causes unexpected or unintended results

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions