ROB: tolerate malformed /Decode array in image extraction

pypdf/generic/_image_xobject.py

@@ -398,6 +398,19 @@ def _apply_decode(
         and color_space[0].get_object() == "/Separation"
     ):
         decode = [1.0, 0.0] * len(img.getbands())
+    if decode is not None and (
+        not isinstance(decode, list) or len(decode) % 2 != 0
+    ):
+        # /Decode is read straight from the image dictionary and must hold an
+        # even number of values (a [min max] pair per component). A malformed
+        # array would otherwise read past its end at decode[i + 1]; drop it and
+        # render the image without the remap.
+        logger_warning(
+            "Ignoring malformed /Decode array %(decode)s; expected an even number of values.",
+            source=__name__,
+            decode=decode,
+        )
+        decode = None
     if decode is not None and not all(decode[i] == i % 2 for i in range(len(decode))):
         lut: list[int] = []
         for i in range(0, len(decode), 2):

tests/generic/test_image_xobject.py

@@ -1,4 +1,5 @@
 """Test the pypdf.generic._image_xobject module."""
+import zlib
 from io import BytesIO
 
 import PIL
@@ -7,9 +8,17 @@
 
 from pypdf import PdfReader
 from pypdf._utils import Version
-from pypdf.constants import FilterTypes, ImageAttributes, StreamAttributes
+from pypdf.constants import ColorSpaces, FilterTypes, ImageAttributes, StreamAttributes
 from pypdf.errors import EmptyImageDataError, LimitReachedError, PdfReadError
-from pypdf.generic import ArrayObject, DecodedStreamObject, NameObject, NumberObject, StreamObject, TextStringObject
+from pypdf.generic import (
+    ArrayObject,
+    DecodedStreamObject,
+    NameObject,
+    NumberObject,
+    PdfObject,
+    StreamObject,
+    TextStringObject,
+)
 from pypdf.generic._image_xobject import (
     _get_image_mode,
     _handle_flate,
@@ -403,6 +412,34 @@ def test_xobj_to_image__color_components_out_of_range() -> None:
         _xobj_to_image(x_object)
 
 
+@pytest.mark.parametrize(
+    "decode",
+    [
+        ArrayObject([NumberObject(1), NumberObject(0), NumberObject(1)]),
+        ArrayObject([NumberObject(1)]),
+        NumberObject(1),
+    ],
+    ids=["odd-length-array", "single-value-array", "not-an-array"],
+)
+def test_xobj_to_image__malformed_decode(
+    decode: PdfObject, caplog: pytest.LogCaptureFixture
+) -> None:
+    """A /Decode without an even number of values must not raise IndexError."""
+    x_object = StreamObject()
+    x_object[NameObject(ImageAttributes.WIDTH)] = NumberObject(2)
+    x_object[NameObject(ImageAttributes.HEIGHT)] = NumberObject(2)
+    x_object[NameObject(ImageAttributes.BITS_PER_COMPONENT)] = NumberObject(8)
+    x_object[NameObject(ImageAttributes.COLOR_SPACE)] = NameObject(ColorSpaces.DEVICE_GRAY)
+    x_object[NameObject(StreamAttributes.FILTER)] = NameObject(FilterTypes.FLATE_DECODE)
+    x_object[NameObject(ImageAttributes.DECODE)] = decode
+    x_object.set_data(zlib.compress(bytes([0, 64, 128, 255])))
+
+    _, _, image = _xobj_to_image(x_object)
+    image.load()
+    assert image.size == (2, 2)
+    assert "Ignoring malformed /Decode array" in caplog.text
+
+
 @pytest.mark.parametrize(
     ("mode", "expected"),
     [