Always skip over any additional, unexpected, RSTx (restart) markers in corrupt JPEG images (issue 11794)

src/core/jpg.js

@@ -393,11 +393,17 @@ var JpegImage = (function JpegImageClosure() {
     }
 
     var h, v;
-    while (mcu < mcuExpected) {
+    while (mcu <= mcuExpected) {
       // reset interval stuff
       var mcuToRead = resetInterval
         ? Math.min(mcuExpected - mcu, resetInterval)
         : mcuExpected;
+
+      // The `mcuToRead === 0` case should only occur when all of the expected
+      // MCU data has been already parsed, i.e. when `mcu === mcuExpected`, but
+      // some corrupt JPEG images contain more data than intended and we thus
+      // want to skip over any extra RSTx markers below (fixes issue11794.pdf).
+      if (mcuToRead > 0) {
         for (i = 0; i < componentsLength; i++) {
           components[i].pred = 0;
         }
@@ -424,6 +430,7 @@ var JpegImage = (function JpegImageClosure() {
             mcu++;
           }
         }
+      }
 
       // find marker
       bitsCount = 0;
@@ -434,8 +441,9 @@ var JpegImage = (function JpegImageClosure() {
       if (fileMarker.invalid) {
         // Some bad images seem to pad Scan blocks with e.g. zero bytes, skip
         // past those to attempt to find a valid marker (fixes issue4090.pdf).
+        const partialMsg = mcuToRead > 0 ? "unexpected" : "excessive";
         warn(
-          `decodeScan - unexpected MCU data, current marker is: ${fileMarker.invalid}`
+          `decodeScan - ${partialMsg} MCU data, current marker is: ${fileMarker.invalid}`
         );
         offset = fileMarker.offset;
       }

test/pdfs/issue11794.pdf.link

@@ -0,0 +1 @@
+https://github.com/mozilla/pdf.js/files/4459214/test.pdf

test/test_manifest.json

@@ -2468,6 +2468,14 @@
       "link": true,
       "type": "eq"
     },
+    {  "id": "issue11794",
+       "file": "pdfs/issue11794.pdf",
+       "md5": "00d17b10a5fd7c06cddd7a0d2066ecdd",
+       "rounds": 1,
+       "link": true,
+       "lastPage": 1,
+       "type": "eq"
+    },
     {
       "id": "bug852992",
       "file": "pdfs/bug852992_reduced.pdf",