Simon Lees
dc93183e5e
- Add security patches: * CVE-2025-55197.patch (bsc#1248089) * CVE-2026-27024.patch (bsc#1258691) * CVE-2026-27025.patch (bsc#1258692) * CVE-2026-27026.patch (bsc#1258693) OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-PyPDF2?expand=0&rev=26
53 lines
2.1 KiB
Diff
53 lines
2.1 KiB
Diff
From 7905842d833f899f1d3228af7e7467ad80277016 Mon Sep 17 00:00:00 2001
|
|
From: Stefan <96178532+stefan6419846@users.noreply.github.com>
|
|
Date: Tue, 17 Feb 2026 17:38:44 +0100
|
|
Subject: [PATCH] SEC: Limit FlateDecode recovery attempts (#3644)
|
|
|
|
---
|
|
docs/user/security.md | 3 +++
|
|
PyPDF2/filters.py | 16 ++++++++++++----
|
|
tests/test_filters.py | 13 ++++++++++---
|
|
3 files changed, 25 insertions(+), 7 deletions(-)
|
|
|
|
Index: PyPDF2-2.11.1/PyPDF2/filters.py
|
|
===================================================================
|
|
--- PyPDF2-2.11.1.orig/PyPDF2/filters.py
|
|
+++ PyPDF2-2.11.1/PyPDF2/filters.py
|
|
@@ -60,6 +60,11 @@ from .constants import LzwFilterParamete
|
|
from .constants import StreamAttributes as SA
|
|
from .errors import LimitReachedError, PdfReadError, PdfStreamError
|
|
|
|
+ZLIB_MAX_RECOVERY_INPUT_LENGTH = 5_000_000
|
|
+
|
|
+# Reuse cached 1-byte values in the fallback loop to avoid per-byte allocations.
|
|
+_SINGLE_BYTES = tuple(bytes((i,)) for i in range(256))
|
|
+
|
|
|
|
def decompress(data: bytes) -> bytes:
|
|
try:
|
|
@@ -67,10 +72,22 @@ def decompress(data: bytes) -> bytes:
|
|
except zlib.error:
|
|
d = zlib.decompressobj(zlib.MAX_WBITS | 32)
|
|
result_str = b""
|
|
- for b in [data[i : i + 1] for i in range(len(data))]:
|
|
+ remaining_limit = ZLIB_MAX_OUTPUT_LENGTH
|
|
+ for index in range(len(data)):
|
|
+ chunk = _SINGLE_BYTES[data[index]]
|
|
try:
|
|
- result_str += d.decompress(b)
|
|
+ decompressed = d.decompress(chunk)
|
|
+ result_str += decompressed
|
|
+ remaining_limit -= len(decompressed)
|
|
+ if remaining_limit <= 0:
|
|
+ raise LimitReachedError(
|
|
+ f"Limit reached while decompressing. {len(data) - index} bytes remaining."
|
|
+ )
|
|
except zlib.error:
|
|
+ if index > ZLIB_MAX_RECOVERY_INPUT_LENGTH:
|
|
+ raise LimitReachedError(
|
|
+ f"Recovery limit reached while decompressing. {data_length - index} bytes remaining."
|
|
+ )
|
|
pass
|
|
return result_str
|
|
|