Merge pull request #13698 from linfangrong/master

[FIX] fix jpx tag tree decode (issue 11957)

src/core/jpx.js

@@ -1203,6 +1203,11 @@ function parseTilePackets(context, data, offset, dataLength) {
           zeroBitPlanesTree = new TagTree(width, height);
           precinct.inclusionTree = inclusionTree;
           precinct.zeroBitPlanesTree = zeroBitPlanesTree;
+          for (let l = 0; l < layerNumber; l++) {
+            if (readBits(1) !== 0) {
+              throw new JpxError("Invalid tag tree");
+            }
+          }
         }
 
         if (inclusionTree.reset(codeblockColumn, codeblockRow, layerNumber)) {

test/pdfs/issue12579.pdf.link

@@ -0,0 +1 @@
+https://github.com/mozilla/pdf.js/files/5492304/3.2020.1.pdf

test/test_manifest.json

@@ -4004,6 +4004,15 @@
        "lastPage": 1,
        "type": "eq"
     },
+    {  "id": "issue12579",
+       "file": "pdfs/issue12579.pdf",
+       "md5": "a56f6c7b6ebe0008bd6215b9a4dc3cca",
+       "link": true,
+       "firstPage": 3,
+       "lastPage": 3,
+       "rounds": 1,
+       "type": "eq"
+    },
     {  "id": "issue11330",
        "file": "pdfs/issue11330.pdf",
        "md5": "03a8a53d4b0dc825e08554f5c0178308",