--- evince-40.1/backend/dvi/mdvi-lib/pagesel.c

+++ evince-40.1/backend/dvi/mdvi-lib/pagesel.c

@@ -209,6 +209,7 @@ DviPageSpec *mdvi_parse_page_spec(const

 		range = mdvi_parse_range(format, NULL, &count, &ptr);

 		if(ptr == format) {

 			if(range) mdvi_free(range);

+			mdvi_free(spec);

 			mdvi_error(_("invalid page specification `%s'\n"), format);

 			return NULL;

 		}

--- evince-40.1/backend/dvi/mdvi-lib/tfmfile.c

+++ evince-40.1/backend/dvi/mdvi-lib/tfmfile.c

@@ -393,6 +393,7 @@ static int ofm1_load_file(FILE *in, TFMI

 	/* read them in one sweep */

 	if(fread(tfm, 4, size, in) != size) {

 		mdvi_free(tfm);

+		tfm = NULL;

 		goto bad_tfm;

 	}

--- evince-40.1/backend/dvi/mdvi-lib/vf.c

+++ evince-40.1/backend/dvi/mdvi-lib/vf.c

@@ -129,6 +129,7 @@ static int vf_load_font(DviParams *param

 		if(ref == NULL) {

 			mdvi_error(_("(vf) %s: could not load font `%s'\n"), 

 				   font->fontname, name);

+			mdvi_free(name);

 			goto error;

 		}

 		mdvi_free(name);

--- evince-40.1/backend/comics/comics-document.c

+++ evince-40.1/backend/comics/comics-document.c

@@ -453,23 +453,27 @@ comics_document_render_pixbuf (EvDocumen

 		name = ev_archive_get_entry_pathname (comics_document->archive);

 		if (g_strcmp0 (name, page_path) == 0) {

-			size_t size = ev_archive_get_entry_size (comics_document->archive);

+			gint64 size = ev_archive_get_entry_size (comics_document->archive);

 			char *buf;

 			ssize_t read;

-			buf = g_malloc (size);

-			read = ev_archive_read_data (comics_document->archive, buf, size, &error);

-			if (read <= 0) {

-				if (read < 0) {

-					g_warning ("Fatal error reading '%s' in archive: %s", name, error->message);

-					g_error_free (error);

+			if (size < 0) {

+				g_warning ("Wrong size of entry '%s'.", name);

+			} else {

+				buf = g_malloc (size);

+				read = ev_archive_read_data (comics_document->archive, buf, size, &error);

+				if (read <= 0) {

+					if (read < 0) {

+						g_warning ("Fatal error reading '%s' in archive: %s", name, error->message);

+						g_error_free (error);

+					} else {

+						g_warning ("Read an empty file from the archive");

+					}

 				} else {

-					g_warning ("Read an empty file from the archive");

+					gdk_pixbuf_loader_write (loader, (guchar *) buf, size, NULL);

 				}

-			} else {

-				gdk_pixbuf_loader_write (loader, (guchar *) buf, size, NULL);

+				g_free (buf);

 			}

-			g_free (buf);

 			gdk_pixbuf_loader_close (loader, NULL);

 			break;

 		}

--- evince-40.1/backend/pdf/ev-poppler.cc

+++ evince-40.1/backend/pdf/ev-poppler.cc

@@ -591,7 +591,7 @@ pdf_document_get_xmptag_from_path (xmlXP

                                    const char* xpath)

 {

 	xmlXPathObjectPtr xpathObj;

-	char *xmpmetapath = g_strdup_printf ("%s%s", "/x:xmpmeta", xpath);

+	char *xmpmetapath;

 	xmlChar *result = NULL;

 	/* add pdf/a and pdf/x namespaces */

@@ -620,13 +620,17 @@ pdf_document_get_xmptag_from_path (xmlXP

 	if (result != NULL)

 		return result;

+	xmpmetapath = g_strdup_printf ("%s%s", "/x:xmpmeta", xpath);

+

 	/*

 	Try in /x:xmpmeta/ (xmpmeta is optional)

 	https://wwwimages2.adobe.com/content/dam/acom/en/devnet/xmp/pdfs/XMP SDK Release cc-2016-08/XMPSpecificationPart1.pdf (Section 7.3.3)

 	*/

 	xpathObj = xmlXPathEvalExpression (BAD_CAST xmpmetapath, xpathCtx);

-	if (xpathObj == NULL)

+	if (xpathObj == NULL) {

+			g_free (xmpmetapath);

 			return NULL;

