Skip to content
  • Adrien Schildknecht's avatar
    Fix double free in pdf_page_init() · 83b3f9e7
    Adrien Schildknecht authored
    In case of failure in 'pdf_page_init', the mupdf_page is being cleared
    and freed but the zathura_page still holds a pointer to it, resulting
    in a double free when 'pdf_page_clear' is later called.
    
    The execution flow resulting in a double free is the following:
      zathura_page_new()
        pdf_page_init()
          zathura_page_set_data()
          failure of fz_load_page(),fz_bound_page() or fz_new_stext_sheet()
          pdf_page_clear()
        zathura_page_free()
          pdf_page_clear() // double free
    
    Make sure 'zathura_page_set_data' is called only if no errors occurred
    so that page->data never points to freed memory.
    83b3f9e7