Vulnerable code sample

import sys
import io

# This code is a conceptual representation of the logic that could lead to
# an infinite loop, as described for a vulnerability in older pypdf versions.
# It simulates a PDF parser that follows object references without tracking
# visited objects, leading to an infinite loop when a cyclic reference is
# encountered in non-strict mode.

# Set a recursion limit to prevent a true infinite loop from crashing the system
# during this demonstration. A real attack would not have this safeguard.
sys.setrecursionlimit(100)

class PdfObject:
    """A mock PDF object that can hold a reference to another object."""
    def __init__(self, id, reference=None):
        self.id = id
        self.reference = reference

    def __repr__(self):
        return f"PdfObject(id={self.id})"

class VulnerablePdfParser:
    """
    A mock parser representing the vulnerable logic before the fix.
    The vulnerability is in how it resolves object references.
    """
    def __init__(self, stream, strict=True):
        self.stream = stream
        self.strict = strict
        # In a real library, this would be a complex cache of objects read from the stream.
        # Here, we'll just use it to hold our manually crafted objects.
        self.objects = {}

    def get_object(self, obj_id):
        """Simulates fetching an object from the PDF file."""
        return self.objects.get(obj_id)

    def _read_indirect_object_vulnerable(self, obj):
        """
        This method simulates the vulnerable process of resolving an object.
        In non-strict mode, it follows references without checking for cycles.
        """
        print(f"Reading object: {obj.id}")

        # The core of the vulnerability: blindly following the next reference.
        ref = obj.reference

        # In a real scenario, this would involve more complex stream parsing.
        # Here we just simulate following the in-memory reference.
        if ref:
            if not self.strict:
                # In non-strict mode, it just follows the reference,
                # leading to an infinite loop if a cycle exists.
                # No tracking of already visited objects is performed.
                print(f"  -> Following reference to object {ref.id} (non-strict mode)")
                return self._read_indirect_object_vulnerable(ref)
            else:
                # A strict parser might have checks that would prevent this,
                # though the vulnerability was specifically about non-strict mode.
                print("  -> Strict mode would error on unexpected structures (not shown).")
        
        return obj

if __name__ == '__main__':
    # 1. Attacker crafts a "PDF" with a cyclic object reference.
    #    Object 10 -> Object 20 -> Object 30 -> Object 10
    obj1 = PdfObject(id=10)
    obj2 = PdfObject(id=20)
    obj3 = PdfObject(id=30)

    # Create the cycle
    obj1.reference = obj2
    obj2.reference = obj3
    obj3.reference = obj1  # This reference back to obj1 creates the infinite loop condition.

    # 2. The victim's application attempts to read this crafted file
    #    using a vulnerable pypdf version with strict=False.
    
    # We simulate a file stream
    mock_pdf_stream = io.BytesIO(b"%PDF-1.7 ...malicious content...")
    
    # Initialize the parser in non-strict mode, which is required to trigger the bug.
    print("Initializing parser in NON-STRICT mode (strict=False).")
    parser = VulnerablePdfParser(mock_pdf_stream, strict=False)

    # Manually add the crafted objects to the parser's internal object list
    # to simulate them being "found" in the PDF.
    parser.objects = {10: obj1, 20: obj2, 30: obj3}

    print("\nAttempting to read the crafted PDF structure...")
    print("-" * 20)

    try:
        # 3. The parser starts reading from an object within the cycle.
        #    This will trigger the infinite recursion/loop.
        parser._read_indirect_object_vulnerable(obj1)
    except RecursionError:
        print("-" * 20)
        print("\nDEMONSTRATION COMPLETE:")
        print("RecursionError caught. This indicates an infinite loop was entered.")
        print("The vulnerable code continuously followed the cyclic reference:")
        print("10 -> 20 -> 30 -> 10 -> 20 -> ...")
        print("This would cause a Denial of Service (DoS) in a real application.")