forked from LibreDWG/libredwg
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathChangeLog
15850 lines (10598 loc) · 458 KB
/
ChangeLog
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
Full history from the git log
-----------------------------
2020-01-10 Reini Urban <[email protected]>
Release 0.10.1
de/encode: protect more class overflows and NULL
reset num_classes with r2007. check NULL dwg.
check NULL dwg->classes.
found via fuzzing
remove outdated dejagnu deps
we dont depend on it anymore for some time already
cirrus: add p5-Convert-Binary-C
switch cirrus to freebsd-12-1-snap
See https://cirrus-ci.org/guide/FreeBSD/
They are using Google Cloud Compute images:
13-0-snap, 12-1-snap (stable), 12-1 (release)
12-0, 11-3-snap and 11-3. Not our old image anymore,
hence the python problems
switch cirrus to py37
py36-libxml2 does not exist anymore
dwg2SVG: protect from wrong style
id's 144 and 109 of GH #182
Closes GH #182
htmslescape: fix off-by-one and overflow
ditto.
Fixes GH #182
htmlescape: fix off-by-one and overflow
need \0 termination to do strcat.
don't skip the very first char.
Fixes GH #182
dwg2SVG: skip nan values
dwg2SVG: skip NULL text_value
Fixes Case 1 of GH #182
2020-01-09 Reini Urban <[email protected]>
add reedsolomon.h
we will use it soon
reedsolomon: missing config.h
needed for HAVE_MALLOC_H
consistent logging handlers, no fprintf, stderr in the lib
library users want to catch fprintf and/or stderr.
Closes GH #181
indxf: silence clang -Wdouble-promotion
use (double)NAN, as it's apparently only float there,
__builtin_nanf().
decode eed: accept raw with unknown codes
For dwgrewrite passes it through, and let data be empty.
And fixes a EED raw leak with such unknown codes.
2020-01-08 Reini Urban <[email protected]>
dwgrewrite: fix leaks on early errors
2020-01-08 Reini Urban <[email protected]>
Release 0.10
Major bugfixes:
* Improved building the perl5 binding, proper dependencies.
Set proper -I and -L paths, create LibreDWG.c not swig_perl.c
* Harmonized INDXFB with INDXF, removed extra src/in_dxfb.c (#134).
Slimmed the .so size by 260Kb. Still untested though.
* Fixed encoding of added r2000 AUXHEADER address (broken since 0.9)
* Fixed EED encoding from dwgrewrite (a dxf2dwg regression from 0.9) (#180)
See NEWS and ChangeLog
decode: protect xdata overflows
reset the lengths when stopped reading invalig xdata,
which would overflow later.
api: rename BLOCK_HEADER.preview_data to preview
analog to the entities. In the headers called PreviewIcon.
encode: fix LOG_TF crash on null field
encode: fix EED writing
which was broken with indxf. don't write raw
plus data (from the next indices), when a previous
raw already covered it.
Fixes GH #180
2020-01-07 Reini Urban <[email protected]>
encode: enable TF logging
-v3 or -v5
decode: disable -v5 object_map printing
printing the whole object for the handle (again) makes no sense.
maybe later print the object name of the handle
encode: eed entity formatting logging
fix endless loop in 2004 decompression
on dat overflow.
This fixes all remaining fuzzed dwgrewrite hangs
indxf: fix endless MULTILEADER loop
with unknown DXF groups.
This fixes all fuzzed indxf hangs.
decode: fix a -Wsign-compare
and some -Wformat
protect strncpy from truncation
without ending \0
fix TIMEOUT_30 duplicate
remove the automake hack
decode: fix bytes_left calc. in decompress_R2004_section
and add various counterchecks. missed the final lit_length
2020-01-07 Reini Urban <[email protected]>
hangs: protect from overlarge mallocs
when using user-provided section sizes.
max_decomp_size, decomp_data_size, ... max ~790Mb per compressed section
Fixes a few fuzzer hangs.
