CVE-2021-3200

An attacker supplies a crafted testcase file to the `testsolv` tool [ref_id=1]. When `testcase_read` processes this input, the index variable `p` can be large enough that `p >> 3` exceeds `pool->considered->size`, causing a heap-buffer-overflow read on the `map` array [ref_id=1]. The overflow occurs at line 2334 during the `FOR_JOB_SELECT` loop where `MAPCLR` is called without bounds checking [ref_id=1]. This can be triggered remotely by providing a malicious testcase file, leading to a denial of service.

The vulnerability resides in the `testcase_read` function at `src/testcase.c:2334` [ref_id=1]. At this line, the macro `MAPCLR(pool->considered, p)` is invoked, which expands to `pool->considered->map[p >> 3] &= ~(1 << (p & 7))` [ref_id=1]. The `pool->considered` variable is a `Map` structure containing a `map` (unsigned char pointer) and a `size` field [ref_id=1].

The advisory does not include a patch or specific remediation guidance [ref_id=1]. To fix the vulnerability, bounds checking should be added before the `MAPCLR` operation at line 2334 to ensure that `p >> 3` is less than `pool->considered->size` [ref_id=1]. Without such a check, an attacker-controlled index can write outside the allocated heap buffer.

Use the provided PoC file with the testsolv tool: `/libsolvBuildDir/tools/testsolv PoC-testcase_read-2334` [ref_id=1]. When built with AddressSanitizer (`-fsanitize=address`), the tool will report a heap-buffer-overflow at `src/testcase.c:2334` [ref_id=1].