Patched code sample

import cbor2
import sys

# This code demonstrates the fix for the vulnerability described (real CVE-2024-26209),
# which was introduced in cbor2 version 5.9.0. This script requires cbor2 >= 5.9.0
# to demonstrate the fix. Running it on a vulnerable version would likely
# result in a RecursionError and a crash.

# 1. Create a deeply nested Python object to simulate a malicious payload.
# A depth of 2000 is chosen to exceed Python's default recursion limit (~1000).
nesting_depth = 2000
payload_object = b''  # Start with a simple base object
for _ in range(nesting_depth):
    # The vulnerability is triggered by deeply nested arrays (CBOR type 4).
    # We repeatedly wrap the object in a single-element list.
    payload_object = [payload_object]

# 2. Encode the object into a CBOR byte string.
# Note: The fix was also applied to the encoder, so we must explicitly
# raise the limit here just to create the malicious payload for our test.
try:
    malicious_payload = cbor2.dumps(payload_object, max_nesting_depth=nesting_depth + 1)
except (cbor2.CBOREncodeError, ValueError) as e:
    print(f"Could not create the test payload: {e}")
    print("This may happen if the cbor2 version is too old or if encoding limits are strict.")
    sys.exit(1)


# 3. Demonstrate the fix by attempting to decode the payload with a safe depth limit.
# The `max_nesting_depth` parameter is the core of the fix.
safe_nesting_limit = 500

print(f"Attempting to decode payload with a nesting depth of {nesting_depth}...")
print(f"Applying a safe `max_nesting_depth` of {safe_nesting_limit}.")
print("-" * 30)

try:
    # In a vulnerable version, this call would cause a RecursionError.
    # In a fixed version, it raises a controlled CBORDecodeValueError
    # because the custom depth limit is exceeded.
    cbor2.loads(malicious_payload, max_nesting_depth=safe_nesting_limit)

except RecursionError:
    # This block should NOT be reached in a fixed version (>= 5.9.0).
    print("[VULNERABILITY TRIGGERED]")
    print("A RecursionError was raised. The process is likely crashing.")
    print("This indicates that the installed cbor2 version is vulnerable.")

except cbor2.CBORDecodeValueError as e:
    # This is the expected outcome in a fixed version.
    print("[FIX VERIFIED]")
    print("The library raised a controlled `CBORDecodeValueError` as expected.")
    print(f"Error message: {e}")
    print("\nThe `max_nesting_depth` limit was enforced, preventing the RecursionError.")
    print("This successfully mitigates the Denial of Service attack.")

except Exception as e:
    print(f"An unexpected error occurred: {type(e).__name__}: {e}")