+	}

 	if (xpathObj->nodesetval != NULL && xpathObj->nodesetval->nodeNr != 0)

 			result = xmlNodeGetContent (xpathObj->nodesetval->nodeTab[0]);

@@ -743,12 +747,14 @@ static char *

 pdf_document_get_author_from_metadata (xmlXPathContextPtr xpathCtx)

 {

 	char* result = NULL;

-	char* xmpmetapath = g_strdup_printf ("%s%s", "/x:xmpmeta", AUTHORS);

+	char* xmpmetapath;

 	/* Try in /rdf:RDF/ */

 	result = pdf_document_get_lists_from_dc_tags (xpathCtx, AUTHORS);

 	if (result != NULL)

 		return result;

+	xmpmetapath = g_strdup_printf ("%s%s", "/x:xmpmeta", AUTHORS);

+

 	/* Try in /x:xmpmeta/ */

 	result = pdf_document_get_lists_from_dc_tags (xpathCtx, xmpmetapath);

 	g_free (xmpmetapath);

@@ -760,12 +766,14 @@ static char *

 pdf_document_get_keywords_from_metadata (xmlXPathContextPtr xpathCtx)

 {

 	char* result = NULL;

-	char* xmpmetapath = g_strdup_printf ("%s%s", "/x:xmpmeta", KEYWORDS);

+	char* xmpmetapath;

 	/* Try in /rdf:RDF/ */

 	result = pdf_document_get_lists_from_dc_tags (xpathCtx, KEYWORDS);

 	if (result != NULL)

 		return result;

+	xmpmetapath = g_strdup_printf ("%s%s", "/x:xmpmeta", KEYWORDS);

+

 	/* Try in /x:xmpmeta/ */

 	result = pdf_document_get_lists_from_dc_tags (xpathCtx, xmpmetapath);

 	g_free (xmpmetapath);

@@ -859,6 +859,7 @@ pdf_document_get_info (EvDocument *docum

 			break;

 		case POPPLER_PAGE_LAYOUT_TWO_COLUMN_RIGHT:

 			info->layout = EV_DOCUMENT_LAYOUT_TWO_COLUMN_RIGHT;

+			break;

 		case POPPLER_PAGE_LAYOUT_TWO_PAGE_LEFT:

 			info->layout = EV_DOCUMENT_LAYOUT_TWO_PAGE_LEFT;

 			break;

--- evince-40.1/properties/ev-properties-view.c

+++ evince-40.1/properties/ev-properties-view.c

@@ -339,6 +339,7 @@ ev_regular_paper_size (const EvDocumentI

 		    ABS (info->paper_width  - paper_width) <= width_tolerance) {

 			/* Note to translators: first placeholder is the paper name (eg.

 			 * A4), second placeholder is the paper size (eg. 297x210 mm) */

+			g_free (str);

 			str = g_strdup_printf (_("%s, Portrait (%s)"),

 					       gtk_paper_size_get_display_name (size),

 					       exact_size);

@@ -346,6 +347,7 @@ ev_regular_paper_size (const EvDocumentI

 			   ABS (info->paper_height - paper_width) <= width_tolerance) {

 			/* Note to translators: first placeholder is the paper name (eg.

 			 * A4), second placeholder is the paper size (eg. 297x210 mm) */

+			g_free (str);

 			str = g_strdup_printf ( _("%s, Landscape (%s)"),

 						gtk_paper_size_get_display_name (size),

 						exact_size);

--- evince-40.1/cut-n-paste/libgd/gd-two-lines-renderer.c

+++ evince-40.1/cut-n-paste/libgd/gd-two-lines-renderer.c

@@ -281,7 +281,7 @@ gd_two_lines_renderer_render (GtkCellRen

   GtkStyleContext *context;

   gint line_one_height;

   GtkStateFlags state;

-  GdkRectangle area, render_area = *cell_area;

+  GdkRectangle area, render_area;

   gint xpad, ypad, x_offset_1, x_offset_2, y_offset;

   PangoLayout *layout_one, *layout_two;

   PangoRectangle layout_rect;

--- evince-40.1/cut-n-paste/unarr/rar/filter-rar.c

+++ evince-40.1/cut-n-paste/unarr/rar/filter-rar.c

@@ -273,8 +273,10 @@ static struct RARFilter *rar_create_filt

     filter->prog = prog;

     filter->globaldatalen = globaldatalen > RARProgramSystemGlobalSize ? globaldatalen : RARProgramSystemGlobalSize;

     filter->globaldata = calloc(1, filter->globaldatalen);

