newsLibreDWG - News


libredwg-0.12.1 released

Item posted by Reini Urban <reini_urban> on Sun 31 Jan 2021 05:04:34 PM UTC.

LibreDWG version 0.12.1 - 2021/01/31 - beta:

Major bugfixes:
  * fixed dwg_bmp() and dwgbmp for >= r2004. Wrong dat offset.
  * Fixed EED with code 3 for layer handles. (Fixes GH #310, shanzhugit)
  * Fixed bit_convert_TU utf8 conversion with ubsan, wrong endian-ness.
  Various fuzzing errors detected and fuzzed by Chew Kin Zhong (See GH #304):
  * Fix possible null-deref with broken DWG's in dwg_get_first_object.
  * Fix possible null-deref with broken DWG's in dwg_find_class with empty
    CLASS.dxfname. (GH #309)
  * Fix possible null-deref with broken DWG's in dwglayers with empty (GH #308)
  * Fix short integer overflow in EED checks when decoding malcrafted DWG's,
    which also led to encode buffer overflows. (GH #307)
  * Fix possible null-derefs with broken DWG's in json export. (GH #306)
  * Fix possible null-deref with broken DWG's in dwg_next_entity iterator. (GH #305)
  * Fix wrong TFF overflow check for static strings, where we cannot set
    the string nor the size. (GH #304)
  * Fix heap-overflows and invalid free's when decoding broken 3DSOLID's
    in malcrafted DWG's. Only accept version 1 and 2. (GH #304)
Minor features:
  * Added string converters with known TU sizes: bit_TU_to_utf8_len, bit_read_TU_len.

See and [NEWS](

Here are the compressed sources:   (17.4MB)   (9MB)

Here are the GPG detached signatures[*]:

Use a mirror for higher download bandwidth:

Here are more binaries:

Here are the SHA256 checksums:

5a71bcb391f9da29e268e86edda3911ae0763fcdba3b21a3c139510474098542  libredwg-0.12.1.tar.gz
dedf502b7085bed716d4ffb669d1b699a988eabd928a48d13e30176b43823128  libredwg-0.12.1.tar.xz

[*] Use a .sig file to verify that the corresponding file (without the
.sig suffix) is intact.  First, be sure to download both the .sig file
and the corresponding tarball.  Then, run a command like this:

  `gpg --verify libredwg-0.12.1.tar.gz.sig`

If that command fails because you don't have the required public key,
then run this command to import it:

  `gpg --keyserver --recv-keys B4F63339E65D6414`

and rerun the `gpg --verify` command.

Back to the top

Powered by Savane 3.13-4448.
Corresponding source code