Vulnerable code sample

import zlib

# This code represents the vulnerable logic inspired by CVE-2023-41314.
# In the actual library, this logic would be part of a larger class structure
# for parsing PDF stream objects.

def vulnerable_decode_stream_data(stream_object):
    """
    A simplified function simulating how a vulnerable version of pypdf
    would handle a Flate-decoded stream. It trusts the '/Length'
    parameter from the PDF without any safety checks.
    """
    # 1. Get the compressed data from the stream object.
    # In a real scenario, this would be read from the PDF file.
    compressed_data = stream_object["_data"]

    # 2. Get the DECLARED uncompressed length from the stream's dictionary.
    # This value is controlled by the attacker in a malicious PDF.
    declared_length = stream_object["/Length"]

    # 3. THE VULNERABLE STEP:
    # Allocate a buffer using the attacker-controlled 'declared_length'.
    # If this value is excessively large (e.g., several gigabytes),
    # this line will attempt to allocate that much memory, leading to
    # a MemoryError and causing a Denial of Service (DoS).
    output_buffer = bytearray(declared_length)

    # 4. Attempt to decompress the (small) actual data into the (huge) buffer.
    # The program would typically crash on the allocation above before this.
    decompressed_data = zlib.decompress(compressed_data)
    output_buffer[:len(decompressed_data)] = decompressed_data
    
    return output_buffer


# --- Setup to demonstrate the vulnerability ---

# An attacker crafts a PDF object where the actual data is tiny,
# but the declared uncompressed length is enormous.

# The actual data is very small (15 bytes).
real_content = b"vulnerable data"
compressed_content = zlib.compress(real_content)

# The malicious PDF stream object claims the data will decompress to 2 GB.
malicious_stream_object = {
    # Untrusted length value from the crafted PDF: 2 GB
    "/Length": 2 * 1024 * 1024 * 1024,
    
    # The actual compressed data, which is only a few bytes long.
    "_data": compressed_content,
}


# --- Triggering the vulnerability ---
# This call will cause the program to try and allocate 2 GB of RAM,
# which will likely exhaust available memory and crash the application.
vulnerable_decode_stream_data(malicious_stream_object)