CVE-2022-25885 (published 2022-11-01T05:15Z)

The package muhammara before 2.6.0; all versions of package hummus are vulnerable to Denial of Service (DoS) when PDFStreamForResponse() is used with invalid data.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/julianhille/MuhammaraJS
commit_details: repo_url: https://github.com/julianhille/MuhammaraJS
author: Julian Hille
author_date: 2022-06-30 00:54:39+02:00
msg: Fix createWriter cpp / crash / npe when using null as stream object (#190)

Fix createWriter cpp / crash / npe when using null as stream object

Fixes #188
repository: repo_url: https://github.com/julianhille/MuhammaraJS
repo_name: julianhille/MuhammaraJS
description: Muhammara a node module with c/cpp bindings to modify PDF with js for node or electron (based/replacement on/of galkhana/hummusjs)
repo_language: C
owner: julianhille
file_changes: filename: CHANGELOG.md
change_type: ModificationType.MODIFY
diff: @@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 ### Changed
 
+- Fixes hard crash to exception when creating a stream with null object and calling createWriter with it
 - Fixes missing buffer information for recrypt typescript definition
 
 ## [2.5.0] - 2022-06-23

programming_language: Markdown
filename: ObjectByteWriterWithPosition.cpp
change_type: ModificationType.MODIFY
diff: @@ -52,12 +52,20 @@ IOBasicTypes::LongBufferSizeType ObjectByteWriterWithPosition::Write(const IOBas
     
     Local<Value> args[1];
     args[0] = anArray;
-    
-	Local<Value> result = func->Call(GET_CURRENT_CONTEXT,  OBJECT_FROM_PERSISTENT(mObject), 1, args).ToLocalChecked();
+    MaybeLocal<Value> maybe;
+    TryCatch try_catch(Isolate::GetCurrent());
+
+    maybe = func->Call(GET_CURRENT_CONTEXT,  OBJECT_FROM_PERSISTENT(mObject), 1, args);
+    Local <Value> result;
+
+    if (!maybe.ToLocal(&result)) {
+       try_catch.ReThrow();
+       return 0;
+    }
     if(result.IsEmpty())
     {
-		THROW_EXCEPTION("wrong return value. it's empty. return the number of written characters");
-		return 0;
+        THROW_EXCEPTION("wrong return value. it's empty. return the number of written characters");
+        return 0;
     }
     else if(result->IsNumber())
     {
@@ -65,8 +73,8 @@ IOBasicTypes::LongBufferSizeType ObjectByteWriterWithPosition::Write(const IOBas
     }
     else
     {
-		THROW_EXCEPTION("wrong return value. write should return the number of written characters");
-		return 0;
+        THROW_EXCEPTION("wrong return value. write should return the number of written characters");
+        return 0;
     }
 }
 
@@ -81,4 +89,4 @@ IOBasicTypes::LongFilePositionType ObjectByteWriterWithPosition::GetCurrentPosit
     Local<Function> func = Local<Function>::Cast(value);
     
 	return TO_NUMBER(func->Call(GET_CURRENT_CONTEXT, OBJECT_FROM_PERSISTENT(mObject), 0, NULL).ToLocalChecked())->Value();
-}
\ No newline at end of file
+}

programming_language: C++
filename: BasicModificationWithStreams.js
change_type: ModificationType.MODIFY
diff: @@ -1,4 +1,5 @@
 var muhammara = require('../muhammara');
+const chai = require('chai');
 
 describe('BasicModificationWithStreams', function() {
 	it('should complete without error', function() {
@@ -14,9 +15,15 @@ describe('BasicModificationWithStreams', function() {
 			color:0x00
 		});
 		pageModifier.endContext().writePage();
-
 		pdfWriter.end();
 		outStream.close();
 		inStream.close();
 	});
+
+	it('null for stream should throw an error and not crash', function () {
+		var res = new muhammara.PDFStreamForResponse(null)
+		chai.expect(
+			muhammara.createWriter.bind(undefined, res)
+		).to.throw(/Cannot read propert.*(write)?.* of null/)
+	})
 });

programming_language: JavaScript