From 369f1899c6864ad8ac9e85b759fde4532b9afb83 Mon Sep 17 00:00:00 2001
From: linfangrong <linfangrong.liuxin@qq.com>
Date: Tue, 31 Aug 2021 11:44:26 +0800
Subject: [PATCH] [FIX] fix jpx tag tree decode (issue 11957)

---
 src/core/jpx.js               | 5 +++++
 test/pdfs/issue12579.pdf.link | 1 +
 test/test_manifest.json       | 9 +++++++++
 3 files changed, 15 insertions(+)
 create mode 100644 test/pdfs/issue12579.pdf.link

diff --git a/src/core/jpx.js b/src/core/jpx.js
index 99bcf3c45..1ac1b6b17 100644
--- a/src/core/jpx.js
+++ b/src/core/jpx.js
@@ -1203,6 +1203,11 @@ function parseTilePackets(context, data, offset, dataLength) {
           zeroBitPlanesTree = new TagTree(width, height);
           precinct.inclusionTree = inclusionTree;
           precinct.zeroBitPlanesTree = zeroBitPlanesTree;
+          for (let l = 0; l < layerNumber; l++) {
+            if (readBits(1) !== 0) {
+              throw new JpxError("Invalid tag tree");
+            }
+          }
         }
 
         if (inclusionTree.reset(codeblockColumn, codeblockRow, layerNumber)) {
diff --git a/test/pdfs/issue12579.pdf.link b/test/pdfs/issue12579.pdf.link
new file mode 100644
index 000000000..5609a6f6b
--- /dev/null
+++ b/test/pdfs/issue12579.pdf.link
@@ -0,0 +1 @@
+https://github.com/mozilla/pdf.js/files/5492304/3.2020.1.pdf
diff --git a/test/test_manifest.json b/test/test_manifest.json
index 39e28e26d..77b7a2fd4 100644
--- a/test/test_manifest.json
+++ b/test/test_manifest.json
@@ -3987,6 +3987,15 @@
        "lastPage": 1,
        "type": "eq"
     },
+    {  "id": "issue12579",
+       "file": "pdfs/issue12579.pdf",
+       "md5": "a56f6c7b6ebe0008bd6215b9a4dc3cca",
+       "link": true,
+       "firstPage": 3,
+       "lastPage": 3,
+       "rounds": 1,
+       "type": "eq"
+    },
     {  "id": "issue11330",
        "file": "pdfs/issue11330.pdf",
        "md5": "03a8a53d4b0dc825e08554f5c0178308",