SEC: Avoid infinite loops for incomplete ASCII85 and ASCIIHex inline images (#3892)

Author: stefan6419846

pypdf/generic/_data_structures.py

@@ -1396,7 +1396,7 @@ def _read_inline_image(self, stream: StreamType) -> dict[str, Any]:
         while True:
             tok = read_non_whitespace(stream)
             if not tok:
-                raise PdfStreamError("Unexpected end of stream.")
+                raise PdfReadError("Unexpected end of stream.")
             stream.seek(-1, 1)
             if tok == b"I":
                 # "ID" - begin of image data

pypdf/generic/_image_inline.py

@@ -61,9 +61,9 @@ def extract_inline__ascii_hex_decode(stream: StreamType) -> bytes:
     data_out = bytearray()
     # Read data until delimiter > and EI as backup.
     while True:
-        data_buffered = read_non_whitespace(stream) + stream.read(BUFFER_SIZE)
-        if not data_buffered:
-            raise PdfReadError("Unexpected end of stream")
+        data_buffered = read_non_whitespace(stream) + (read_bytes := stream.read(BUFFER_SIZE))
+        if not data_buffered or not read_bytes:
+            raise PdfReadError("Unexpected end of stream.")
         pos_tok = data_buffered.find(b">")
         if pos_tok >= 0:  # found >
             data_out += data_buffered[: pos_tok + 1]
@@ -81,13 +81,13 @@ def extract_inline__ascii_hex_decode(stream: StreamType) -> bytes:
             break
         if len(data_buffered) == 2:
             data_out += data_buffered
-            raise PdfReadError("Unexpected end of stream")
+            raise PdfReadError("Unexpected end of stream.")
         # Neither > nor EI found
         data_out += data_buffered[:-2]
         stream.seek(-2, 1)
 
     if not _check_end_image_marker(stream):
-        raise PdfReadError("EI stream not found")
+        raise PdfReadError("EI stream not found.")
     return bytes(data_out)
 
 
@@ -99,24 +99,24 @@ def extract_inline__ascii85_decode(stream: StreamType) -> bytes:
     data_out = bytearray()
     # Read data until delimiter ~>
     while True:
-        data_buffered = read_non_whitespace(stream) + stream.read(BUFFER_SIZE)
-        if not data_buffered:
-            raise PdfReadError("Unexpected end of stream")
+        data_buffered = read_non_whitespace(stream) + (read_bytes := stream.read(BUFFER_SIZE))
+        if not data_buffered or not read_bytes:
+            raise PdfReadError("Unexpected end of stream.")
         pos_tok = data_buffered.find(b"~>")
         if pos_tok >= 0:  # found!
             data_out += data_buffered[: pos_tok + 2]
             stream.seek(-len(data_buffered) + pos_tok + 2, 1)
             break
         if len(data_buffered) == 2:  # end of buffer
             data_out += data_buffered
-            raise PdfReadError("Unexpected end of stream")
+            raise PdfReadError("Unexpected end of stream.")
         data_out += data_buffered[
             :-2
         ]  # back by one char in case of in the middle of ~>
         stream.seek(-2, 1)
 
     if not _check_end_image_marker(stream):
-        raise PdfReadError("EI stream not found")
+        raise PdfReadError("EI stream not found.")
     return bytes(data_out)
 
 
@@ -130,7 +130,7 @@ def extract_inline__run_length_decode(stream: StreamType) -> bytes:
     while True:
         data_buffered = stream.read(BUFFER_SIZE)
         if not data_buffered:
-            raise PdfReadError("Unexpected end of stream")
+            raise PdfReadError("Unexpected end of stream.")
         pos_tok = data_buffered.find(b"\x80")
         if pos_tok >= 0:  # found
             # Ideally, we could just use plain run-length decoding here, where 80_16 = 128_10
@@ -155,7 +155,7 @@ def extract_inline__run_length_decode(stream: StreamType) -> bytes:
         data_out += data_buffered
 
     if not _check_end_image_marker(stream):
-        raise PdfReadError("EI stream not found")
+        raise PdfReadError("EI stream not found.")
     return bytes(data_out)
 
 
@@ -169,7 +169,7 @@ def read(length: int) -> bytes:
         # If the object is in non-blocking mode and no bytes are available, `None` is returned.
         _result = stream.read(length)
         if _result is None or len(_result) != length:
-            raise PdfReadError("Unexpected end of stream")
+            raise PdfReadError("Unexpected end of stream.")
         return _result
 
     data_out = bytearray()
@@ -202,7 +202,7 @@ def read(length: int) -> bytes:
             data_out += read(sz - 2)
 
     if not _check_end_image_marker(stream):
-        raise PdfReadError("EI stream not found")
+        raise PdfReadError("EI stream not found.")
     return bytes(data_out)
 
