-
Adrien Schildknecht authored
In case of failure in 'pdf_page_init', the mupdf_page is being cleared and freed but the zathura_page still holds a pointer to it, resulting in a double free when 'pdf_page_clear' is later called. The execution flow resulting in a double free is the following: zathura_page_new() pdf_page_init() zathura_page_set_data() failure of fz_load_page(),fz_bound_page() or fz_new_stext_sheet() pdf_page_clear() zathura_page_free() pdf_page_clear() // double free Make sure 'zathura_page_set_data' is called only if no errors occurred so that page->data never points to freed memory.
83b3f9e7