Fix null pointer exception when reading stream object

DEVSIX-8301
DEVSIX-8374

Author: Alexander Pliushchou

kernel/src/main/java/com/itextpdf/kernel/exceptions/KernelExceptionMessageConstant.java

@@ -441,6 +441,10 @@ public final class KernelExceptionMessageConstant {
     public static final String XREF_HAS_AN_ENTRY_WITH_TOO_BIG_OFFSET = "Pdf document is to large to "
             + "use normal cross reference table. Use cross reference streams instead. To enable feature use com.itextpdf"
             + ".kernel.pdf.WriterProperties#setFullCompressionMode(true). ";
+    public static final String UNABLE_TO_READ_OBJECT_STREAM ="Unable to read object stream.";
+    public static final String UNABLE_TO_READ_STREAM_BYTES ="Unable to read stream bytes because stream is null.";
+    public static final String INVALID_OBJECT_STREAM_NUMBER = "Unable to read object {0} with object stream " +
+            "number {1} and index {2} from object stream.";
 
     private KernelExceptionMessageConstant() {
     }

kernel/src/main/java/com/itextpdf/kernel/pdf/PdfReader.java

@@ -380,6 +380,10 @@ public byte[] readStreamBytes(PdfStream stream, boolean decode) throws IOExcepti
      * @throws IOException on error.
      */
     public byte[] readStreamBytesRaw(PdfStream stream) throws IOException {
+        if (stream == null) {
+            throw new PdfException(KernelExceptionMessageConstant.UNABLE_TO_READ_STREAM_BYTES);
+        }
+
         PdfName type = stream.getAsName(PdfName.Type);
         if (!PdfName.XRef.equals(type) && !PdfName.ObjStm.equals(type)) {
             checkPdfStreamLength(stream);
@@ -765,6 +769,10 @@ protected void readPdf() throws IOException {
     }
 
     protected void readObjectStream(PdfStream objectStream) throws IOException {
+        if (objectStream == null) {
+            throw new PdfException(KernelExceptionMessageConstant.UNABLE_TO_READ_OBJECT_STREAM);
+        }
+
         int objectStreamNumber = objectStream.getIndirectReference().getObjNumber();
         int first = objectStream.getAsNumber(PdfName.First).intValue();
         int n = objectStream.getAsNumber(PdfName.N).intValue();
@@ -1457,6 +1465,12 @@ private PdfObject readObject(PdfIndirectReference reference, boolean fixXref) {
             if (reference.getObjStreamNumber() > 0) {
                 PdfStream objectStream = (PdfStream) pdfDocument.getXref().
                         get(reference.getObjStreamNumber()).getRefersTo(false);
+                if (objectStream == null) {
+                    throw new PdfException(MessageFormatUtil.format(
+                            KernelExceptionMessageConstant.INVALID_OBJECT_STREAM_NUMBER, reference.getObjNumber()
+                            , reference.getObjStreamNumber(), reference.getIndex()));
+                }
+
                 readObjectStream(objectStream);
                 return reference.refersTo;
             } else if (reference.getOffset() > 0) {

kernel/src/test/java/com/itextpdf/kernel/pdf/PdfReaderTest.java

@@ -2814,6 +2814,36 @@ public void newPdfReaderConstructorPropertiesTest() throws IOException {
         Assert.assertEquals(PdfObject.STREAM, pdfDoc.getPdfObject(5).getType());
     }
 
