Vulnerable code sample

import sys
import time
from types import TracebackType
from typing import Any, Dict, Optional, Tuple

# This code represents the vulnerable components in zeroconf < 0.149.6.
# The vulnerability lies in the QuietLogger class from zeroconf/_logging.py
# and how it is used by classes like DNSIncoming from zeroconf/_protocol.py.

DEDUPLICATION_TIMEOUT_S = 300.0

class QuietLogger:
    """
    A logger that de-duplicates messages. In the vulnerable version, it stores
    tracebacks indefinitely for unique exception messages.
    """

    def __init__(self) -> None:
        self._seen_logs: Dict[str, Tuple[float, Optional[TracebackType]]] = {}

    def log_exception(self, msg: str, *args: Any, **kwargs: Any) -> None:
        """Logs an exception message if it has not been seen before."""
        now = time.monotonic()
        exc_info = sys.exc_info()
        # The check `msg not in self._seen_logs` can be bypassed by an attacker
        # who sends packets that generate unique error messages.
        if msg not in self._seen_logs or self._seen_logs[msg][0] + DEDUPLICATION_TIMEOUT_S < now:
            # VULNERABILITY: A reference to the traceback object `exc_info[2]`
            # is stored in the `_seen_logs` dictionary. The dictionary key `msg`
            # is derived from attacker-controlled packet data. This allows an
            # attacker to grow the dictionary without bounds. The traceback
            # holds references to stack frames and all their local variables,
            # including the raw packet data, causing a memory leak.
            self._seen_logs[msg] = (now, exc_info[2])
            # The real library would call an underlying logger here.
            # e.g., self._logger.exception(msg, *args, **kwargs)


# A dummy exception to represent a parsing failure.
class IncomingDecodeError(Exception):
    pass


class DNSIncoming:
    """
    A simplified representation of a class that processes incoming DNS packets.
    """

    def __init__(self, data: bytes) -> None:
        # The raw packet data from the network.
        self.data = data
        self._logger = QuietLogger()

    def _parse(self) -> None:
        """
        Simulates the parsing of a packet which can fail.
        """
        try:
            # In a real scenario, parsing logic would go here.
            # An attacker sends a crafted packet that is guaranteed to fail parsing
            # in a way that includes part of the packet data in the error message.
            if self.data.startswith(b'invalid_packet'):
                raise IncomingDecodeError(f"Packet decoding failed for: {self.data!r}")
        except IncomingDecodeError:
            # The exception is caught and logged using the vulnerable method.
            # The error message from `sys.exc_info()[1]` is unique per packet,
            # and the traceback holds a reference to `self.data`.
            self._logger.log_exception(str(sys.exc_info()[1]))