-    if (!filter->globaldata)

+    if (!filter->globaldata) {

+        free (filter);

         return NULL;

+    }

     if (globaldata)

         memcpy(filter->globaldata, globaldata, globaldatalen);

     if (registers)

--- evince-40.1/libdocument/ev-document.c

+++ evince-40.1/libdocument/ev-document.c

@@ -496,6 +496,9 @@ ev_document_load_stream (EvDocument

         g_return_val_if_fail (error == NULL || *error == NULL, FALSE);

         klass = EV_DOCUMENT_GET_CLASS (document);

+

+        g_return_val_if_fail (klass != NULL, FALSE);

+

         if (!klass->load_stream) {

                 g_set_error_literal (error, G_IO_ERROR, G_IO_ERROR_NOT_SUPPORTED,

                                      "Backend does not support loading from stream");

@@ -544,6 +547,9 @@ ev_document_load_gfile (EvDocument

         g_return_val_if_fail (error == NULL || *error == NULL, FALSE);

         klass = EV_DOCUMENT_GET_CLASS (document);

+

+        g_return_val_if_fail (klass != NULL, FALSE);

+

         if (!klass->load_gfile) {

                 g_set_error_literal (error, G_IO_ERROR, G_IO_ERROR_NOT_SUPPORTED,

                                      "Backend does not support loading from GFile");

@@ -867,6 +873,9 @@ ev_document_get_backend_info (EvDocument

 	g_return_val_if_fail (EV_IS_DOCUMENT (document), FALSE);

 	klass = EV_DOCUMENT_GET_CLASS (document);

+

+        g_return_val_if_fail (klass != NULL, FALSE);

+

 	if (klass->get_backend_info == NULL)

 		return FALSE;

--- evince-40.1/libview/ev-pixbuf-cache.c

+++ evince-40.1/libview/ev-pixbuf-cache.c

@@ -337,6 +337,11 @@ job_finished_cb (EvJob         *job,

 	job_info = find_job_cache (pixbuf_cache, job_render->page);

+	if (job_info == NULL) {

+		g_warning ("Job info not found.");

+		return;

+	}

+

 	if (ev_job_is_failed (job)) {

 		job_info->job = NULL;

 		g_object_unref (job);

@@ -721,6 +726,11 @@ add_job_if_needed (EvPixbufCache *pixbuf

 	gint device_scale = get_device_scale (pixbuf_cache);

 	gint width, height;

+	if (job_info == NULL) {

+		g_warning ("Adding job with NULL info.");

+		return;

+	}

+

 	if (job_info->job)

 		return;

--- evince-40.1/libview/ev-print-operation.c

+++ evince-40.1/libview/ev-print-operation.c

@@ -181,6 +181,7 @@ ev_print_operation_set_current_page (EvP

 	EvPrintOperationClass *class = EV_PRINT_OPERATION_GET_CLASS (op);

 	g_return_if_fail (EV_IS_PRINT_OPERATION (op));

+	g_return_if_fail (class != NULL);

 	g_return_if_fail (current_page >= 0);

 	class->set_current_page (op, current_page);

@@ -193,6 +194,7 @@ ev_print_operation_set_print_settings (E

 	EvPrintOperationClass *class = EV_PRINT_OPERATION_GET_CLASS (op);

 	g_return_if_fail (EV_IS_PRINT_OPERATION (op));

+	g_return_if_fail (class != NULL);

 	g_return_if_fail (GTK_IS_PRINT_SETTINGS (print_settings));

 	class->set_print_settings (op, print_settings);

@@ -210,6 +212,7 @@ ev_print_operation_get_print_settings (E

 	EvPrintOperationClass *class = EV_PRINT_OPERATION_GET_CLASS (op);

 	g_return_val_if_fail (EV_IS_PRINT_OPERATION (op), NULL);

+	g_return_val_if_fail (class != NULL, NULL);

 	return class->get_print_settings (op);

 }

@@ -221,6 +224,7 @@ ev_print_operation_set_default_page_setu

 	EvPrintOperationClass *class = EV_PRINT_OPERATION_GET_CLASS (op);

 	g_return_if_fail (EV_IS_PRINT_OPERATION (op));

+	g_return_if_fail (class != NULL);

 	g_return_if_fail (GTK_IS_PAGE_SETUP (page_setup));

 	class->set_default_page_setup (op, page_setup);