+    @Test
+    public void streamObjIsNullTest() throws IOException {
+        ByteArrayOutputStream bsaos = new ByteArrayOutputStream();
+        PdfDocument pdfDocument = new PdfDocument(new PdfWriter(bsaos));
+
+        new PdfDictionary().makeIndirect(pdfDocument);
+
+        PdfStream pdfDictionary = new PdfStream();
+        pdfDictionary.makeIndirect(pdfDocument);
+
+        int objNumber = pdfDictionary.getIndirectReference().objNr;
+        pdfDocument.catalog.getPdfObject().put(PdfName.StructTreeRoot, pdfDictionary);
+        pdfDocument.close();
+
+        PdfReader pdfReader = new PdfReader(new ByteArrayInputStream(bsaos.toByteArray())) {
+            @Override
+            protected PdfObject readObject(PdfIndirectReference reference) {
+                if (reference.objNr == objNumber) {
+                    reference.setObjStreamNumber(objNumber - 1);
+                    reference.setIndex(492);
+                }
+                return super.readObject(reference);
+            }
+        };
+
+        Exception e = Assert.assertThrows(PdfException.class, () -> new PdfDocument(pdfReader));
+        Assert.assertEquals(MessageFormatUtil.format(
+                KernelExceptionMessageConstant.INVALID_OBJECT_STREAM_NUMBER, 5, 4, 492), e.getMessage());
+    }
+
     @Test
     public void initTagTreeStructureThrowsOOMIsCatched() throws IOException {
         File file = new File(SOURCE_FOLDER+ "big_table_lot_of_mcrs.pdf");

kernel/src/test/java/com/itextpdf/kernel/pdf/PdfReaderUnitTest.java

@@ -0,0 +1,51 @@
+package com.itextpdf.kernel.pdf;
+
+import com.itextpdf.commons.utils.MessageFormatUtil;
+import com.itextpdf.kernel.exceptions.KernelExceptionMessageConstant;
+import com.itextpdf.kernel.exceptions.PdfException;
+import com.itextpdf.test.ExtendedITextTest;
+import com.itextpdf.test.annotations.type.UnitTest;
+import org.junit.Assert;
+import org.junit.Test;
+import org.junit.experimental.categories.Category;
+
+@Category(UnitTest.class)
+public class PdfReaderUnitTest extends ExtendedITextTest {
+
+    private static final String SOURCE_FOLDER = "./src/test/resources/com/itextpdf/kernel/pdf/PdfReaderUnitTest/";
+
+    @Test
+    public void readStreamBytesRawNullStreamTest() throws java.io.IOException {
+        PdfReader reader = new PdfReader(SOURCE_FOLDER + "testFile.pdf");
+        Exception e = Assert.assertThrows(PdfException.class, () -> reader.readStreamBytesRaw(null));
+        Assert.assertEquals(KernelExceptionMessageConstant.UNABLE_TO_READ_STREAM_BYTES, e.getMessage());
+    }
+
+    @Test
+    public void readObjectStreamNullStreamTest() throws java.io.IOException {
+        PdfReader reader = new PdfReader(SOURCE_FOLDER + "testFile.pdf");
+        Exception e = Assert.assertThrows(PdfException.class, () -> reader.readObjectStream(null));
+        Assert.assertEquals(KernelExceptionMessageConstant.UNABLE_TO_READ_OBJECT_STREAM, e.getMessage());
+    }
+
+    @Test
+    public void readObjectInvalidObjectStreamNumberTest() throws java.io.IOException {
+        PdfReader reader = new PdfReader(SOURCE_FOLDER + "testFile.pdf");
+        PdfDocument doc = new PdfDocument(reader);
+
+        PdfIndirectReference ref = new PdfIndirectReference(doc, 20);
+        ref.setState(PdfObject.FREE);
+        ref.setObjStreamNumber(5);
+        ref.refersTo = null;
+
+        PdfIndirectReference ref2 = new PdfIndirectReference(doc, 5);
+        ref2.setState(PdfObject.FREE);
+        ref2.refersTo = null;
+        doc.getXref().add(ref2);
+
+        doc.getCatalog().getPdfObject().put(PdfName.StructTreeRoot, ref);
+        Exception e = Assert.assertThrows(PdfException.class, () -> reader.readObject(ref));
+        Assert.assertEquals(MessageFormatUtil.format(
+                KernelExceptionMessageConstant.INVALID_OBJECT_STREAM_NUMBER, 20, 5, 0), e.getMessage());
+    }
+}