CVE-2020-21680: 
NixOS vulnerability analysis and mitigation

A stack-based buffer overflow vulnerability exists in the put_arrow() component in genpict2e.c of fig2dev version 3.2.7b. The vulnerability is identified as CVE-2020-21680 and affects the fig2dev software when converting a xfig file into pict2e format (NVD).

The vulnerability occurs in the putarrow() function at line 1191 in genpict2e.c when attempting to draw an arrow head with zero length. The issue arises because the direction of the arrow is computed as the chord rather than the tangent between the tip and back of the arrow head. When the arrow length is zero, the start and end points coincide, causing calcarrow() to return prematurely with an invalid number of points set to 0, leading to a stack buffer overflow (SourceForge Issue).

When exploited, this vulnerability allows attackers to cause a denial of service (DoS) condition via converting a xfig file into pict2e format (NVD).

The issue was fixed in commit [100e27] where arcs with arrow heads that have a length of zero are now drawn using the tangent instead of a secant to the arc. This provides a proper handling of zero-length arrow heads (SourceForge Issue).