Patched code sample

The vulnerability CVE-2022-1941 (not the fictional CVE-2026-0994) was fixed by ensuring that the recursion depth counter is correctly decremented when parsing nested `Any` messages.

The following Python code demonstrates the *behavior* of the fix. In a vulnerable version of `protobuf`, this code would crash with a `RecursionError`. In a patched version, it correctly raises a `ParseError`, preventing the Denial of Service.

```python
import sys
from google.protobuf import any_pb2, wrappers_pb2
from google.protobuf.json_format import ParseDict, ParseError, MessageToDict

def create_deeply_nested_any_dict(depth: int):
    """
    Creates a dictionary that mimics a deeply nested protobuf Any message
    in JSON format. This structure is used to test recursion limits.
    """
    # Start with a simple, concrete message at the deepest level.
    inner_message = wrappers_pb2.StringValue(value="core")
    any_proto = any_pb2.Any()
    any_proto.Pack(inner_message)
    
    # Convert the innermost protobuf message to its dictionary representation.
    nested_dict = MessageToDict(any_proto)
    
    # Wrap the dictionary in 'Any' type layers.
    # This simulates a JSON object like:
    # { "@type": "type.googleapis.com/google.protobuf.Any", "value": { ... } }
    for _ in range(depth):
        wrapper_dict = {
            "@type": "type.googleapis.com/google.protobuf.Any",
            "value": nested_dict 
        }
        nested_dict = wrapper_dict
        
    return nested_dict

# The default max_recursion_depth for ParseDict is 100.
# We create a structure deeper than this to test the fix.
NESTING_DEPTH = 105 
DEFAULT_RECURSION_LIMIT = 100

# 1. Create the malicious dictionary that would cause the recursion issue.
malicious_dict = create_deeply_nested_any_dict(depth=NESTING_DEPTH)

# 2. Prepare a target message to parse the dictionary into.
target_message = any_pb2.Any()

print(f"Python's recursion limit is: {sys.getrecursionlimit()}")
print(f"Attempting to parse a dict with nesting depth: {NESTING_DEPTH}")
print(f"Protobuf's max_recursion_depth is set to: {DEFAULT_RECURSION_LIMIT}\n")

# 3. Attempt to parse the dictionary and demonstrate the fix.
try:
    # In a FIXED version (e.g., protobuf>=4.21.1), the internal logic for 'Any'
    # correctly decrements the recursion depth. This call will fail safely
    # with a ParseError because NESTING_DEPTH > max_recursion_depth.
    ParseDict(
        js_dict=malicious_dict,
        message=target_message,
        max_recursion_depth=DEFAULT_RECURSION_LIMIT
    )
    
    # In a VULNERABLE version, the recursion limit is bypassed, and either
    # this print statement is reached (if the depth is less than Python's
    # own limit) or a RecursionError is raised.
    print("[VULNERABLE BEHAVIOR DETECTED]")
    print("Parsing unexpectedly succeeded. The depth limit was bypassed.")

except ParseError as e:
    # This is the EXPECTED outcome in a fixed version.
    # The library correctly identifies the excessive depth and aborts safely.
    print("[FIXED BEHAVIOR DEMONSTRATED]")
    print("Caught the expected 'ParseError', preventing a crash.")
    print(f"-> Error message: {e}")

except RecursionError:
    # This is the EXPECTED outcome in a vulnerable version.
    print("[VULNERABLE BEHAVIOR DETECTED]")
    print("A 'RecursionError' occurred, causing a Denial of Service.")