New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
double free in dwg_free #33
Comments
|
I found the fix method is to add a line code in The orgin code: After |
|
Nice |
|
Thanks. Why don't you create a commit to fix it? |
|
Because I'm just busy with something else |
|
And please don't file CVE's for unreleased versions in the future. 0.5.1048 was never a released version, clearly marked as Pre-Release on github. For releases see https://ftp.gnu.org/gnu/libredwg/ |
|
@jinyu00 hi,jinyu00. I want to know that in which branch and which tag this bug be found. |
|
This bug was in 0.5.1048 and fixed in 0.5.1067 (Jul 2018), master. |
thanks to your reply. |
When open the crafted
dwgfile , it could tiggerdouble freeindwg2svg2Let's see the program error output
And the output with asan
According debuging, I found that When open the crafted
dwgfile ,dwg_freecould calldwg_decode_eed, indwg_free_objectfirst, it could calldwg_free_BLOCK_HEADERto free a pointer (for example :0x789430)The backtrace are as below
And then it could call
dwg_free_BLOCK_HEADERagain , it could calldwg_free_eedto free0x789430again.The backtrace are as below
The poc file
The text was updated successfully, but these errors were encountered: