--- evince-3.28.2/backend/comics/comics-document.c

+++ evince-3.28.2/backend/comics/comics-document.c

@@ -453,23 +453,27 @@ comics_document_render_pixbuf (EvDocumen

 		name = ev_archive_get_entry_pathname (comics_document->archive);

 		if (g_strcmp0 (name, page_path) == 0) {

-			size_t size = ev_archive_get_entry_size (comics_document->archive);

+			gint64 size = ev_archive_get_entry_size (comics_document->archive);

 			char *buf;

 			ssize_t read;

-			buf = g_malloc (size);

-			read = ev_archive_read_data (comics_document->archive, buf, size, &error);

-			if (read <= 0) {

-				if (read < 0) {

-					g_warning ("Fatal error reading '%s' in archive: %s", name, error->message);

-					g_error_free (error);

+			if (size < 0) {

+				g_warning ("Wrong size of entry '%s'.", name);

+			} else {

+				buf = g_malloc (size);

+				read = ev_archive_read_data (comics_document->archive, buf, size, &error);

+				if (read <= 0) {

+					if (read < 0) {

+						g_warning ("Fatal error reading '%s' in archive: %s", name, error->message);

+						g_error_free (error);

+					} else {

+						g_warning ("Read an empty file from the archive");

+					}

 				} else {

-					g_warning ("Read an empty file from the archive");

+					gdk_pixbuf_loader_write (loader, (guchar *) buf, size, NULL);

 				}

-			} else {

-				gdk_pixbuf_loader_write (loader, (guchar *) buf, size, NULL);

+				g_free (buf);

 			}

-			g_free (buf);

 			gdk_pixbuf_loader_close (loader, NULL);

 			break;

 		}

--- evince-3.28.2/backend/pdf/ev-poppler.cc

+++ evince-3.28.2/backend/pdf/ev-poppler.cc

@@ -859,6 +859,7 @@ pdf_document_get_info (EvDocument *docum

 			break;

 		case POPPLER_PAGE_LAYOUT_TWO_COLUMN_RIGHT:

 			info->layout = EV_DOCUMENT_LAYOUT_TWO_COLUMN_RIGHT;

+			break;

 		case POPPLER_PAGE_LAYOUT_TWO_PAGE_LEFT:

 			info->layout = EV_DOCUMENT_LAYOUT_TWO_PAGE_LEFT;

 			break;

--- evince-3.28.2/cut-n-paste/libgd/gd-two-lines-renderer.c

+++ evince-3.28.2/cut-n-paste/libgd/gd-two-lines-renderer.c

@@ -281,7 +281,7 @@ gd_two_lines_renderer_render (GtkCellRen

   GtkStyleContext *context;

   gint line_one_height;

   GtkStateFlags state;

-  GdkRectangle area, render_area = *cell_area;

+  GdkRectangle area, render_area;

   gint xpad, ypad, x_offset_1, x_offset_2, y_offset;

   PangoLayout *layout_one, *layout_two;

   PangoRectangle layout_rect;

--- evince-3.28.2/cut-n-paste/synctex/synctex_parser.c

+++ evince-3.28.2/cut-n-paste/synctex/synctex_parser.c

@@ -2878,6 +2878,7 @@ int _synctex_open(const char * output, c

 				build_output[0] = '\0';

 			} else {

 				if (build_output != strcpy(build_output,output)) {

+					free(build_output);

 					return -4;

 				}

 				build_output[lpc-output]='\0';

@@ -2886,15 +2887,18 @@ int _synctex_open(const char * output, c

 				/*	Append a path separator if necessary. */

 				if (!SYNCTEX_IS_PATH_SEPARATOR(build_output[strlen(build_directory)-1])) {

 					if (build_output != strcat(build_output,"/")) {

+						free(build_output);

 						return -2;

 					}

 				}

 				/*	Append the last path component of the output. */

 				if (build_output != strcat(build_output,lpc)) {

+					free(build_output);

 					return -3;

 				}

 				return __synctex_open(build_output,synctex_name_ref,file_ref,add_quotes,io_mode_ref);

 			}

+			free(build_output);

 		}

 		return -1;

 	}

--- evince-3.28.2/cut-n-paste/synctex/synctex_parser_utils.c

+++ evince-3.28.2/cut-n-paste/synctex/synctex_parser_utils.c

@@ -292,6 +292,7 @@ char * _synctex_merge_strings(const char

 		size_t len = strlen(temp);

 		if(UINT_MAX-len

 			_synctex_error("!  _synctex_merge_strings: Capacity exceeded.");

+			va_end(arg);

 			return NULL;

 		}

 		size+=len;

@@ -312,6 +313,7 @@ char * _synctex_merge_strings(const char

 						_synctex_error("!  _synctex_merge_strings: Copy problem");

 						free(result);

 						result = NULL;

+						va_end(arg);

 						return NULL;

 					}

 					dest += size;

@@ -393,7 +395,7 @@ int _synctex_get_name(const char * outpu

 					free(dir_name);

 					dir_name = NULL;

 					free(core_name);

-					dir_name = NULL;

+					core_name = NULL;

 					return -2;

 				}

 				dir_name[size] = '\0';

@@ -487,6 +489,12 @@ int _synctex_get_name(const char * outpu

             /* set up the returned values */

             * synctex_name_ref = synctex_name;

             * io_mode_ref = io_mode;

+			free(dir_name);

+			dir_name = NULL;

+			free(core_name);

+			core_name = NULL;

+			free(quoted_core_name);

+			quoted_core_name = NULL;

 			return 0;

 		}

 		return -1;/*  bad argument */

--- evince-3.28.2/cut-n-paste/unarr/rar/filter-rar.c

+++ evince-3.28.2/cut-n-paste/unarr/rar/filter-rar.c

@@ -273,8 +273,10 @@ static struct RARFilter *rar_create_filt

     filter->prog = prog;

     filter->globaldatalen = globaldatalen > RARProgramSystemGlobalSize ? globaldatalen : RARProgramSystemGlobalSize;

     filter->globaldata = calloc(1, filter->globaldatalen);

-    if (!filter->globaldata)

+    if (!filter->globaldata) {

+        free (filter);

         return NULL;

+    }

     if (globaldata)

         memcpy(filter->globaldata, globaldata, globaldatalen);

     if (registers)

--- evince-3.28.2/libdocument/ev-document.c

+++ evince-3.28.2/libdocument/ev-document.c

@@ -496,6 +496,9 @@ ev_document_load_stream (EvDocument

         g_return_val_if_fail (error == NULL || *error == NULL, FALSE);

         klass = EV_DOCUMENT_GET_CLASS (document);

+

+        g_return_val_if_fail (klass != NULL, FALSE);

+

         if (!klass->load_stream) {

                 g_set_error_literal (error, G_IO_ERROR, G_IO_ERROR_NOT_SUPPORTED,

                                      "Backend does not support loading from stream");

@@ -544,6 +547,9 @@ ev_document_load_gfile (EvDocument

         g_return_val_if_fail (error == NULL || *error == NULL, FALSE);

         klass = EV_DOCUMENT_GET_CLASS (document);

+

+        g_return_val_if_fail (klass != NULL, FALSE);

+

         if (!klass->load_gfile) {

                 g_set_error_literal (error, G_IO_ERROR, G_IO_ERROR_NOT_SUPPORTED,

                                      "Backend does not support loading from GFile");

@@ -867,6 +873,9 @@ ev_document_get_backend_info (EvDocument

 	g_return_val_if_fail (EV_IS_DOCUMENT (document), FALSE);

 	klass = EV_DOCUMENT_GET_CLASS (document);

+

+        g_return_val_if_fail (klass != NULL, FALSE);

+

 	if (klass->get_backend_info == NULL)

 		return FALSE;

--- evince-3.28.2/libview/ev-pixbuf-cache.c

+++ evince-3.28.2/libview/ev-pixbuf-cache.c

@@ -337,6 +337,11 @@ job_finished_cb (EvJob         *job,

 	job_info = find_job_cache (pixbuf_cache, job_render->page);

+	if (job_info == NULL) {

+		g_warning ("Job info not found.");

+		return;

