#2 Using PdfReader causes a crash

[Avgor46]

Hi!

It's me again, I've been fuzzing PdfReader with a sydr-fuzz via langchain project and found few errors. The necessary information to reproduce one of them is provided below.

Environment

Which environment were you using when you encountered the problem?

$ python -m platform
Linux-5.15.0-56-generic-x86_64-with-glibc2.31

$ python -c "import pypdf;print(pypdf._debug_versions)"
pypdf==4.3.1, crypt_provider=('cryptography', '3.1'), PIL=none

upd. commit b7b3c8c

Code + PDF

This is a minimal, complete example that shows the issue:

#! /usr/bin/env python3

import pypdf
from pypdf.errors import EmptyFileError, PdfReadError, PdfStreamError
import sys

def TestOneInput(fname):
  try:
    pdf_reader = pypdf.PdfReader(fname)
    for page_number, page in enumerate(pdf_reader.pages):
        page.extract_text()
  except (EmptyFileError, PdfReadError, PdfStreamError):
      pass

if __name__ == "__main__":
    if len(sys.argv) < 2:
        exit(1)
    TestOneInput(sys.argv[1])

PoC

crash-c1920c7a064649e1191d7879952ec252473fc7e6.pdf

Traceback

This is the complete traceback I see:

Traceback (most recent call last):
  File "/usr/local/lib/python3.9/dist-packages/pypdf/_page.py", line 1869, in process_operation
    charMapTuple = cmaps[operands[0]]
KeyError: 10

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/fuzz/./poc.py", line 18, in <module>
    TestOneInput(sys.argv[1])
  File "/fuzz/./poc.py", line 11, in TestOneInput
    page.extract_text()
  File "/usr/local/lib/python3.9/dist-packages/pypdf/_page.py", line 2231, in extract_text
    return self._extract_text(
  File "/usr/local/lib/python3.9/dist-packages/pypdf/_page.py", line 2025, in _extract_text
    process_operation(operator, operands)
  File "/usr/local/lib/python3.9/dist-packages/pypdf/_page.py", line 1885, in process_operation
    "???" + operands[0],
TypeError: can only concatenate str (not "NumberObject") to str

[pubpub-zz]

your pdf is invalid : the content holds Tf operator where the font is missing.
however for robustification you can replace line 1886 in _page.py with:

                        f"???{operands[0]}",

I will produce a PR with this fix and add a test with your file