2020-01-07 Reini Urban <[email protected]>
indxf: add only full classes
with all names and mandatory DXF fields
2020-01-06 Reini Urban <[email protected]>
dwg: enhance the dxf2dwg timeout to 30
larger DXF need longer
indxf: skip setting buffers twice,
with the exception of 310 previews, as in PROXY_ENTITY
and Surfaces.
indxf: avoid hang when reading illegal numbers
advance the ptr before erroring out
indxf: fix CLASSES hang
2 CLASSES must be followed by 0 CLASS, else
it might realloc constantly, leading to DOS/hang.
faster aligned bit_read_fixed, bit_write_TF
when aligned use memcpy, esp. for large data blocks
indxf: fix double entity.preview write
which would corrupt the previous preview, not matching
the preview_size. we dont append, we rather ERROR
protect bit_utf8_to_TU from invalid UTF-8
count len, not to overflow the utf8 string.
e.g. "4è^C"
indxf: stabilize adding BLOCK_CONTROL.entries
fuzzed DXF could lead to heap overflows (wrong i)
indxf: protect SUMMARY header fields
by checking NULL and the code 1
2020-01-06 Reini Urban <[email protected]>
indxf: fix invalid free of static obj->dxfname
when dxfname came from dwg_encode_get_class() ->
dxf_encode_alias() returning a static string.
This should fix all the remaining fuzzing crashes. (for now)
2020-01-06 Reini Urban <[email protected]>
decode_r2007: protect from section overflow
when reading invalid section pages
decode: protect from empty dat sections r2007+
e.g. wrong summaryinfo, objects or handles.
some of these dont return a critical error
protect xdata overflows
in encode and decode. proper error handling, esp. with fuzzed wrong data.
Update docs for 2020
encode: add LOG_INSANE_TF EED logging
still broken. GH #180
Bump Copyright years to 2020
of all changed files so far, with more than a few lines
encode: add LOG_TF from decode
fixes xdata[] binary logging
2020-01-06 Reini Urban <[email protected]>
Add AFL_COMPILER persistent llvm_mode support to dwgrewrite
Instrument overly long functions as such.
Support persistent llvm_mode, via afl-clang-fast for dwgrewrite.
export AFL_PATH=/usr/local/lib/afl
PERL=cperl5.30.0-nt \
CC="afl-clang-fast" \
CFLAGS="-O2 -g -fsanitize=address,undefined -fno-omit-frame-pointer" \
../configure --disable-shared --disable-dxf --disable-bindings
export ASAN_OPTIONS="abort_on_error=1:detect_leaks=0:symbolize=0:allocator_may_return_null=1"
AFL_USE_ASAN=1 make -j4 -s -C src
AFL_USE_ASAN=1 make -j4 -s -C programs dwgrewrite
AFL_SKIP_CPUFREQ=1 afl-fuzz $@ -m none -i ../.fuzz-in -o .fuzz-out programs/dwgrewrite -v0 @@ /dev/null
2020-01-06 Reini Urban <[email protected]>
decode: eed logging
searching EED leaks with fuzzed DWGs.
let the last invalid EED[idx] leak in this case
init bit_read_TF
when bit_read_fixed failed earlier with overflows,
set the bits to 0. valgrind with fuzzing
2020-01-06 Reini Urban <[email protected]>
api: add int *isnew param to all dynapi _utf8text functions
we really need to know exactly if the returned string is freshly
malloced (from a r2007+ wide string), or the original string,
which may NOT be freed.
Fixes the remaining fuzzing double-free's, where the dwg/obj
version or string TF type might disagree. Tried hard to avoid this.
2020-01-06 Reini Urban <[email protected]>
dwg_find_dictionary: add NULL ptr protections
indxf: add xcalloc, exit on Out of Memory
indxf: protect invalid double DOS
advance endptr, with nums like 28ABC....
indxf: protect invalid DIMASSOC_Ref index
indxf: protect DIMSTYLE_CONTROL.morehandles[j]
gracefully
fixup check bytes_left for decompress_R2004_section 32bit
the overflow check does not work with 32bit, only 64.
Fixes up 80d17da65507ca1242c48ffe3b31afa48a0859aa
2020-01-05 Reini Urban <[email protected]>
Update NEWS
dxf_read_file: properly end DXF
with a final \n and \0 for libc strtol/strtod readers,
to avoid internal errors on truncated files we cannot avoid.
indxf: more truncated DXF protections
but not exhaustive. We really need to add a final \n to the read chain
indxf: stricter MLEADER subclasses
On unknown DXF code break the loop, and continue
with the main MLEADER loop. Add a few more array index asserts.
