Multiple heap buffer overflows in R2004 DWG decoder

Multiple heap buffer overflows found in the R2004 decoder via AFL++ fuzzing. Bug A - decompress_R2004_section (decode.c:1297) - WRITE overflow: The LZ77 back-reference loop does not validate that end <= dec->size before writing, allowing writes past the allocated buffer. #0 WRITE of size 1 in decompress_R2004_section decode.c:1297 #1 in read_2004_compressed_section decode.c:2152 #2 in decode_R2004 decode.c:3624 Bug B - read_2004_compressed_section (decode.c:2072) - READ overflow: Attacker-controlled address used in memcpy without bounds validation. #0 READ of size 8 in read_2004_compressed_section decode.c:2072 #1 in read_2004_section_template decode.c:3225 #2 in decode_R2004 decode.c:3638 Both triggered by malformed R2004 format DWG files. 362 crash files collected. PoC files attached. [poc_r2004_memcpy.zip](https://github.com/user-attachments/files/26742284/poc_r2004_memcpy.zip)