Merge pull request #3 from ActiveState/1.28.6-sec-generic

Security (3/5): generic.py parse limits & cycle guard — CVE-2026-27024, CVE-2026-31826, CVE-2026-33123

Author: icanhasmath

PyPDF2/generic.py

@@ -63,6 +63,15 @@
     from io import BytesIO, StringIO
 
 logger = logging.getLogger(__name__)
+
+# CVE-2026-31826: refuse to pre-allocate a read buffer for an absurd declared
+# stream /Length. Set to 0 to disable (only safe for fully trusted input).
+MAX_DECLARED_STREAM_LENGTH = 75000000  # 75 MB
+
+# CVE-2026-33123: bound array-based content streams. Set to 0 to disable.
+CONTENT_STREAM_ARRAY_MAX_LENGTH = 10000  # max number of array elements
+MAX_ARRAY_BASED_STREAM_OUTPUT_LENGTH = 75000000  # 75 MB total concatenated
+
 ObjectPrefix = b_("/<[tf(n%")
 NumberSigns = b_("+-")
 IndirectPattern = re.compile(b_(r"[+-]?(\d+)\s+(\d+)\s+R[^a-zA-Z]"))
@@ -835,6 +844,17 @@ def read_from_stream(stream, pdf):
                 t = stream.tell()
                 length = pdf.get_object(length)
                 stream.seek(t, 0)
+            # CVE-2026-31826: a crafted /Length (e.g. 2 GB) would make
+            # stream.read(length) pre-allocate a huge buffer. Reject it.
+            if (
+                isinstance(length, int)
+                and MAX_DECLARED_STREAM_LENGTH
+                and length > MAX_DECLARED_STREAM_LENGTH
+            ):
+                raise PdfReadError(
+                    "Declared stream length (%d bytes) exceeds maximum allowed "
+                    "(%d bytes)." % (length, MAX_DECLARED_STREAM_LENGTH)
+                )
             data["__streamdata__"] = stream.read(length)
             e = readNonWhitespace(stream)
             ndstream = stream.read(8)
@@ -895,9 +915,22 @@ def children(self):
                 raise StopIteration
 
         child = self["/First"]
+        last = self["/Last"]
+        # CVE-2026-27024: a crafted outline whose /Next chain forms a cycle
+        # that never reaches /Last made this loop run forever. Track visited
+        # nodes and stop on a repeat.
+        visited = set()
         while True:
+            child_id = id(child)
+            if child_id in visited:
+                logger.warning("Cycle detected in TreeObject.children; stopping")
+                if sys.version_info >= (3, 5):  # PEP 479
+                    return
+                else:
+                    raise StopIteration
+            visited.add(child_id)
             yield child
-            if child == self["/Last"]:
+            if child == last:
                 if sys.version_info >= (3, 5):  # PEP 479
                     return
                 else:
@@ -1191,10 +1224,32 @@ def __init__(self, stream, pdf):
         # multiple StreamObjects to be cat'd together.
         stream = stream.get_object()
         if isinstance(stream, ArrayObject):
-            data = b_("")
+            # CVE-2026-33123: bound both the number of array elements and the
+            # total concatenated size so a crafted array-based content stream
+            # cannot exhaust CPU/memory.
+            if (
+                CONTENT_STREAM_ARRAY_MAX_LENGTH
+                and len(stream) > CONTENT_STREAM_ARRAY_MAX_LENGTH
+            ):
+                raise PdfReadError(
+                    "Content stream array has %d elements, exceeding the "
+                    "maximum of %d." % (len(stream), CONTENT_STREAM_ARRAY_MAX_LENGTH)
+                )
+            parts = []
+            total = 0
             for s in stream:
-                data += b_(s.get_object().get_data())
-            stream = BytesIO(b_(data))
+                new_data = b_(s.get_object().get_data())
+                total += len(new_data)
+                if (
+                    MAX_ARRAY_BASED_STREAM_OUTPUT_LENGTH
+                    and total > MAX_ARRAY_BASED_STREAM_OUTPUT_LENGTH
+                ):
+                    raise PdfReadError(
+                        "Content stream array output exceeds the maximum of "
+                        "%d bytes." % MAX_ARRAY_BASED_STREAM_OUTPUT_LENGTH
+                    )
+                parts.append(new_data)
+            stream = BytesIO(b_("").join(parts))
         else:
             stream = BytesIO(b_(stream.get_data()))
         self.__parseContentStream(stream)