Fixes a few fuzzing cases.
indxf: protect from MLEADER blk/txt mixup
a union
2020-01-04 Reini Urban <[email protected]>
indxf: fix truncated dxf
gracefully end on EOF or invalid ctrl object.
prevent indxf buf and most dat overflows.
indxf: fix double-free of BLOCK_HEADER.*Model_Space
when reusing it. Check if not already done before
fix dwgrewrite for preR13 with VPORT_ENTITY table
yet unsupported, dont add its num_objects to the table.
auxheader: protect from NULL HEADER.HANDSEED
usually with encode
encode: protect from NULL obj->parent
when erroring out early
decode_r2007: add decode_rs src overflow check
add the size of the src, to overvoid reading past it.
and use the actual computed src_size args, not the user-provided ones.
improve r2007 copy_compressed_bytes check
check for overflows before the loop. better than
c893d847716aa6d64c2ff25834c80b43c4806f9b
check bytes_left for decompress_R2004_section
Fixes heap overflows with fuzzed section values
fix bit_read_fixed overflow
fix bit_search_sentinel overflow
with empty dat chain
indxf: add_SPLINE cosmetics
indxf: set WIPEOUT.clip_verts[]
num_clip_verts got reset every pair
indxf: dxf sources are always utf8
for dynapi. without is_utf we assume the source is already TU.
no changes <r2007.
indxf: convert *Model_Space name to TU earlier
when $ACADVER is read.
more dwg_find_tablehandle protections
and some cosmetics.
analyzing a r2007 *Model_Space use-after-free
where BLOCK_HEADER.name stays the initial <r2007, due
to DXF errors.
indxf: protect from some NULL _obj->name
Fixes a few fuzzing cases
encode: fix 2NDHEADER address
needs to be recomputed, even with dwgrewrite.
Fixes section[3] address or size overflow with r2000 DWGs
encode: detect section address or size overflow
already in encode, not just later in decode.
i.e. only with r2000 DWGs
encode: always set 2ndheader section addresses
even with dwgrewrite.
dwgrewrite: fix filename_out leaks
use a var when suffix is used.
dxf2dwg, dwg2dxf: allow /dev/null sinks
dwg_write_file: allow /dev/null sink
2020-01-03 Reini Urban <[email protected]>
indxf: fix TABLESTYLE rowstyles init
indxf: more NULL pair protections
dwg2svg2: protect from empty BLOCK_HEADERs
name is not really needed
add r2007 Page out of bounds check
Fixes case 1 of GH #179
fix bit_search_sentinel out of range check
off by 16, the sentinel length. Fixes case 2 of GH #179
fix read_R2004_section_info out of range check
forgot 32. Fixes case 3 of GH #179
protect r2007 section.num_pages overflow
skip section when >0xf0000. Fixes case 4 if GH #179
protect r2007 decode compression length
length is a user value, add src_end. Fixes GH #179, case 5
Fix NULL ptr deref in get_next_owned_entity
Fixes case 6 in GH #179
dwg2svg2: fail on NULL _hdr
Fixes GH #179, id:000026 (case 7)
dwg: add missing dynapi.h
code added with 0.9,
commit 359502ac86b389b248a9080c9ba8462aff1058ee
relevant only for --disable-dxf
indxf: more NULL pair protections
2020-01-03 Reini Urban <[email protected]>
api: move 2 DIMENSION handles to DIMENSION_COMMON
with in_dxf when changing the type this would change the
offset of DIMENSION.block and DIMENSION.dimstyle, leading
to invalid pointers. found via fuzzing, fixes 3 cases.
TODO: block has still DXF code 0, maybe indxf read DXF 2 into that.
Need a testcase for that.
2020-01-03 Reini Urban <[email protected]>
encode: add OVERFLOW_NULL_CHECK_LV
to check the ptr before loops
2020-01-03 Reini Urban <[email protected]>
indxf: skip creating empty invalid objects
rather dont create them than leaving them without type or name.
not unknown, but DWG_TYPE_UNUSED.
We dont want to check all object[i] loops.
Reverts the previous commit for a fuzzing testcase.
