Patched code sample

import io

# The pyasn1 fix introduced a limit on the number of sub-identifiers that can be
# decoded for an OID or a Relative OID. This constant represents that limit.
# The actual fix is in the pyasn1.codec.ber.decoder module. This code
# provides a simplified, self-contained demonstration of the fixing logic.
MAX_SUB_OID_COUNT = 1024

class PyAsn1Error(Exception):
    """A base class for pyasn1 exceptions."""
    pass

def decode_relative_oid_safely(encoded_bytes: bytes):
    """
    A simplified decoder for a Relative OID that demonstrates the DoS fix.

    The vulnerability existed because a malicious payload could contain an
    enormous number of sub-identifiers, each encoded with just one or a few
    bytes. The old decoder would try to process all of them, allocating memory
    for each one and eventually leading to memory exhaustion.

    The fix is to introduce a counter and stop decoding if the number of
    sub-identifiers exceeds a reasonable limit (MAX_SUB_OID_COUNT).
    """
    sub_oids = []
    sub_oid_count = 0
    # Use BytesIO to simulate reading from a stream, similar to the real decoder
    stream = io.BytesIO(encoded_bytes)

    while stream.tell() < len(encoded_bytes):
        # FIX: Increment and check the counter *before* processing and allocating
        # memory for the next sub-identifier. This prevents memory exhaustion.
        sub_oid_count += 1
        if sub_oid_count > MAX_SUB_OID_COUNT:
            raise PyAsn1Error(
                f'Too many sub-OIDs in RELATIVE-OID, limit of {MAX_SUB_OID_COUNT} reached'
            )

        # In a real decoder, this part is more complex. It reads variable-length
        # base-128 encoded integers. For this demonstration, we'll simplify and
        # assume each sub-oid is a single byte for clarity.
        sub_oid_value_byte = stream.read(1)
        if not sub_oid_value_byte:
            break # End of stream
        
        # This is a placeholder for the complex sub-identifier decoding logic.
        # The key is that this logic would have been executed in a loop
        # without a limit check.
        sub_oid_value = int.from_bytes(sub_oid_value_byte, 'big')
        
        sub_oids.append(sub_oid_value)

    return tuple(sub_oids)

# Example usage to demonstrate the fix in action.

# 1. A benign payload with a few sub-identifiers. This will pass.
# In a real BER encoding, these would be base-128 encoded. Here we use
# simple bytes for a clear demonstration.
benign_payload = b'\x01\x02\x03\x04'

# 2. A malicious payload crafted to cause memory exhaustion.
# It contains more sub-identifiers than the allowed limit.
malicious_payload = b'\x00' * (MAX_SUB_OID_COUNT + 5)


if __name__ == '__main__':
    print("--- Demonstrating the fix for CVE-2026-23490 (hypothetical) ---")
    print(f"Decoder is configured with a limit of {MAX_SUB_OID_COUNT} sub-OIDs.\n")

    try:
        print(f"Attempting to decode a benign payload of length {len(benign_payload)}...")
        decoded_oid = decode_relative_oid_safely(benign_payload)
        print(f"Successfully decoded benign payload: {decoded_oid}\n")
    except PyAsn1Error as e:
        print(f"Decoding benign payload failed unexpectedly: {e}\n")

    try:
        print(f"Attempting to decode a malicious payload of length {len(malicious_payload)}...")
        decode_relative_oid_safely(malicious_payload)
        print("Decoding malicious payload succeeded (VULNERABLE BEHAVIOR).")
    except PyAsn1Error as e:
        print(f"Successfully caught malicious payload with an error: {e}")
        print("The limit prevented a potential Denial-of-Service attack.")