Hello,

I am reporting a reproducible security issue in Debian wv 1.2.9-9 and upstream wvWare.

`wvGetBKD_PLCF()` in `bkd.c:73` frees the address of its `U32 **pos` parameter instead of the heap buffer it points to:

    wvFree(pos); /* incorrect */
    wvFree(*pos); /* intended */

A crafted Word 97 document with `lcbPlcftxbxBkd=4` makes `*nobkd=0`, so `wvMalloc(0)` returns NULL and the error path calls `free()` on a stack address. No real memory-pressure condition is needed.

Reproduction:

    wvConvert simple-bkd-len4.doc
    wvRTF simple-bkd-len4.doc

Both terminate with:

    free(): invalid pointer

ASan reports an attempted free of an address located in the `wvDecodeSimple` stack frame at `generic.c:67` / `bkd.c:73`. The same input was also tested with Ubuntu's prebuilt wv 1.2.9-4.2build1 binaries.

The same copy-paste error remains in nine other PLCF parsers: `ffn.c:253`, `lst.c:163`, `pcd.c:96`, `fld.c:298`, `atrd.c:69`, `bte.c:88`, `frd.c:63`, `ftxbxs.c:81`, and `fdoa.c:65`. I verified the BKD path end to end; these nine sites are reported as the same source-level pattern, not as nine separate CVE requests.

The current Debian 1.2.9-9 source still contains `wvFree(pos)` at `bkd.c:73`. The attached patch replaces the erroneous operand with `wvFree(*pos)`.

This is distinct from CVE-2026-112055 (FKP stack out-of-bounds read), CVE-2026-112056 (stylesheet heap out-of-bounds read), and Debian Bug #1148725 (pap.c list-index issue). Confirmed impact is process termination; the document does not control an arbitrary free address or code execution.

Please assign a CVE if Debian considers this a vulnerability in the Debian package. I am happy to retest a patched build.

Thanks,
netwind
zwfnetwind@hotmail.com

Patch for the invalid free described in #1153067.

`wvGetBKD_PLCF()` and the nine sibling PLCF parsers free the address of the `U32 **pos`
parameter instead of the buffer it points to on the allocation-failure path. The patch
changes every `wvFree (pos)` to `wvFree (*pos)` in the affected parsers, so the actual
heap block is released and `*pos` is then cleared.

Tested on a plain/optimised build of 1.2.9 with the patch applied:

- simple-bkd-len4.doc: `free(): invalid pointer`, abort (rc=134) before, rc=0 after
- simple-bkd-len13.doc: same before/after result
- wv-corpus/backslash.doc: RTF output SHA-256 identical before and after

The patch is `-p1` and touches only the affected `wvFree` call sites plus the surrounding
files listed in the diff.

Happy to retest or rework the approach.

Reported upstream as well, with the same sample(s) and patch attached: https://github.com/opendocument-app/wvWare/issues/1