2020-01-03 Reini Urban <[email protected]>
dwg_find_table_control: protect from NULL object.name
which might happen somehow via fuzzing.
indxf: LEADER.points array protections
with asserts
indxf: replace IMAGE.clip_verts asserts
with graceful logic. Actually failed in the good tests,
not just with fuzzing
indxf: IMAGE.clip_verts array protections
with asserts
indxf: add_HATCH array protections
with asserts
indxf: add_SPLINE array protections
but here do it gracefully, no asserts
indxf: more eed point protections
indxf: add new_LWPOLYLINE asserts
on illegal array accesses. Here we rather abort.
indxf: NULL pair protections in new_LWPOLYLINE
fixes a few fuzzing cases
fix bit_write_CRC* overflows
analog to read, fixes some fuzzing cases
dwg2dxf: fix leaks on section overflow error
2020-01-02 Reini Urban <[email protected]>
indxf: protect eed points with wrong codes
found via fuzzing
indxf: some more ptr protections
fix strange dwg_class_is_entity miscompilation
where it returned wrong results.
(comparing a short field with an const int, without zeroing the previous short)
Add various measures.
indxf: fix postprocess_SEQEND use-after-free
the owner handles are used, they are not copied.
2020-01-02 Reini Urban <[email protected]>
fix write-as leaks
In free check from_version in the spec, not
the version we were last using (writing to).
Fixes most dwgrewrite leaks, just one eed leak remaining,
from the 2nd r2000 read.
2020-01-02 Reini Urban <[email protected]>
bits: avoid uninitialized reads on bit realloc
in bit_calc_CRC
encode: Fix -Wpointer-bool-conversion
address of data->u.eed_0.string is always true
encode: fix Too many sections
when down-converting from r2004+ to r2000, with
typically 10-30 num_sections.
enable dwgrewrite with --disable-dxf
for fuzzing
api: Add LIBREDWG_VERSION et al to include/dwg.h
api: renamed CLASS.wasazombie to is_zombie
i.e. was_proxy, or class not loaded
indxf: is_entity logging for CLASS 281
adjust dynapi_test for LAYER_INDEX
layer_entries was renamed with e3374397f386fd1b38b8d732a6ef601ddf7ec592
(0.9) and then later again.
adjust dynapi_test for SORTENTSTABLE
sort_handles was renamed with e3374397f386fd1b38b8d732a6ef601ddf7ec592
(0.9)
dynapi: add nan checks TODO
add DEBUGGING_CLASS_CPP
and use it for TABLECONTENT.
This is more stable than CLASS_DXF in cases when
TABLE is mixed up with TABLECONTENT. See e.g.
GH #178, where it fixes the heap_overflow2 case.
prepare 0.10 NEWS
2020-01-01 Reini Urban <[email protected]>
decode ERROR cosmetics
api: remove DWG_SUPERTYPE_UNKNOWN fully
we now have only entity or object, unknown_bits
are parts of these.
xmlsuite: proper add_helix
indxf: fix num_entries/i underflow
for the i = -1 case. (Fuzzing)
free: fix invalid dwg_free_LAYOUT
dynapi: remove UNKNOWN tests
as the obj->name does not fit the fixedtype anymore
for partially handled classes, like TABLE or ARC_DIMENSION
2019-12-31 Reini Urban <[email protected]>
cleanup tio.unknown
not needed anymore, we only have UNKNOWN_OBJ or UNKNOWN_ENT with full common
entity_data.
Fixes GH #178 heap_overflow2
encode: object.size overflow
decode fails when it overflows, but encode does not
know its final dat->size, so introduce a sensible limit.
Fixes the dos testcase of GH #178
decode: protect from preR13 section size overflow
More fuzzing testcase in GH #176 with some broken
sections
decode: protect from section size/address overflow
There is one fuzzing testcase in GH #176 with some broken
sections
dwg_free_object: avoid uninitialized is_entity warning
even if logically impossible.
encode: protect dwg_encode_eed_data overflows
encode: protect NULL eed string
indxf: more NULL ptr protections
fixes more fuzzer testcases
free: protect freeing obj->dxfname
dont set INDXF when HANDSEED is missing.
e.g. GH #178 null_pointer2 testcase
indxf: fix rootcause for prev. commit
Fail on duplicate CLASS groups, i.e. when O CLASS is replaced
by 2 CLASS.
free: fail on Wrong DATATABLE.type 529
for obj [index]: != MULTILEADER.
wrong class, maybe a dwg_encode_get_class() failure.