@@ -238,6 +242,7 @@ ev_print_operation_get_default_page_setu

 	EvPrintOperationClass *class = EV_PRINT_OPERATION_GET_CLASS (op);

 	g_return_val_if_fail (EV_IS_PRINT_OPERATION (op), NULL);

+	g_return_val_if_fail (class != NULL, NULL);

 	return class->get_default_page_setup (op);

 }

@@ -249,6 +254,7 @@ ev_print_operation_set_job_name (EvPrint

 	EvPrintOperationClass *class = EV_PRINT_OPERATION_GET_CLASS (op);

 	g_return_if_fail (EV_IS_PRINT_OPERATION (op));

+	g_return_if_fail (class != NULL);

 	g_return_if_fail (job_name != NULL);

 	class->set_job_name (op, job_name);

@@ -260,6 +266,7 @@ ev_print_operation_get_job_name (EvPrint

 	EvPrintOperationClass *class = EV_PRINT_OPERATION_GET_CLASS (op);

 	g_return_val_if_fail (EV_IS_PRINT_OPERATION (op), NULL);

+	g_return_val_if_fail (class != NULL, NULL);

 	return class->get_job_name (op);

 }

@@ -271,6 +278,7 @@ ev_print_operation_run (EvPrintOperation

 	EvPrintOperationClass *class = EV_PRINT_OPERATION_GET_CLASS (op);

 	g_return_if_fail (EV_IS_PRINT_OPERATION (op));

+	g_return_if_fail (class != NULL);

 	class->run (op, parent);

 }

@@ -281,6 +289,7 @@ ev_print_operation_cancel (EvPrintOperat

 	EvPrintOperationClass *class = EV_PRINT_OPERATION_GET_CLASS (op);

 	g_return_if_fail (EV_IS_PRINT_OPERATION (op));

+	g_return_if_fail (class != NULL);

 	class->cancel (op);

 }

@@ -292,6 +301,7 @@ ev_print_operation_get_error (EvPrintOpe

 	EvPrintOperationClass *class = EV_PRINT_OPERATION_GET_CLASS (op);

 	g_return_if_fail (EV_IS_PRINT_OPERATION (op));

+	g_return_if_fail (class != NULL);

 	class->get_error (op, error);

 }

@@ -303,6 +313,7 @@ ev_print_operation_set_embed_page_setup

 	EvPrintOperationClass *class = EV_PRINT_OPERATION_GET_CLASS (op);

 	g_return_if_fail (EV_IS_PRINT_OPERATION (op));

+	g_return_if_fail (class != NULL);

 	class->set_embed_page_setup (op, embed);

 }

@@ -313,6 +324,7 @@ ev_print_operation_get_embed_page_setup

 	EvPrintOperationClass *class = EV_PRINT_OPERATION_GET_CLASS (op);

 	g_return_val_if_fail (EV_IS_PRINT_OPERATION (op), FALSE);

+	g_return_val_if_fail (class != NULL, FALSE);

 	return class->get_embed_page_setup (op);

 }

--- evince-40.1/libview/ev-timeline.c

+++ evince-40.1/libview/ev-timeline.c

@@ -289,9 +289,15 @@ ev_timeline_new (guint duration)

 void

 ev_timeline_start (EvTimeline *timeline)

 {

+	EvTimelineClass *klass;

+

 	g_return_if_fail (EV_IS_TIMELINE (timeline));

-	EV_TIMELINE_GET_CLASS (timeline)->start (timeline);

+	klass = EV_TIMELINE_GET_CLASS (timeline);

+

+	g_return_if_fail (klass != NULL);

+

+	klass->start (timeline);

 }

 void

--- evince-40.1/libview/ev-view.c

+++ evince-40.1/libview/ev-view.c

@@ -1147,7 +1147,7 @@ ensure_rectangle_is_visible (EvView *vie

 	if (rect->x < adj_value) {

 		value = MAX (gtk_adjustment_get_lower (adjustment), rect->x - MARGIN);

 		gtk_adjustment_set_value (view->hadjustment, value);

-	} else if (rect->x + rect->height > adj_value + allocation.width) {

+	} else if (rect->x + rect->width > adj_value + allocation.width) {

 		value = MIN (gtk_adjustment_get_upper (adjustment), rect->x + rect->width -

 			     allocation.width + MARGIN);

 		gtk_adjustment_set_value (view->hadjustment, value);

