AI_ONLY_REPORT
package: libsolv-0.7.36-2.hum1
------
Summary: Heap Buffer Overflow in repopagestore_load_page_range via Malicious Compressed Data: libsolv decompresses attacker-controlled compressed `.solv` page data with `unchecked_decompress_buf` before validating the required output length or back-reference safety, allowing out-of-bounds reads and writes during page loading.
Requirements to exploit: An attacker must be able to supply a crafted `.solv` file or attacker-controlled repository metadata with compressed page data and cause a victim application to parse it through the normal loading flow that reaches `repopagestore_read_or_setup_pages` or `repopagestore_load_page_range`. No privileges on the target are required, but the victim must ingest the malicious content.
Component affected: libsolv - `src/repopage.c` (`repopagestore_load_page_range`, `repopagestore_read_or_setup_pages`)
Version affected: at least `libsolv-0.7.36` (confirmed in the source report); likely other releases that contain the same `src/repopage.c` call sites without `check_decompress_buf` before page decompression
Patch available: Proposed fix included in this report (see "Proposed Fix"); upstream release status unknown.
Version fixed (if any already): unknown
Upstream coordination: Initial disclosure draft prepared for libsolv maintainers.
CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - 7.8 (HIGH)
AV:L - The vulnerable component is a local parser reached when a victim application loads attacker-controlled `.solv` content.
AC:L - No unusual preconditions are required once crafted compressed page data is processed.
PR:N - The attacker does not need privileges on the target system.
UI:R - A victim must cause a vulnerable libsolv consumer to parse the malicious `.solv` content.
S:U - The impact remains within the vulnerable component's security scope.
C:H - Successful memory corruption could expose sensitive process memory.
I:H - Successful memory corruption could allow modification of process state or control flow.
A:H - Malformed metadata can crash the process and may permit broader denial of service.
Impact: Moderate. This is a memory-safety flaw in a parser for attacker-controlled `.solv` metadata. The report demonstrates out-of-bounds read and write conditions during normal parsing, but exploitation still requires the victim to ingest malicious `.solv` content and does not show reliable code execution in a default remote, no-interaction scenario.
Embargo: yes
Reason: The source report proposes a standard 90-day coordinated disclosure window while the issue is validated and a fix is prepared.
Suggested public date: 16-Jul-2026
Acknowledgement: Aisle Research
Steps to reproduce:
1. Build libsolv with AddressSanitizer (`-fsanitize=address`) and symbols.
2. Prepare a `.solv` file containing vertical page data marked as compressed.
3. Encode a compressed stream that either decompresses beyond `REPOPAGE_BLOBSIZE` (32 KB) or uses a back-reference offset larger than the amount of data already produced.
4. Load the file via normal `.solv` parsing flow, for example through a path that reaches `repo_add_solv`, `repopagestore_read_or_setup_pages`, or `repopagestore_load_page_range`.
5. Observe an ASan crash such as `heap-buffer-overflow` or invalid read during `unchecked_decompress_buf`.
------


Vulnerability Details






The issue is in page-loading paths that decompress attacker-controlled data from `.solv` files using `unchecked_decompress_buf` without pre-validation:
```c
/* src/repopage.c */
if (compressed)
{
unsigned int out_len;
out_len = unchecked_decompress_buf(buf, in_len, dest, REPOPAGE_BLOBSIZE);
if (out_len != REPOPAGE_BLOBSIZE && pnum < store->num_pages - 1)
return 0;
}
```
```c
/* src/repopage.c */
if (compressed)
{
out_len = unchecked_decompress_buf(buf, in_len, dest, REPOPAGE_BLOBSIZE);
if (out_len != REPOPAGE_BLOBSIZE && i < npages - 1)
return SOLV_ERROR_CORRUPT;
}
```
`unchecked_decompress_buf` does not enforce output bounds and does not validate back-reference safety before dereference. A safer pattern already exists elsewhere:
```c
/* src/repopage.c */
unsigned int l = check_decompress_buf(cpage, len);
if (l == 0 || l > max)
return 0;
return unchecked_decompress_buf(cpage, len, page, max);
```
This makes crafted compressed pages able to trigger:
Out-of-bounds write to the destination page buffer (`REPOPAGE_BLOBSIZE`), and/or

Out-of-bounds read via invalid back-reference offsets.


Relevant CWEs:
`CWE-787` (Out-of-bounds Write)

`CWE-125` (Out-of-bounds Read)

`CWE-20` (Improper Input Validation)




Proposed Fix






Suggested patch to validate compressed pages before decompression in both vulnerable paths:
```diff
diff --git a/src/repopage.c b/src/repopage.c
— a/src/repopage.c
+++ b/src/repopage.c
@@ -770,8 +770,13 @@ repopagestore_load_page_range(Repopagestore *store, unsigned int pstart, unsigned int pend)
if (compressed)
{
unsigned int out_len;

out_len = unchecked_decompress_buf(buf, in_len, dest, REPOPAGE_BLOBSIZE);
+ unsigned int out_len;
+ unsigned int need_len = check_decompress_buf(buf, in_len);
+ if (need_len == 0 || need_len > REPOPAGE_BLOBSIZE ||
+ (need_len != REPOPAGE_BLOBSIZE && pnum < store->num_pages - 1))
+ return 0;
+ out_len = unchecked_decompress_buf(buf, in_len, dest, REPOPAGE_BLOBSIZE);
+ if (out_len != need_len)
+ return 0;
 if (out_len != REPOPAGE_BLOBSIZE && pnum < store->num_pages - 1)
 {
 #ifdef DEBUG_PAGING
@@ -910,8 +915,13 @@ repopagestore_read_or_setup_pages(Repopagestore *store, FILE *fp, unsigned int pagesz, unsigned int blobsz)
 if (compressed)
 {

out_len = unchecked_decompress_buf(buf, in_len, dest, REPOPAGE_BLOBSIZE);
+ unsigned int need_len = check_decompress_buf(buf, in_len);
+ if (need_len == 0 || need_len > REPOPAGE_BLOBSIZE ||
+ (need_len != REPOPAGE_BLOBSIZE && i < npages - 1))
+ return SOLV_ERROR_CORRUPT;
+ out_len = unchecked_decompress_buf(buf, in_len, dest, REPOPAGE_BLOBSIZE);
+ if (out_len != need_len)
+ return SOLV_ERROR_CORRUPT;
 if (out_len != REPOPAGE_BLOBSIZE && i < npages - 1)
 {
 return SOLV_ERROR_CORRUPT;
```


------
This report was generated using AI technology. Always review AI-generated content prior to use