Fixes several fuzzing crashes.
encode: fix empty FIELD_2DD_VECTOR
Fixes GH #178 null_pointer1 case
encode: protect from stack under-flow
From GH #178 fuzzing
encode: protect some NULL pointers
Fixes some GH #178 fuzzing
2019-12-30 Reini Urban <[email protected]>
indxf: fix r2007+ dwg_find_tablehandle() leaks
dwg_find_tablehandle searches by name, dwg_dynapi_entity_utf8text creates
fresh utf8 names, which were not freed.
This fixed now most of the indxf leaks, GH #151
2019-12-30 Reini Urban <[email protected]>
free: fix more indxf leaks
the underlying cause is that indxf already adds
DEBUGGING classes, for which no dwg_free_OBJECT code exists.
i.e. TABLE.preview (common entity data), or TABLE colors.
Let dwg_free_UNKNOWN_ENT handle that and leak the rest
classes.inc: formatting only
2019-12-30 Reini Urban <[email protected]>
fixup indxf, wrong NULL pair check
at dwg_read_dxf the initial pair is NULL,
so empty DWGs were produced.
also harmonize dat opts with dwg opts
2019-12-30 Reini Urban <[email protected]>
programs leaks comments
indxf: fix name "*Model_Space" free
must not be constant. broken with
27a4380702667391668d4693ea7bdfdc9cf823c7
indxf: more pair NULL protections
found via fuzzing
indxf: protect types in dxf_blocks_read
when reading mspace or pspace BLOCK's, its owners are
not a BLOCK_HEADER, but BLOCK_CONTROL.
Found via fuzzing
2019-12-29 Reini Urban <[email protected]>
more free indxf fuzzing fixes
skip color names, not assigned yet, and failing.
only free unknown if type is UNKNOWN, otherwise
it will free illegal reactors, ...
indxf: protect NULL pair
this time in dxf_classes_read. Fixes some fuzzer cases
in_dxf: improve new_object speed by 2x
make ADD_OBJECT/ADD_ENTITY linear search 2x faster, by aborting
on found.
improve dwg_encode_get_class
require more than one invalid klass->dxfname to switch
over to search by index, and never do it with indxf, because
there we do have the proper name already, and we just need the dynamic type
Fix off-by-one class indices
encode: protect from NULL klass->dxfname
only relevant with fuzzed dxf data.
rm .build-asan/dxf-check
accidently added
decode, dwg.h: add more restrict
2019-12-29 Reini Urban <[email protected]>
indxf: protect NULL pair
in dxf_header_read on overflowed values.
try a 2nd time then.
Fixes ERROR: dxf_read_rs: RS overflow 860276 (at 314)
ERROR: Invalid DXF group code: 8308
Segmentation fault (core dumped)
2019-12-29 Reini Urban <[email protected]>
indxf: protect null-dereference in dxf_fixup_header
found by fuzzing dxf2dwg
define 2 pline api funcs for afl-fuzz
needed by dwg2ps.
fix outdxf cquote buffer-overflow
stack or heap, detected by fuzzing. using for cquote 2*len+1 is enough,
but also protect from stack-overflow in cquote and json_cquote.
encode: add missing restrict
dxf <=> dwg helper
harmonize helpers, analog to log.
log creates a dwgread log file.
dxf should create a dxf from dwg,
dwg should create a dwg from dxf.
free: enable indxf VALUE_HANDLE logic
actually set dat->opts to detect global HULL handles,
which may not be double-freed
2019-12-29 Reini Urban <[email protected]>
alive.test: skip dxf2dwg leak test
this helps under asan/lsan when custom ASAN_OPTIONS are set.
writers do not hang anymore.
