Empty String Integer Parsing in NumberObject.new

[JeffAllen714]

I found something when using PyPDF in my flask application. When processing a malformed PDF file with a corrupted xref table, the library attempts to parse an empty string as an integer, resulting in an unhandled ValueError exception. This can potentially be exploited to cause denial of service in applications that use PyPDF4 to process user-uploaded PDF files.

I've created a write-up explaining this more in depth, including a PoC

https://github.com/JeffAllen714/PyPDF4-Integer-Parsing-Vulnerability/blob/main/PyPDF4-Integer-Parsing-Vulnerability-Writeup.md

[MasterOdin]

This library has long since been abandoned, and the recommendation would be to use https://github.com/py-pdf/pypdf instead which is actively maintained.

Also looks like you since deleted the repo so cannot see your writeup to see if it applies to pypdf.

[JeffAllen714]

Sorry about that, I had moved the write-up over to Gist. Heres a link:

https://gist.github.com/JeffAllen714/af0700fc5e13e3ff91a713f5156fea6e