Patched code sample

import sys
from typing import Optional, Set

# The user specified CVE-2026-27024, which is not a real CVE as of now.
# The description matches CVE-2023-27024 for the 'pypdf' library.
# This vulnerability, an infinite loop on crafted outlines, was fixed in pypdf 3.7.1.
# This code demonstrates the logic of the fix by simulating a traversal
# of a PDF outline structure containing a circular reference.

class MockPdfOutlineObject:
    """
    A mock object simulating a PDF structure (like a TreeObject) that can be
    part of a linked list, representing document outlines.
    """
    def __init__(self, object_id: int):
        self.id = object_id
        # In a real PDF, this could be a reference to another object via '/Next'
        self.next: Optional[MockPdfOutlineObject] = None

    def __repr__(self) -> str:
        return f"PdfObject(id={self.id})"

def traverse_outline_with_fix(start_node: MockPdfOutlineObject):
    """
    Demonstrates the patched traversal logic from pypdf 3.7.1.

    The core of the fix is to track the object IDs that have already been
    visited during the traversal of a specific list (e.g., outlines). If an
    object ID is encountered a second time, it indicates a circular reference,
    and the traversal is halted to prevent an infinite loop.
    """
    print("--- Running traversal with CVE-2023-27024 fix ---")

    # The fix: A set to keep track of visited object IDs during this traversal.
    visited_object_ids: Set[int] = set()

    current_node: Optional[MockPdfOutlineObject] = start_node
    while current_node is not None:
        # Before processing the node, check if it's already been visited.
        if current_node.id in visited_object_ids:
            print(f"INFO: Circular reference detected at {current_node}.")
            print("INFO: Halting traversal to prevent infinite loop.")
            # This 'break' is the essential part of the vulnerability fix.
            break

        print(f"Visiting {current_node}")
        # If not visited, add its ID to the set for future checks.
        visited_object_ids.add(current_node.id)

        # Move to the next node in the outline chain.
        current_node = current_node.next

    print("--- Traversal finished ---\n")


def demonstrate_vulnerability_without_fix(start_node: MockPdfOutlineObject):
    """
    Simulates the unpatched, vulnerable behavior.
    This function will loop indefinitely if there is a cycle. A manual break
    is included to prevent this script from actually freezing.
    """
    print("--- Simulating vulnerable traversal (without fix) ---")
    print("NOTE: A counter is used to break the loop after 15 iterations.")

    current_node: Optional[MockPdfOutlineObject] = start_node
    iteration_count = 0
    limit = 15

    # This 'while' loop is where the infinite loop vulnerability occurs.
    while current_node is not None:
        if iteration_count >= limit:
            print(f"ERROR: Iteration limit of {limit} reached. This indicates an infinite loop.")
            break

        print(f"Visiting {current_node}")
        current_node = current_node.next
        iteration_count += 1
    print("--- Traversal finished ---\n")


if __name__ == "__main__":
    # 1. Create a set of mock PDF outline objects.
    #    This simulates a PDF that has been crafted to cause a vulnerability.
    obj1 = MockPdfOutlineObject(object_id=101)
    obj2 = MockPdfOutlineObject(object_id=202)
    obj3 = MockPdfOutlineObject(object_id=303)

    # 2. Create the malicious circular reference: 101 -> 202 -> 303 -> 202
    #    An unpatched parser would get stuck looping between 202 and 303.
    obj1.next = obj2
    obj2.next = obj3
    obj3.next = obj2  # This creates the cycle.

    print(f"Created a crafted PDF outline: Obj(101) -> Obj(202) -> Obj(303) -> Obj(202)\n")

    # 3. First, show the vulnerable behavior.
    demonstrate_vulnerability_without_fix(obj1)

    # 4. Now, show the behavior with the fix implemented.
    traverse_outline_with_fix(obj1)