Vulnerable code sample

# This code conceptually represents the vulnerable logic in psd-tools < 1.12.2
# as described in CVE-2021-27809. It demonstrates how a malformed RLE
# run would raise an unhandled ValueError, crashing higher-level functions.

def decode_rle(data, height, width):
    """
    A simplified simulation of the RLE decoder.
    It is designed to raise a ValueError for specific "malformed" data,
    mimicking a literal run that extends past the expected row size.
    """
    # In this simulation, the byte b'\xff' represents a malformed RLE run
    # that would cause the decoder to read past its buffer.
    if b'\xff' in data:
        raise ValueError("RLE literal run extends past row data")

    # In a non-malformed case, it would return the decoded pixel data.
    return b'\x00' * (height * width)


def decompress(channel_data):
    """
    A simplified simulation of the decompression logic that calls the decoder.
    In the vulnerable version, this function does not handle the ValueError
    that decode_rle() can raise, causing it to propagate up.
    """
    height, width, compressed_data = channel_data

    # This call to the decoder is not wrapped in a try/except block.
    # If decode_rle raises a ValueError, this function will crash.
    result = decode_rle(compressed_data, height, width)

    # The CVE notes that a fallback for `result is None` existed, but it
    # was never triggered for this particular bug because the uncaught
    # ValueError crashed the program before this check could be reached.
    if result is None:
        return b'\x00' * (height * width)

    return result


def composite_psd(psd_file):
    """
    A mock of a high-level function like psd.composite() or an export script.
    This function will crash when decompress() passes up the unhandled ValueError.
    """
    print("Attempting to composite PSD file...")
    for channel in psd_file['image_data']:
        print("Decompressing channel...")
        # This call chain will trigger the unhandled exception and crash the program.
        decompressed_channel = decompress(channel)
        print("Channel decompressed successfully.") # This line will not be reached.

    print("Image composition complete.")


# --- Demonstration of the Crash ---

# This mock object represents a parsed PSD file structure.
mock_psd_with_malformed_channel = {
    'image_data': [
        # A valid channel
        (10, 10, b'\x01\x02\x03'),
        # This channel contains the byte `b'\xff'`, which our mock
        # decode_rle function will identify as a malformed RLE run,
        # triggering the ValueError.
        (10, 10, b'\x04\xff\x06'),
        # This channel will never be processed because the program crashes
        # on the previous one.
        (10, 10, b'\x07\x08\x09')
    ]
}

# The following function call will cause the program to exit with an
# unhandled ValueError, demonstrating the vulnerability.
composite_psd(mock_psd_with_malformed_channel)