CVE-2022-25892: Insufficient Information (NVD-CWE-noinfo)
value: The package muhammara before 2.6.1, from 3.0.0 and before 3.1.1; all versions of package hummus are vulnerable to Denial of Service (DoS) when supplied with a maliciously crafted PDF file to be parsed.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.5
Published: 2022-11-01T05:15Z
Repository: https://github.com/julianhille/MuhammaraJS
Language: C++
Files changed: CHANGELOG.md, src/deps/PDFWriter/PDFParser.cpp, tests/SigSeg.js, tests/TestMaterials/BrokenPdfBadHeader.txt
Commit date: 2022-10-23 09:13:52 +0200
Commit message: Fix NPE in pdf parser

Fixes #214

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index 539b6f95..882b38a2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,10 +5,14 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/)
 and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+### Fixed
+
+- NPE in parser when file ends before it really starts
+
 ## [3.1.0] - 2022-09-30
 
 ### Changed
 
 - Update TypeScript declaration for `PDFStreamForResponse` to accept any writable stream as an argument, not just `PDFRStreamForFile`
diff --git a/src/deps/PDFWriter/PDFParser.cpp b/src/deps/PDFWriter/PDFParser.cpp
index 4cfd0705..d2bc2154 100755
--- a/src/deps/PDFWriter/PDFParser.cpp
+++ b/src/deps/PDFWriter/PDFParser.cpp
@@ -350,10 +350,16 @@ EStatusCode PDFParser::ParseLastXrefPosition()
 		mStream->SetPositionFromEnd(GetCurrentPositionFromEnd());
 
 		mObjectParser.ResetReadState();
 		RefCountPtr<PDFObject> anObject(mObjectParser.ParseNewObject());
 
+		if (!anObject) {
+			status = PDFHummus::eFailure;
+			TRACE_LOG("PDFParser::ParseXrefPosition: Unable to find any object");
+			break;
+		}
+
 		if(anObject->GetType() == PDFObject::ePDFObjectInteger)
 		{
 			mLastXrefPosition = (LongFilePositionType)((PDFInteger*)anObject.GetPtr())->GetValue();
 
 			// find and read startxref keyword
diff --git a/tests/SigSeg.js b/tests/SigSeg.js
new file mode 100644
index 00000000..57fcb3de
--- /dev/null
+++ b/tests/SigSeg.js
@@ -0,0 +1,12 @@
+var muhammara = require("../muhammara");
+const { expect } = require("chai");
+
+describe("SigSegv test", function () {
+  it("should read fields correctly", function () {
+    expect(() =>
+      muhammara.createReader(
+        __dirname + "/TestMaterials/BrokenPdfBadHeader.txt"
+      )
+    ).to.throw();
+  });
+});
diff --git a/tests/TestMaterials/BrokenPdfBadHeader.txt b/tests/TestMaterials/BrokenPdfBadHeader.txt
new file mode 100644
index 00000000..fd0b6cec
--- /dev/null
+++ b/tests/TestMaterials/BrokenPdfBadHeader.txt
@@ -0,0 +1,2 @@
+%PDF-1.4
+%%EOF
\ No newline at end of file

Fixed code: ### Fixed

- NPE in parser when file ends before it really starts

		if (!anObject) {
			status = PDFHummus::eFailure;
			TRACE_LOG("PDFParser::ParseXrefPosition: Unable to find any object");
			break;
		}

var muhammara = require("../muhammara");
const { expect } = require("chai");

describe("SigSegv test", function () {
  it("should read fields correctly", function () {
    expect(() =>
      muhammara.createReader(
        __dirname + "/TestMaterials/BrokenPdfBadHeader.txt"
      )
    ).to.throw();
  });
});
%PDF-1.4
%%EOF