Fix CVE-2026-33123: bound array-based ContentStream

A content stream supplied as an array of many stream objects (or whose
elements concatenate to an enormous size) made ContentStream.__init__
build the combined buffer with an unbounded `data += ...` loop, causing
CPU/memory exhaustion (CWE-400/CWE-407).

Cap the number of array elements (CONTENT_STREAM_ARRAY_MAX_LENGTH = 10000)
and the total concatenated size (MAX_ARRAY_BASED_STREAM_OUTPUT_LENGTH =
75 MB), raising PdfReadError when exceeded, and join via a list to avoid
the quadratic concatenation. Mirrors upstream pypdf 6.9.1 (PR py-pdf#3686).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: icanhasmath

PyPDF2/generic.py

@@ -68,6 +68,10 @@
 # stream /Length. Set to 0 to disable (only safe for fully trusted input).
 MAX_DECLARED_STREAM_LENGTH = 75000000  # 75 MB
 
+# CVE-2026-33123: bound array-based content streams. Set to 0 to disable.
+CONTENT_STREAM_ARRAY_MAX_LENGTH = 10000  # max number of array elements
+MAX_ARRAY_BASED_STREAM_OUTPUT_LENGTH = 75000000  # 75 MB total concatenated
+
 ObjectPrefix = b_("/<[tf(n%")
 NumberSigns = b_("+-")
 IndirectPattern = re.compile(b_(r"[+-]?(\d+)\s+(\d+)\s+R[^a-zA-Z]"))
@@ -1220,10 +1224,32 @@ def __init__(self, stream, pdf):
         # multiple StreamObjects to be cat'd together.
         stream = stream.get_object()
         if isinstance(stream, ArrayObject):
-            data = b_("")
+            # CVE-2026-33123: bound both the number of array elements and the
+            # total concatenated size so a crafted array-based content stream
+            # cannot exhaust CPU/memory.
+            if (
+                CONTENT_STREAM_ARRAY_MAX_LENGTH
+                and len(stream) > CONTENT_STREAM_ARRAY_MAX_LENGTH
+            ):
+                raise PdfReadError(
+                    "Content stream array has %d elements, exceeding the "
+                    "maximum of %d." % (len(stream), CONTENT_STREAM_ARRAY_MAX_LENGTH)
+                )
+            parts = []
+            total = 0
             for s in stream:
-                data += b_(s.get_object().get_data())
-            stream = BytesIO(b_(data))
+                new_data = b_(s.get_object().get_data())
+                total += len(new_data)
+                if (
+                    MAX_ARRAY_BASED_STREAM_OUTPUT_LENGTH
+                    and total > MAX_ARRAY_BASED_STREAM_OUTPUT_LENGTH
+                ):
+                    raise PdfReadError(
+                        "Content stream array output exceeds the maximum of "
+                        "%d bytes." % MAX_ARRAY_BASED_STREAM_OUTPUT_LENGTH
+                    )
+                parts.append(new_data)
+            stream = BytesIO(b_("").join(parts))
         else:
             stream = BytesIO(b_(stream.get_data()))
         self.__parseContentStream(stream)

Tests/test_security_generic.py

@@ -19,7 +19,20 @@
 
 from PyPDF2 import generic
 from PyPDF2.errors import PdfReadError
-from PyPDF2.generic import DictionaryObject, NameObject, TreeObject
+from PyPDF2.generic import (
+    ArrayObject,
+    ContentStream,
+    DecodedStreamObject,
+    DictionaryObject,
+    NameObject,
+    TreeObject,
+)
+
+
+def _stream(data):
+    so = DecodedStreamObject()
+    so._data = data
+    return so
 
 
 def _node(**kv):
@@ -67,3 +80,26 @@ def test_small_stream_length_ok():
     data = b"<< /Length 3 >>\nstream\nabc\nendstream"
     obj = generic.DictionaryObject.read_from_stream(BytesIO(data), pdf)
     assert obj.get_data() in (b"abc", "abc")
+
+
+# --- CVE-2026-33123: array-based ContentStream caps -----------------------
+
+def test_content_stream_array_element_cap(monkeypatch):
+    monkeypatch.setattr(generic, "CONTENT_STREAM_ARRAY_MAX_LENGTH", 2)
+    arr = ArrayObject([_stream(b"q\n"), _stream(b"Q\n"), _stream(b"q\n")])
+    with pytest.raises(PdfReadError):
+        ContentStream(arr, Mock())
+
+
+def test_content_stream_array_output_cap(monkeypatch):
+    monkeypatch.setattr(generic, "MAX_ARRAY_BASED_STREAM_OUTPUT_LENGTH", 3)
+    arr = ArrayObject([_stream(b"q\n"), _stream(b"Q\n")])  # 4 bytes > 3
+    with pytest.raises(PdfReadError):
+        ContentStream(arr, Mock())
+
+
+def test_content_stream_array_ok():
+    arr = ArrayObject([_stream(b"q\n"), _stream(b"Q\n")])
+    cs = ContentStream(arr, Mock())
+    assert len(cs.operations) == 2
+