From 1bbc694ac3ce7d949f1ad520abed40bdbd0fe04b Mon Sep 17 00:00:00 2001
From: Jonas Jenwald <jonas.jenwald@gmail.com>
Date: Mon, 13 Jun 2016 13:29:32 +0200
Subject: [PATCH] Assign the `quantizationTables` after parsing the entire JPEG
 image, to prevent issues when the DQT (Define Quantization Tables) marker is
 encountered after SOF{n} (Start of Frame) markers (issue 7406)

This is a tentative patch that fixes 7406.
---
 src/core/jpg.js | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/src/core/jpg.js b/src/core/jpg.js
index be6840479..4bb326635 100644
--- a/src/core/jpg.js
+++ b/src/core/jpg.js
@@ -387,6 +387,10 @@ var JpegImage = (function jpegImage() {
     var p0, p1, p2, p3, p4, p5, p6, p7;
     var t;
 
+    if (!qt) {
+      throw 'missing required Quantization Table.';
+    }
+
     // inverse DCT on rows
     for (var row = 0; row < 64; row += 8) {
       // gather block data
@@ -738,7 +742,8 @@ var JpegImage = (function jpegImage() {
               l = frame.components.push({
                 h: h,
                 v: v,
-                quantizationTable: quantizationTables[qId]
+                quantizationId: qId,
+                quantizationTable: null, // See comment below.
               });
               frame.componentIds[componentId] = l - 1;
               offset += 3;
@@ -822,6 +827,15 @@ var JpegImage = (function jpegImage() {
       this.components = [];
       for (i = 0; i < frame.components.length; i++) {
         component = frame.components[i];
+
+        // Prevent errors when DQT markers are placed after SOF{n} markers,
+        // by assigning the `quantizationTable` entry after the entire image
+        // has been parsed (fixes issue7406.pdf).
+        var quantizationTable = quantizationTables[component.quantizationId];
+        if (quantizationTable) {
+          component.quantizationTable = quantizationTable;
+        }
+
         this.components.push({
           output: buildComponentData(frame, component),
           scaleX: component.h / frame.maxH,