Merge pull request #11805 from Snuffleupagus/issue-11794

Always skip over any additional, unexpected, RSTx (restart) markers in corrupt JPEG images (issue 11794)

src/core/jpg.js

@@ -393,11 +393,17 @@ var JpegImage = (function JpegImageClosure() {
     }
 
     var h, v;
-    while (mcu < mcuExpected) {
+    while (mcu <= mcuExpected) {
       // reset interval stuff
       var mcuToRead = resetInterval
         ? Math.min(mcuExpected - mcu, resetInterval)
         : mcuExpected;
+
+      // The `mcuToRead === 0` case should only occur when all of the expected
+      // MCU data has been already parsed, i.e. when `mcu === mcuExpected`, but
+      // some corrupt JPEG images contain more data than intended and we thus
+      // want to skip over any extra RSTx markers below (fixes issue11794.pdf).
+      if (mcuToRead > 0) {
         for (i = 0; i < componentsLength; i++) {
           components[i].pred = 0;
         }
@@ -424,28 +430,24 @@ var JpegImage = (function JpegImageClosure() {
             mcu++;
           }
         }
+      }
 
       // find marker
       bitsCount = 0;
       fileMarker = findNextFileMarker(data, offset);
       if (!fileMarker) {
-        // Reached the end of the image data without finding an EOI marker.
-        break;
-      } else if (fileMarker.invalid) {
+        break; // Reached the end of the image data without finding any marker.
+      }
+      if (fileMarker.invalid) {
         // Some bad images seem to pad Scan blocks with e.g. zero bytes, skip
         // past those to attempt to find a valid marker (fixes issue4090.pdf).
+        const partialMsg = mcuToRead > 0 ? "unexpected" : "excessive";
         warn(
-          "decodeScan - unexpected MCU data, current marker is: " +
-            fileMarker.invalid
+          `decodeScan - ${partialMsg} MCU data, current marker is: ${fileMarker.invalid}`
         );
         offset = fileMarker.offset;
       }
-      var marker = fileMarker && fileMarker.marker;
-      if (!marker || marker <= 0xff00) {
-        throw new JpegError("decodeScan - a valid marker was not found.");
-      }
-
-      if (marker >= 0xffd0 && marker <= 0xffd7) {
+      if (fileMarker.marker >= 0xffd0 && fileMarker.marker <= 0xffd7) {
         // RSTx
         offset += 2;
       } else {
@@ -458,8 +460,7 @@ var JpegImage = (function JpegImageClosure() {
     // attempt to find the next valid marker (fixes issue8182.pdf).
     if (fileMarker && fileMarker.invalid) {
       warn(
-        "decodeScan - unexpected Scan data, current marker is: " +
-          fileMarker.invalid
+        `decodeScan - unexpected Scan data, current marker is: ${fileMarker.invalid}`
       );
       offset = fileMarker.offset;
     }

test/pdfs/issue11794.pdf.link

@@ -0,0 +1 @@
+https://github.com/mozilla/pdf.js/files/4459214/test.pdf

test/test_manifest.json

@@ -2468,6 +2468,14 @@
       "link": true,
       "type": "eq"
     },
+    {  "id": "issue11794",
+       "file": "pdfs/issue11794.pdf",
+       "md5": "00d17b10a5fd7c06cddd7a0d2066ecdd",
+       "rounds": 1,
+       "link": true,
+       "lastPage": 1,
+       "type": "eq"
+    },
     {
       "id": "bug852992",
       "file": "pdfs/bug852992_reduced.pdf",