guard missing /AP appearance state in button form fields

Author: metsw24-max

pypdf/_doc_common.py

@@ -96,6 +96,15 @@ def convert_to_int(d: bytes, size: int) -> Union[int, tuple[Any, ...]]:
     return cast(int, struct.unpack(">Q", d)[0])
 
 
+def _normal_appearance(appearance: Any) -> Optional[DictionaryObject]:
+    """Return the /N normal-appearance sub-dictionary, or None when absent."""
+    appearance = appearance.get_object()
+    if not isinstance(appearance, DictionaryObject) or "/N" not in appearance:
+        return None
+    normal = appearance["/N"]
+    return normal if isinstance(normal, DictionaryObject) else None
+
+
 class DocumentInformation(DictionaryObject):
     """
     A class representing the basic document metadata provided in a PDF File.
@@ -629,17 +638,22 @@ def _build_field(
             retval[key][NameObject("/_States_")] = obj[NameObject(FA.Opt)]
         if obj.get(FA.FT, "") == "/Btn" and "/AP" in obj:
             #  Checkbox
-            retval[key][NameObject("/_States_")] = ArrayObject(
-                list(obj["/AP"]["/N"].keys())
-            )
-            if "/Off" not in retval[key]["/_States_"]:
-                retval[key][NameObject("/_States_")].append(NameObject("/Off"))
+            normal = _normal_appearance(obj["/AP"])
+            if normal is not None:
+                retval[key][NameObject("/_States_")] = ArrayObject(
+                    list(normal.keys())
+                )
+                if "/Off" not in retval[key]["/_States_"]:
+                    retval[key][NameObject("/_States_")].append(NameObject("/Off"))
         elif obj.get(FA.FT, "") == "/Btn" and obj.get(FA.Ff, 0) & FA.FfBits.Radio != 0:
             states: list[str] = []
             retval[key][NameObject("/_States_")] = ArrayObject(states)
             for k in obj.get(FA.Kids, {}):
                 k = k.get_object()
-                for s in list(k["/AP"]["/N"].keys()):
+                normal = _normal_appearance(k["/AP"]) if "/AP" in k else None
+                if normal is None:
+                    continue
+                for s in list(normal.keys()):
                     if s not in states:
                         states.append(s)
                 retval[key][NameObject("/_States_")] = ArrayObject(states)

tests/test_doc_common.py

@@ -208,6 +208,50 @@ def test_build_destination__short_array():
     assert dest["/Type"] == "/FitR"
 
 
+def _reader_with_button_field(field: DictionaryObject) -> PdfReader:
+    writer = PdfWriter()
+    writer.add_blank_page(width=72, height=72)
+    reference = writer._add_object(field)
+    acroform = DictionaryObject()
+    acroform[NameObject("/Fields")] = ArrayObject([reference])
+    writer._root_object[NameObject("/AcroForm")] = writer._add_object(acroform)
+    stream = BytesIO()
+    writer.write(stream)
+    stream.seek(0)
+    return PdfReader(stream)
+
+
+def test_build_field__checkbox_missing_normal_appearance():
+    # A checkbox whose /AP has no /N sub-dictionary must not crash get_fields().
+    field = DictionaryObject()
+    field[NameObject("/T")] = TextStringObject("CheckBox")
+    field[NameObject("/FT")] = NameObject("/Btn")
+    field[NameObject("/AP")] = DictionaryObject()
+    fields = _reader_with_button_field(field).get_fields()
+    assert "CheckBox" in fields
+    assert "/_States_" not in fields["CheckBox"]
+
+    # A well-formed /AP /N still collects the appearance states.
+    normal = DictionaryObject()
+    normal[NameObject("/Yes")] = NumberObject(1)
+    appearance = DictionaryObject()
+    appearance[NameObject("/N")] = normal
+    field[NameObject("/AP")] = appearance
+    fields = _reader_with_button_field(field).get_fields()
+    assert all(state in fields["CheckBox"]["/_States_"] for state in ("/Yes", "/Off"))
+
+
+def test_build_field__radio_kid_missing_appearance():
+    # A radio kid lacking /AP (or its /N) must not crash get_fields().
+    field = DictionaryObject()
+    field[NameObject("/T")] = TextStringObject("Radio")
+    field[NameObject("/FT")] = NameObject("/Btn")
+    field[NameObject("/Ff")] = NumberObject(1 << 15)
+    field[NameObject("/Kids")] = ArrayObject([DictionaryObject()])
+    fields = _reader_with_button_field(field).get_fields()
+    assert list(fields["Radio"]["/_States_"]) == []
+
+
 @pytest.mark.enable_socket
 def test_named_destinations__tree_is_null_object():
     url = "https://github.com/user-attachments/files/20885216/test.pdf"