+	}

+

 	if (ev_job_is_failed (job)) {

 		job_info->job = NULL;

 		g_object_unref (job);

@@ -721,6 +726,11 @@ add_job_if_needed (EvPixbufCache *pixbuf

 	gint device_scale = get_device_scale (pixbuf_cache);

 	gint width, height;

+	if (job_info == NULL) {

+		g_warning ("Adding job with NULL info.");

+		return;

+	}

+

 	if (job_info->job)

 		return;

--- evince-3.28.2/libview/ev-print-operation.c

+++ evince-3.28.2/libview/ev-print-operation.c

@@ -181,6 +181,7 @@ ev_print_operation_set_current_page (EvP

 	EvPrintOperationClass *class = EV_PRINT_OPERATION_GET_CLASS (op);

 	g_return_if_fail (EV_IS_PRINT_OPERATION (op));

+	g_return_if_fail (class != NULL);

 	g_return_if_fail (current_page >= 0);

 	class->set_current_page (op, current_page);

@@ -193,6 +194,7 @@ ev_print_operation_set_print_settings (E

 	EvPrintOperationClass *class = EV_PRINT_OPERATION_GET_CLASS (op);

 	g_return_if_fail (EV_IS_PRINT_OPERATION (op));

+	g_return_if_fail (class != NULL);

 	g_return_if_fail (GTK_IS_PRINT_SETTINGS (print_settings));

 	class->set_print_settings (op, print_settings);

@@ -210,6 +212,7 @@ ev_print_operation_get_print_settings (E

 	EvPrintOperationClass *class = EV_PRINT_OPERATION_GET_CLASS (op);

 	g_return_val_if_fail (EV_IS_PRINT_OPERATION (op), NULL);

+	g_return_val_if_fail (class != NULL, NULL);

 	return class->get_print_settings (op);

 }

@@ -221,6 +224,7 @@ ev_print_operation_set_default_page_setu

 	EvPrintOperationClass *class = EV_PRINT_OPERATION_GET_CLASS (op);

 	g_return_if_fail (EV_IS_PRINT_OPERATION (op));

+	g_return_if_fail (class != NULL);

 	g_return_if_fail (GTK_IS_PAGE_SETUP (page_setup));

 	class->set_default_page_setup (op, page_setup);

@@ -238,6 +242,7 @@ ev_print_operation_get_default_page_setu

 	EvPrintOperationClass *class = EV_PRINT_OPERATION_GET_CLASS (op);

 	g_return_val_if_fail (EV_IS_PRINT_OPERATION (op), NULL);

+	g_return_val_if_fail (class != NULL, NULL);

 	return class->get_default_page_setup (op);

 }

@@ -249,6 +254,7 @@ ev_print_operation_set_job_name (EvPrint

 	EvPrintOperationClass *class = EV_PRINT_OPERATION_GET_CLASS (op);

 	g_return_if_fail (EV_IS_PRINT_OPERATION (op));

+	g_return_if_fail (class != NULL);

 	g_return_if_fail (job_name != NULL);

 	class->set_job_name (op, job_name);

@@ -260,6 +266,7 @@ ev_print_operation_get_job_name (EvPrint

 	EvPrintOperationClass *class = EV_PRINT_OPERATION_GET_CLASS (op);

 	g_return_val_if_fail (EV_IS_PRINT_OPERATION (op), NULL);

+	g_return_val_if_fail (class != NULL, NULL);

 	return class->get_job_name (op);

 }

@@ -271,6 +278,7 @@ ev_print_operation_run (EvPrintOperation

 	EvPrintOperationClass *class = EV_PRINT_OPERATION_GET_CLASS (op);

 	g_return_if_fail (EV_IS_PRINT_OPERATION (op));

+	g_return_if_fail (class != NULL);

 	class->run (op, parent);

 }

@@ -281,6 +289,7 @@ ev_print_operation_cancel (EvPrintOperat

 	EvPrintOperationClass *class = EV_PRINT_OPERATION_GET_CLASS (op);

 	g_return_if_fail (EV_IS_PRINT_OPERATION (op));

+	g_return_if_fail (class != NULL);

 	class->cancel (op);