 
@@ -213,7 +213,7 @@ def extract_inline_default(stream: StreamType) -> bytes:
     while True:
         data_buffered = stream.read(BUFFER_SIZE)
         if not data_buffered:
-            raise PdfReadError("Unexpected end of stream")
+            raise PdfReadError("Unexpected end of stream.")
         pos_ei = data_buffered.find(
             b"E"
         )  # We can not look straight for "EI" because it may not have been loaded in the buffer

tests/generic/test_data_structures.py

@@ -10,7 +10,7 @@
 import pytest
 
 from pypdf import PdfReader, PdfWriter
-from pypdf.errors import LimitReachedError, PdfReadError, PdfStreamError
+from pypdf.errors import LimitReachedError, PdfReadError
 from pypdf.generic import (
     ArrayObject,
     ByteStringObject,
@@ -460,12 +460,13 @@ def test_content_stream__parse_content_stream__limits() -> None:
         content_stream._parse_content_stream(stream)
 
 
+@pytest.mark.timeout(5)
 def test_content_stream__read_inline_image__end_of_stream() -> None:
     # Broken content stream, for example due to filter errors.
     # Specific example:
     #   Error -3 while decompressing data: invalid distance too far back
     #   b'q 0.1 0 0 0.1 0 0 cm\n/R7 gs\n0 g\nq 4.8 0 0 -135.6 2155.08 7150.48 cm\nBI\n/IM true\n/W001'
     content_stream = ContentStream(stream=None, pdf=None)
 
-    with pytest.raises(expected_exception=PdfStreamError, match=r"^Unexpected end of stream\.$"):
+    with pytest.raises(expected_exception=PdfReadError, match=r"^Unexpected end of stream\.$"):
         content_stream._read_inline_image(BytesIO(b"\n/IM true\n/W001"))

tests/generic/test_image_inline.py

@@ -5,7 +5,11 @@
 
 from pypdf import PdfReader
 from pypdf.errors import PdfReadError
-from pypdf.generic._image_inline import is_followed_by_binary_data
+from pypdf.generic._image_inline import (
+    extract_inline__ascii85_decode,
+    extract_inline__ascii_hex_decode,
+    is_followed_by_binary_data,
+)
 from tests import get_data_from_url
 
 
@@ -74,7 +78,7 @@ def test_extract_inline_dct__early_end_of_file() -> None:
     page = reader.pages[0]
 
     with pytest.raises(
-        expected_exception=PdfReadError, match=r"^Unexpected end of stream$"
+        expected_exception=PdfReadError, match=r"^Unexpected end of stream\.$"
     ):
         image = page.images[0].image
         assert image is not None
@@ -91,3 +95,23 @@ def test_extract_inline_dct__multiple_eod() -> None:
         for image in page.images:
             assert image.image is not None
             _ = image.image.load()
+
+
+@pytest.mark.timeout(5)
+def test_extract_inline__ascii_hex_decode__early_end_of_file() -> None:
+    stream = BytesIO(b"ABCDE\nF G")
+
+    with pytest.raises(expected_exception=PdfReadError, match=r"^Unexpected end of stream\.$"):
+        extract_inline__ascii_hex_decode(stream)
+
+
+@pytest.mark.timeout(5)
+def test_extract_inline__ascii85_decode__early_end_of_file() -> None:
+    # Broken content stream, for example due to filter errors.
+    # Specific example:
+    #   Error -3 while decompressing data: invalid distance too far back
+    #   b'[...] \nBI\n/W 16 /H 16 /BPC 8 /CS /RGB /F [/A85 /Fl]\nID\nGar8O(o6*i%*56~\ne  L\ne  L9/ LL9/ L'
+    stream = BytesIO(b"Gar8O(o6*i%*56~\ne  L\ne  L9/ LL9/ L")
+
+    with pytest.raises(expected_exception=PdfReadError, match=r"^Unexpected end of stream\.$"):
+        extract_inline__ascii85_decode(stream)

tests/test_workflows.py

@@ -943,9 +943,8 @@ def test_extra_test_iss1541():
     reader = PdfReader(
         BytesIO(bytes(b.getbuffer()).replace(b"EI \n", b"E! \n")), strict=False
     )
-    with pytest.raises(PdfReadError) as exc:
+    with pytest.raises(expected_exception=PdfReadError, match=r"^Unexpected end of stream\.$"):
         reader.pages[0].extract_text()
-    assert exc.value.args[0] == "Unexpected end of stream"
 
 
 @pytest.mark.enable_socket