Tests/test_security_generic.py

@@ -0,0 +1,105 @@
+# -*- coding: utf-8 -*-
+"""
+Regression tests for the generic.py parsing-limit / cycle-guard backports:
+
+- CVE-2026-27024 : TreeObject.children cyclic /Next infinite loop.
+- CVE-2026-31826 : unbounded declared stream /Length allocation.
+- CVE-2026-33123 : array-based ContentStream resource exhaustion.
+"""
+import pytest
+
+try:
+    from io import BytesIO
+except ImportError:  # pragma: no cover
+    from cStringIO import StringIO as BytesIO
+try:
+    from unittest.mock import Mock
+except ImportError:  # Python 2
+    from mock import Mock
+
+from PyPDF2 import generic
+from PyPDF2.errors import PdfReadError
+from PyPDF2.generic import (
+    ArrayObject,
+    ContentStream,
+    DecodedStreamObject,
+    DictionaryObject,
+    NameObject,
+    TreeObject,
+)
+
+
+def _stream(data):
+    so = DecodedStreamObject()
+    so._data = data
+    return so
+
+
+def _node(**kv):
+    d = DictionaryObject()
+    for k, v in kv.items():
+        d[NameObject(k)] = v
+    return d
+
+
+# --- CVE-2026-27024: TreeObject.children cycle ----------------------------
+
+def test_children_linear_ok():
+    a = DictionaryObject()
+    b = DictionaryObject()
+    a[NameObject("/Next")] = b
+    t = TreeObject()
+    t[NameObject("/First")] = a
+    t[NameObject("/Last")] = b
+    assert list(t.children()) == [a, b]
+
+
+def test_children_cycle_terminates():
+    a = DictionaryObject()
+    b = DictionaryObject()
+    a[NameObject("/Next")] = b
+    b[NameObject("/Next")] = a  # cycle that never reaches /Last
+    t = TreeObject()
+    t[NameObject("/First")] = a
+    t[NameObject("/Last")] = DictionaryObject()  # unreachable sentinel
+    kids = list(t.children())  # must terminate rather than hang
+    assert kids == [a, b]
+
+
+# --- CVE-2026-31826: declared stream /Length cap --------------------------
+
+def test_declared_stream_length_capped():
+    pdf = Mock(strict=False)
+    data = b"<< /Length 999999999 >>\nstream\n"
+    with pytest.raises(PdfReadError):
+        generic.DictionaryObject.read_from_stream(BytesIO(data), pdf)
+
+
+def test_small_stream_length_ok():
+    pdf = Mock(strict=False)
+    data = b"<< /Length 3 >>\nstream\nabc\nendstream"
+    obj = generic.DictionaryObject.read_from_stream(BytesIO(data), pdf)
+    assert obj.get_data() in (b"abc", "abc")
+
+
+# --- CVE-2026-33123: array-based ContentStream caps -----------------------
+
+def test_content_stream_array_element_cap(monkeypatch):
+    monkeypatch.setattr(generic, "CONTENT_STREAM_ARRAY_MAX_LENGTH", 2)
+    arr = ArrayObject([_stream(b"q\n"), _stream(b"Q\n"), _stream(b"q\n")])
+    with pytest.raises(PdfReadError):
+        ContentStream(arr, Mock())
+
+
+def test_content_stream_array_output_cap(monkeypatch):
+    monkeypatch.setattr(generic, "MAX_ARRAY_BASED_STREAM_OUTPUT_LENGTH", 3)
+    arr = ArrayObject([_stream(b"q\n"), _stream(b"Q\n")])  # 4 bytes > 3
+    with pytest.raises(PdfReadError):
+        ContentStream(arr, Mock())
+
+
+def test_content_stream_array_ok():
+    arr = ArrayObject([_stream(b"q\n"), _stream(b"Q\n")])
+    cs = ContentStream(arr, Mock())
+    assert len(cs.operations) == 2
+