 }

@@ -292,6 +301,7 @@ ev_print_operation_get_error (EvPrintOpe

 	EvPrintOperationClass *class = EV_PRINT_OPERATION_GET_CLASS (op);

 	g_return_if_fail (EV_IS_PRINT_OPERATION (op));

+	g_return_if_fail (class != NULL);

 	class->get_error (op, error);

 }

@@ -303,6 +313,7 @@ ev_print_operation_set_embed_page_setup

 	EvPrintOperationClass *class = EV_PRINT_OPERATION_GET_CLASS (op);

 	g_return_if_fail (EV_IS_PRINT_OPERATION (op));

+	g_return_if_fail (class != NULL);

 	class->set_embed_page_setup (op, embed);

 }

@@ -313,6 +324,7 @@ ev_print_operation_get_embed_page_setup

 	EvPrintOperationClass *class = EV_PRINT_OPERATION_GET_CLASS (op);

 	g_return_val_if_fail (EV_IS_PRINT_OPERATION (op), FALSE);

+	g_return_val_if_fail (class != NULL, FALSE);

 	return class->get_embed_page_setup (op);

 }

--- evince-3.28.2/libview/ev-timeline.c

+++ evince-3.28.2/libview/ev-timeline.c

@@ -289,9 +289,15 @@ ev_timeline_new (guint duration)

 void

 ev_timeline_start (EvTimeline *timeline)

 {

+	EvTimelineClass *klass;

+

 	g_return_if_fail (EV_IS_TIMELINE (timeline));

-	EV_TIMELINE_GET_CLASS (timeline)->start (timeline);

+	klass = EV_TIMELINE_GET_CLASS (timeline);

+

+	g_return_if_fail (klass != NULL);

+

+	klass->start (timeline);

 }

 void

--- evince-3.28.2/libview/ev-view.c

+++ evince-3.28.2/libview/ev-view.c

@@ -1147,7 +1147,7 @@ ensure_rectangle_is_visible (EvView *vie

 	if (rect->x < adj_value) {

 		value = MAX (gtk_adjustment_get_lower (adjustment), rect->x - MARGIN);

 		gtk_adjustment_set_value (view->hadjustment, value);

-	} else if (rect->x + rect->height > adj_value + allocation.width) {

+	} else if (rect->x + rect->width > adj_value + allocation.width) {

 		value = MIN (gtk_adjustment_get_upper (adjustment), rect->x + rect->width -

 			     allocation.width + MARGIN);

 		gtk_adjustment_set_value (view->hadjustment, value);

@@ -1777,6 +1777,11 @@ goto_fitv_dest (EvView *view, EvLinkDest

 	page = ev_link_dest_get_page (dest);

+	if (page < 0) {

+		g_warning ("Link does not contain a page.");

+		return;

+	}

+

 	left = ev_link_dest_get_left (dest, &change_left);

 	doc_point.x = change_left ? left : 0;

 	doc_point.y = 0;

@@ -1813,6 +1818,11 @@ goto_fith_dest (EvView *view, EvLinkDest

 	page = ev_link_dest_get_page (dest);

+	if (page < 0) {

+		g_warning ("Link does not contain a page.");

+		return;

+	}

+

 	top = ev_link_dest_get_top (dest, &change_top);

 	doc_point.x = 0;

 	doc_point.y = change_top ? top : 0;

@@ -1846,6 +1856,11 @@ goto_fit_dest (EvView *view, EvLinkDest

 	page = ev_link_dest_get_page (dest);

+	if (page < 0) {

+		g_warning ("Link does not contain a page.");

+		return;

+	}

+

 	if (view->allow_links_change_zoom) {

 		double zoom;

 		gdouble doc_width, doc_height;

--- evince-3.28.2/libview/ev-view-presentation.c

+++ evince-3.28.2/libview/ev-view-presentation.c

@@ -448,7 +448,7 @@ ev_view_presentation_update_current_page

 {

 	gint jump;

-	if (page < 0 || page >= ev_document_get_n_pages (pview->document))

