Patched code sample

class PdfReadError(ValueError):
    """Minimal mock exception for demonstration purposes."""
    pass

class DictionaryObject(dict):
    """Minimal mock class for a pypdf DictionaryObject."""
    def get_object(self):
        # In a real scenario, this resolves an indirect reference.
        # For this demonstration, it simply returns itself.
        return self

def get_root_object_fixed(trailer, objects, strict=False):
    """
    Demonstrates the patched logic for finding the PDF's /Root object,
    which fixes the vulnerability described in CVE-2023-36464.

    The vulnerability occurs in non-strict mode when the /Root entry is missing
    from the trailer and the /Size entry is maliciously large. The vulnerable code
    would iterate through all potential objects, leading to a long runtime.

    Args:
        trailer (DictionaryObject): The trailer dictionary of the PDF.
        objects (list): A list representing all objects in the PDF. The length
                        of this list could be maliciously large.
        strict (bool): A flag indicating if parsing should be strict.

    Returns:
        The root DictionaryObject.

    Raises:
        PdfReadError: If the root cannot be found according to the rules.
    """
    try:
        # Standard case: Get the /Root object reference from the trailer.
        root = trailer["/Root"].get_object()
        return root
    except KeyError:
        # This block contains the logic for when /Root is missing.
        if strict:
            # In strict mode, a missing /Root is always an error.
            raise PdfReadError("File has no /Root entry.")

        # In non-strict mode, pypdf attempts to find the document catalog object
        # by iterating through objects as a fallback.
        #
        # --- THE VULNERABILITY FIX ---
        # The original, vulnerable code would iterate over `range(len(objects))`.
        # If `len(objects)` was a huge number (e.g., 5,000,000) from a
        # malicious /Size entry, this would cause a denial-of-service.
        #
        # The fix is to limit the search to a reasonable number of objects,
        # preventing a potentially unbounded loop.
        search_limit = 1000
        for i in range(min(len(objects), search_limit)):
            try:
                # In the real library, this would be a more complex
                # object lookup, e.g., `self.get_object(i)`.
                obj = objects[i]
                if isinstance(obj, DictionaryObject) and obj.get("/Type") == "/Catalog":
                    # Found the catalog object, which serves as the root.
                    return obj
            except Exception:
                # Be robust and ignore errors in other objects during the search.
                pass
        # --- END OF FIX ---

        # If no /Catalog is found within the limited search, raise an error.
        raise PdfReadError(
            f"File has no /Root entry and no /Catalog object found within "
            f"the first {search_limit} objects."
        )