2019-12-29 Reini Urban <[email protected]>
indxf: clear realloced buffers
avoid uninitialized data and pointers, esp. for free
and valgrind.
indxf move_out_BLOCK_CONTROL: fix for j>1
when pspace is at entry 2 we need to avoid a classic heap-overflow
XDICOBJHANDLE
when add xdicobjhandle ref failed, set xdic_missing_flag
dxf: support --force-free
as dxf2dwg does. needed for leak debugging
harmonize some ACIS ERROR newlines
make: extract VALGRIND_OPTS for check-dwg-valgrind
it is now overridable
add LTEXEC for --enable-shared (the default)
for some top test targets
add dwg helper for dwg2dxf analog to dxf
Maybe the name is a bit unfortunate, but it is only
an internal helper
free: omit Free object pointer
so that all logs are diffable
fix MULTILEADER.ctx.lline[] handles <r2010+
unlike ODA I dont see them in the wild, only r2010+.
the logs do make sense now.
fix SummaryInfo leak
when summaryinfo.spec fails in one field
we forgot to restore dat (harmless), also to free
the decomp chain. E.g. DS_libereco_R2010.dwg
fix entity.ownerhandle leak
the double-free from #43 was fixed with 38bc21c643451c2e31af0cc631cc7d651b310e54.
ownerhandles are not really stored in the ref vector.
outdxf: fix null-dereference in dxf_process_INSERT
detected via dwg2dxf fuzzing
*.spec formatting
space after (
but beware of gen-dynapi.c: no wrapping in REPEAT or FIELD
common_entity_handle_data.spec formatting
space after (
fix eed leaks with UNKNOWN objects
when the overflowed early.
Found via fuzzing.
2019-12-29 Reini Urban <[email protected]>
Support SHAPE.style_id for DXF as name [2]
renamed from SHAPE.shape_no (changed API).
for out_dxf look up the name from the STYLE index,
for in_dxf still ignored.
BTW: We still don't have a testcase for SHAPE, but the afl
fuzzer was nice to create a proper one to detect this case!
2019-12-29 Reini Urban <[email protected]>
free: fix VALUE_HANDLE for INDXF
NULLIFY ref only if really freed. Fixes a few leaks and double-frees.
make -C src .ic: keep a physical backup, not just in git
2019-12-28 Reini Urban <[email protected]>
free: fix the dxf pair leaks
before each new_object.
The INDXF obj->dxfname is heap allocated, the obj->name const.
Biggest part of #151
Now leftovers are mostly some dynamic dynapi strings and SPLINE callocs.
2019-12-28 Reini Urban <[email protected]>
free: more indxf leaks
free pair on DXF_CHECK_EOF, DXF_RETURN_EOF. GH #151
free: work on indxf leaks
Keep the first BLOCK_HEADER name static, as all the others.
See GH #151
adjust gen-dynapi.pl line numbers +1 not -1
2019-12-27 Reini Urban <[email protected]>
dxf2dwg: add experimental --force-free option
to be able to debug into dwg_free leaks, as found by
valgrind
outdxf: protect from NULL HATCH.boundary_handles
found via fuzzing
outdxf: fix some dxf_tables_write null-dereferences
leading to fuzzing crashes
outdxf: fix 1 dxf_classes_write null-dereferences
leading to fuzzing crashes
outdxf: fix 3 header null-dereferences
leading to fuzzing crashes
No -Wformat-truncation warnings anymore.
Add an assert. The old code ran out of var-tracking size,
but the assert now makes it clear.
indxf: fix some nonnull warnings
Fix some -Wunused-but-set-variable
detected by clang-analyzer
Avoid -Wformat-truncation, add RETURNS_NONNULL attribute
mark dxf_format() and dxf_codepage() as __attribute__((returns_nonnull)),
avoiding clang warnings warning: null format string [-Wformat-truncation=]
snprintf (buf, 255, _fmt, value);
indxfb: fix dxf_read_rd
copy pasta
indxf: fix -Wformat with 32bit
2019-12-26 Reini Urban <[email protected]>
indxf: init MLEADER counts
in REPEAT check num_vars before accessing the array,
which might still be NULL. esp. with indxf
indxf: fix DXF_*_EOF logic
treat NULL pair as EOF, and return immediately
indxf: support 3DSOLID.history_id
and for all its children (AcDb3dSolid). r2007+
indxf: fix color.alpha
at least since r2007 alpha is seperately at 440
indxf: dxf_read_pair() pair leak
indxf: dxf_thumbnail_read pair leak
indxf dxf_expect_code: use-after-free
and -Wnull-dereference
fix decomp leak in read_2004_compressed_section
with empty sections
fix preR13 PREP_TABLE memory leak
fix dwg2dxf filename_out memory leak
fix some dwg_api point memory leaks
refactor perl5 bindings
set proper -I and -L paths, create LibreDWG.c not swig_perl.c
fix dwgwrite outfile memory leak
fix 2 dwgrewrite filename_out memory leaks
indxf: fix postprocess_SEQEND memory leak
indxf new_object: -Wnull-dereference
(the last one)
indxf new_LWPOLYLINE: fix 91 vertexids type
detected by scan-build
in_dxf add_MULTILEADER_leaders: fix -Wnull-dereference
Harmonize out_dxfb.c with out_dxf.c
Fixes GH #173, esp. add the new mspace improvements.