+	if (page >= ev_document_get_n_pages (pview->document))

 		return;

 	ev_view_presentation_animation_cancel (pview);

--- evince-3.28.2/shell/ev-sidebar.c

+++ evince-3.28.2/shell/ev-sidebar.c

@@ -471,18 +471,19 @@ ev_sidebar_add_page (EvSidebar   *ev_sid

 	/* Set the first item added as active */

-	gtk_tree_model_get_iter_first (ev_sidebar->priv->page_model, &iter);

-	gtk_tree_model_get (ev_sidebar->priv->page_model,

-			    &iter,

-			    PAGE_COLUMN_TITLE, &label_title,

-			    PAGE_COLUMN_NOTEBOOK_INDEX, &index,

-			    -1);

+	if (gtk_tree_model_get_iter_first (ev_sidebar->priv->page_model, &iter)) {

+		gtk_tree_model_get (ev_sidebar->priv->page_model,

+				    &iter,

+				    PAGE_COLUMN_TITLE, &label_title,

+				    PAGE_COLUMN_NOTEBOOK_INDEX, &index,

+				    -1);

-	gtk_menu_set_active (GTK_MENU (ev_sidebar->priv->menu), index);

-	gtk_label_set_text (GTK_LABEL (ev_sidebar->priv->label), label_title);

-	gtk_notebook_set_current_page (GTK_NOTEBOOK (ev_sidebar->priv->notebook),

-				       index);

-	g_free (label_title);

+		gtk_menu_set_active (GTK_MENU (ev_sidebar->priv->menu), index);

+		gtk_label_set_text (GTK_LABEL (ev_sidebar->priv->label), label_title);

+		gtk_notebook_set_current_page (GTK_NOTEBOOK (ev_sidebar->priv->notebook),

+					       index);

+		g_free (label_title);

+	}

 }

 static gboolean

--- evince-3.28.2/shell/ev-sidebar-thumbnails.c

+++ evince-3.28.2/shell/ev-sidebar-thumbnails.c

@@ -658,11 +658,11 @@ ev_sidebar_thumbnails_fill_model (EvSide

 	int i;

 	gint prev_width = -1;

 	gint prev_height = -1;

+	cairo_surface_t *loading_icon = NULL;

 	for (i = 0; i < sidebar_thumbnails->priv->n_pages; i++) {

 		gchar     *page_label;

 		gchar     *page_string;

-		cairo_surface_t *loading_icon = NULL;

 		gint       width, height;

 		page_label = ev_document_get_page_label (priv->document, i);

--- evince-3.28.2/shell/ev-window.c

+++ evince-3.28.2/shell/ev-window.c

@@ -3121,10 +3121,10 @@ ev_window_load_print_settings_from_metad

 	for (i = 0; i < G_N_ELEMENTS (document_print_settings); i++) {

 		gchar *value = NULL;

-		ev_metadata_get_string (window->priv->metadata,

-					document_print_settings[i], &value);

-		gtk_print_settings_set (print_settings,

-					document_print_settings[i], value);

+		if (ev_metadata_get_string (window->priv->metadata,

+					    document_print_settings[i], &value))

+			gtk_print_settings_set (print_settings,

+						document_print_settings[i], value);

 	}

 }

@@ -4705,12 +4705,16 @@ ev_window_cmd_bookmarks_add (GSimpleActi

 	gchar     *page_label;

 	bm.page = ev_document_model_get_page (window->priv->model);

-	page_label = ev_document_get_page_label (window->priv->document, bm.page);

-	bm.title = g_strdup_printf (_("Page %s"), page_label);

-	g_free (page_label);

+	if (bm.page >= 0) {

+		page_label = ev_document_get_page_label (window->priv->document, bm.page);

+		bm.title = g_strdup_printf (_("Page %s"), page_label);

+		g_free (page_label);

-	/* EvBookmarks takes ownership of bookmark */

-	ev_bookmarks_add (window->priv->bookmarks, &bm;;

+		/* EvBookmarks takes ownership of bookmark */

+		ev_bookmarks_add (window->priv->bookmarks, &bm;;

+	} else {

+		g_warning ("Bookmarking of a page failed.");

+	}

 }

 static void