pypdf: Manipulated FlateDecode XFA streams can exhaust RAM

@@ -29,7 +29,6 @@
 # POSSIBILITY OF SUCH DAMAGE.
 
 import struct
-import zlib
 from abc import abstractmethod
 from collections.abc import Generator, Iterable, Iterator, Mapping
 from datetime import datetime
@@ -61,6 +60,7 @@
 from .constants import FieldDictionaryAttributes as FA
 from .constants import PageAttributes as PG
 from .errors import PdfReadError, PyPdfError
+from .filters import _decompress_with_limit
 from .generic import (
     ArrayObject,
     BooleanObject,
@@ -1324,7 +1324,6 @@ def is_encrypted(self) -> bool:
 
     @property
     def xfa(self) -> Optional[dict[str, Any]]:
-        tree: Optional[TreeObject] = None
         retval: dict[str, Any] = {}
         catalog = self.root_object
 
@@ -1342,7 +1341,7 @@ def xfa(self) -> Optional[dict[str, Any]]:
                 if isinstance(f, IndirectObject):
                     field = cast(Optional[EncodedStreamObject], f.get_object())
                     if field:
-                        es = zlib.decompress(field._data)
+                        es = _decompress_with_limit(field._data)
                         retval[tag] = es
         return retval
 

@@ -11,11 +11,13 @@
 import pytest
 
 from pypdf import PdfReader, PdfWriter
-from pypdf.errors import PdfReadError
+from pypdf.errors import LimitReachedError, PdfReadError
+from pypdf.filters import FlateDecode
 from pypdf.generic import (
     ArrayObject,
     DictionaryObject,
     EmbeddedFile,
+    EncodedStreamObject,
     NameObject,
     NullObject,
     TextStringObject,
@@ -552,3 +554,30 @@ def test_get_outline__cyclic_references__nested_handling(caplog):
         ]
     ]
     assert caplog.messages[0].startswith("Detected cycle in outline structure for {")
+
+
+def test_xfa__decompression_limit():
+    payload = b"A" * 100_0000
+    compressed = FlateDecode.encode(payload, 9)
+
+    writer = PdfWriter()
+    writer.add_blank_page(width=72, height=72)
+
+    stream = EncodedStreamObject()
+    stream._data = compressed
+    stream[NameObject("/Filter")] = NameObject("/FlateDecode")
+    stream_reference = writer._add_object(stream)
+
+    acro = DictionaryObject()
+    acro[NameObject("/XFA")] = ArrayObject([TextStringObject("datasets"), stream_reference])
+    writer.root_object[NameObject("/AcroForm")] = writer._add_object(acro)
+
+    data = BytesIO()
+    writer.write(data)
+    data.flush()
+
+    reader = PdfReader(data)
+    with mock.patch("pypdf.filters.ZLIB_MAX_OUTPUT_LENGTH", 75_000), pytest.raises(
+            expected_exception=LimitReachedError, match=r"^Limit reached while decompressing. 902 bytes remaining.$"
+    ):
+        _ = reader.xfa