SEGV READ in dwg_free_preR13_header_vars at header_variables_r11.spec:129 (libredwg main branch @6d6a339)

## Summary An AddressSanitizer SEGV READ crash is triggered in dwg_free_preR13_header_vars() when running dxf2dwg with empty /dev/null input. The crash is caused by an invalid memory read access on an unknown address during the pre-R13 header variables free process. ## Affected Version Branch: main Commit: 6d6a339 (2026-04-10 latest) Tool: dxf2dwg Library: libredwg Build type: Debug + AddressSanitizer ## Reproduction ```sh git clone https://github.com/LibreDWG/libredwg.git cd libredwg sh autogen.sh CC=/home/AFLplusplus/afl-clang-fast \ CXX=/home/AFLplusplus/afl-clang-fast++ \ CFLAGS="-O0 -g -fno-omit-frame-pointer -fsanitize=address -Wno-error" \ CXXFLAGS="-std=c++20 -O0 -g -fno-omit-frame-pointer -fsanitize=address -Wno-error" \ LDFLAGS="-fsanitize=address -no-pie -pthread -ldl -lm" \ ./configure \ --enable-debug \ --enable-trace \ --disable-shared \ --disable-bindings \ --disable-docs make -j$(nproc) ./programs/dxf2dwg < /dev/null ``` ## Error Log ``` Fuzzing in_dxf + encode from shmem (0) AddressSanitizer:DEADLYSIGNAL ================================================================= ==995223==ERROR: AddressSanitizer: SEGV on unknown address 0x000000028018 (pc 0x000000fd9d2f bp 0x7fffffffc040 sp 0x7fffffffbba0 T0) ==995223==The signal is caused by a READ memory access. #0 0xfd9d2f in dwg_free_preR13_header_vars /home/new-cases/libredwg/libredwg/src/./header_variables_r11.spec:129:3 #1 0xfd64e6 in dwg_free /home/new-cases/libredwg/libredwg/src/free.c:1676:9 #2 0x4dc48d in main /home/new-cases/libredwg/libredwg/programs/dxf2dwg.c:171:3 #3 0x7ffff7cadd8f in __libc_start_call_main csu/../sysdeps/nptl/libreDWG/libredwg_start_main.h:58:16 #4 0x7ffff7cade3f in __libc_start_main csu/../csu/start.c:392:3 #5 0x41d5a4 in _start (/home/new-cases/libredwg/libredwg/programs/dxf2dwg+0x41d5a4) (BuildId: 5588f4d3837f96b3d3bf30e6d9c4d1a51ceb45fa) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV /home/new-cases/libredwg/libredwg/src/./header_variables_r11.spec:129:3 in dwg_free_preR13_header_vars ==995223==ABORTING ``` ## Debug This is quite strange. I found that it got stuck while I was running it. When I debugged it with GDB, I saw it was blocked on a read syscall, so I manually entered 0 (or anything else), and then it crashed with an error by itself. That is why i use `./programs/dxf2dwg < /dev/null` as poc ``` ╰─ gdb --args /home/new-cases/libredwg/libredwg/programs/dxf2dwg GNU gdb (Ubuntu 12.1-0ubuntu1~22.04.3) 12.1 Copyright (C) 2022 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-linux-gnu". Type "show configuration" for configuration details. For bug reporting instructions, please see: <https://www.gnu.org/software/gdb/bugs/>. Find the GDB manual and other documentation resources online at: <http://www.gnu.org/software/gdb/documentation/>. For help, type "help". Type "apropos word" to search for commands related to "word"... Reading symbols from /home/new-cases/libredwg/libredwg/programs/dxf2dwg... (gdb) r Starting program: /home/new-cases/libredwg/libredwg/programs/dxf2dwg warning: Error disabling address space randomization: Operation not permitted [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". 0 (<- My input) Fuzzing in_dxf + encode from shmem (2) Program received signal SIGSEGV, Segmentation fault. 0x000000000041f804 in __asan::Allocator::Deallocate(void*, unsigned long, unsigned long, __sanitizer::BufferedStackTrace*, __asan::AllocType) () (gdb) bt #0 0x000000000041f804 in __asan::Allocator::Deallocate(void*, unsigned long, unsigned long, __sanitizer::BufferedStackTrace*, __asan::AllocType) () #1 0x00000000004a01a6 in free () #2 0x0000000000fe8216 in dwg_free_summaryinfo (dwg=0x7fffffffc460) at ./summaryinfo.spec:46 #3 0x0000000000fd652e in dwg_free (dwg=0x7fffffffc460) at free.c:1679 #4 0x00000000004dc48e in main (argc=1, argv=0x7fffffffde98) at dxf2dwg.c:171 (gdb) ```