in_dxf add_MULTILEADER_lines: fix -Wnull-dereference
dxf_header_read: add a strlen nonnull check
dxf_tables_read: -Wnull-dereference
abstract DWG_OPTS for dat->opts and dwg->opts
use constants
2019-12-26 Reini Urban <[email protected]>
remove in_dxfb.c GH #134
add some is_binary logic to in_dxf.c
use dat->opts flag 0x20 for DXFB
reduced size of the .so from 30521368 - 30260552 = 260816 byte.
It should be a bit slower though, but many indxf funcs are now static,
and there are no silly code duplicates anymore.
Closes GH #134
2019-12-26 Reini Urban <[email protected]>
in_dxfb.c: merge with in_dxf.c
add all the missing logic.
See GH #134, we really wanted to avoid that code duplication.
2019-12-26 Reini Urban <[email protected]>
in_dxf: pair->value.s nonnull as version
Argument with 'nonnull' attribute passed null
in_dxf: STRADD pair->value.s nonnull
Argument with 'nonnull' attribute passed null
STRADD with NULL pair->value.s
sec_dat.chain nonnull
Argument with 'nonnull' attribute passed null
Harmonize read_2004_section_preview with r2007 variant,
sec_dat.chain could be NULL
Type casting inconsistency #174
Avoid overflows by casting to the larger type, zero-extended
2019-12-25 Reini Urban <[email protected]>
examples: add unknown.pi to EXTRA_DIST
make unknown didnt work in checkouts with picat
Makefile: refman-pdf is not a prime-target
and does not work
2019-12-25 Reini Urban <[email protected]>
Release 0.9.3
2019-12-25 Reini Urban <[email protected]>
enable ax_restrict
re-format docs: autoconf-archive is pretty strict
gcc-9.2 on fedora has it fixed.
enable it. we do have several small inlined functions with loops on arrays,
so it might affects us. See GH #141
2019-12-25 Reini Urban <[email protected]>
fix -Wcpp warning with AX_ADD_FORTIFY_SOURCE
protect from invalid preR13 table numbers
various int overflows. Fixes GH #176, case 8.
add more preR13 error handling.
Fixes the remaining GH #176 case 9
more illegal preR13 protections
and optional byte overflow counter to abort >200
errors. Helpful in fuzzing, but not really useful for
libs, the program must install a SIGABRT handler then.
Fixes part of the remaining GH #176 case 9 (id:000024)
2019-12-24 Reini Urban <[email protected]>
fix REPEAT overflow check for <r2004
earlier DWGs can also be broken to include wrong REPEAT counts.
Fixes Case 3 of GH #176
fix ref double-free on error
Let the ref loop in dwg_free() free those refs.
Fixes case 5 of GH #176.
fix illegal SPLINE scenarios
from fuzzed DWGs, See GH #176, case 1
2019-12-20 Reini Urban <[email protected]>
fix dwg_find_table_extname -Wnull-dereference
use format(ms_printf) only on _WIN32
silences a few warnings
fix theoretical strncpy truncations
gcc-9 warns too much to my taste.
2019-11-07 Reini Urban <[email protected]>
geom: fix transform_OCS
normalized the wrong vector, ax => az typo,
worked with random stack values.
fix PROXY_ENTITY.ownerhandle leak
found in example r13 DWGs
extnames: add documentation
Closes GH #167
dwg_find_table_extname improved
find more ACAD_XREC_ROUNDTRIP, not only at the first index.
find the correct XRECORD via the xdic itemhandles[], no need to search
the next or all XRECORDs
extnames: only for r13-r14
EXTNAMES do not exist since r2000. just ignore it