Patched code sample

import sys

# This example simulates the logic used to fix the infinite loop vulnerability
# in pypdf. The vulnerability occurred when traversing a linked list of PDF
# outline items (bookmarks) that contained a cycle. The fix involves tracking
# visited items to detect such a cycle.

# Suppress RecursionError for this demonstration on some platforms
sys.setrecursionlimit(2000)

class MockPdfOutlineItem:
    """A mock object to represent a PDF outline item (bookmark)."""
    def __init__(self, title, obj_id):
        self.title = title
        # In a real PDF, this would be an IndirectObject reference.
        # We use a simple integer ID for this simulation.
        self.obj_id = obj_id
        self.next = None

    def __repr__(self):
        return f"Outline(id={self.obj_id}, title='{self.title}')"

def add_outlines_fixed(writer_outlines, new_outlines, visited_ids):
    """
    A function that represents the fixed logic.
    It traverses the outline items and adds them, but crucially, it keeps track
    of visited object IDs to prevent an infinite loop if a cycle is present.

    :param writer_outlines: The list where outlines are being collected.
    :param new_outlines: The current outline item to process.
    :param visited_ids: A set of object IDs that have already been processed.
    """
    current = new_outlines
    while current is not None:
        # THE FIX: Check if the object ID has been seen before.
        if current.obj_id in visited_ids:
            # If so, a cycle is detected. Stop processing this chain.
            print(f"Cycle detected at {current!r}. Halting traversal.")
            return

        # Mark this object ID as visited.
        visited_ids.add(current.obj_id)
        print(f"Processing {current!r}")
        writer_outlines.append(current)

        # In a real implementation, this would also handle child outlines ('/First').
        # We simplify to just the '/Next' chain for this example.

        # Move to the next item in the linked list.
        current = current.next

if __name__ == '__main__':
    # 1. Create a series of mock outline items.
    # In a malicious PDF, these would be actual PDF objects.
    item1 = MockPdfOutlineItem("Chapter 1", 101)
    item2 = MockPdfOutlineItem("Chapter 2", 102)
    item3 = MockPdfOutlineItem("Appendix", 103) # The malicious item

    # 2. Create a structure with a cycle, simulating a crafted PDF.
    # The list of outlines should be: Chapter 1 -> Chapter 2 -> Appendix
    # But the malicious PDF makes the Appendix link back to Chapter 2.
    item1.next = item2
    item2.next = item3
    item3.next = item2  # This creates the infinite loop: 2 -> 3 -> 2 -> 3 ...

    # 3. Demonstrate the fixed logic.
    print("Demonstrating the fix for CVE-2026-54531 (simulated):")
    final_outline_list = []
    visited_object_ids = set()

    # The `add_outlines_fixed` function safely processes the list,
    # detects the cycle, and terminates gracefully.
    add_outlines_fixed(final_outline_list, item1, visited_object_ids)

    print("\nProcessing complete. Final outlines collected:")
    for outline in final_outline_list:
        print(f"- {outline.title}")

    # If the vulnerable code were run, it would print:
    # Processing Outline(id=101, title='Chapter 1')
    # Processing Outline(id=102, title='Chapter 2')
    # Processing Outline(id=103, title='Appendix')
    # Processing Outline(id=102, title='Chapter 2')
    # Processing Outline(id=103, title='Appendix')
    # ... and so on, indefinitely.