@@ -1777,6 +1777,11 @@ goto_fitv_dest (EvView *view, EvLinkDest

 	page = ev_link_dest_get_page (dest);

+	if (page < 0) {

+		g_warning ("Link does not contain a page.");

+		return;

+	}

+

 	left = ev_link_dest_get_left (dest, &change_left);

 	doc_point.x = change_left ? left : 0;

 	doc_point.y = 0;

@@ -1813,6 +1818,11 @@ goto_fith_dest (EvView *view, EvLinkDest

 	page = ev_link_dest_get_page (dest);

+	if (page < 0) {

+		g_warning ("Link does not contain a page.");

+		return;

+	}

+

 	top = ev_link_dest_get_top (dest, &change_top);

 	doc_point.x = 0;

 	doc_point.y = change_top ? top : 0;

@@ -1846,6 +1856,11 @@ goto_fit_dest (EvView *view, EvLinkDest

 	page = ev_link_dest_get_page (dest);

+	if (page < 0) {

+		g_warning ("Link does not contain a page.");

+		return;

+	}

+

 	if (view->allow_links_change_zoom) {

 		double zoom;

 		gdouble doc_width, doc_height;

--- evince-40.1/libview/ev-view-presentation.c

+++ evince-40.1/libview/ev-view-presentation.c

@@ -448,7 +448,7 @@ ev_view_presentation_update_current_page

 {

 	gint jump;

-	if (page < 0 || page >= ev_document_get_n_pages (pview->document))

+	if (page >= ev_document_get_n_pages (pview->document))

 		return;

 	ev_view_presentation_animation_cancel (pview);

--- evince-40.1/shell/ev-find-sidebar.c

+++ evince-40.1/shell/ev-find-sidebar.c

@@ -476,8 +476,10 @@ process_matches_idle (EvFindSidebar *sid

 		page_label = ev_document_get_page_label (document, current_page);

                 page_text = get_page_text (document, page, &areas, &n_areas);

                 g_object_unref (page);

-                if (!page_text)

+                if (!page_text) {

+                        g_free (page_label);

                         continue;

+                }

                 text_log_attrs_length = g_utf8_strlen (page_text, -1);

                 text_log_attrs = g_new0 (PangoLogAttr, text_log_attrs_length + 1);

--- evince-40.1/shell/ev-sidebar-thumbnails.c

+++ evince-40.1/shell/ev-sidebar-thumbnails.c

@@ -658,11 +658,11 @@ ev_sidebar_thumbnails_fill_model (EvSide

 	int i;

 	gint prev_width = -1;

 	gint prev_height = -1;

+	cairo_surface_t *loading_icon = NULL;

 	for (i = 0; i < sidebar_thumbnails->priv->n_pages; i++) {

 		gchar     *page_label;

 		gchar     *page_string;

-		cairo_surface_t *loading_icon = NULL;

 		gint       width, height;

 		page_label = ev_document_get_page_label (priv->document, i);

--- evince-40.1/shell/ev-window.c

+++ evince-40.1/shell/ev-window.c

@@ -3121,10 +3121,10 @@ ev_window_load_print_settings_from_metad

 	for (i = 0; i < G_N_ELEMENTS (document_print_settings); i++) {

 		gchar *value = NULL;

-		ev_metadata_get_string (priv->metadata,

-					document_print_settings[i], &value);

-		gtk_print_settings_set (print_settings,

-					document_print_settings[i], value);

+		if (ev_metadata_get_string (priv->metadata,

+					    document_print_settings[i], &value))

+			gtk_print_settings_set (print_settings,

+						document_print_settings[i], value);

 	}

 }

@@ -4705,12 +4705,16 @@ ev_window_cmd_bookmarks_add (GSimpleActi

 	gchar     *page_label;

 	bm.page = ev_document_model_get_page (priv->model);

-	page_label = ev_document_get_page_label (priv->document, bm.page);

-	bm.title = g_strdup_printf (_("Page %s"), page_label);

-	g_free (page_label);

+	if (bm.page >= 0) {

+		page_label = ev_document_get_page_label (priv->document, bm.page);

+		bm.title = g_strdup_printf (_("Page %s"), page_label);

+		g_free (page_label);

-	/* EvBookmarks takes ownership of bookmark */

-	ev_bookmarks_add (priv->bookmarks, &bm;;

+		/* EvBookmarks takes ownership of bookmark */

+		ev_bookmarks_add (priv->bookmarks, &bm;;

+	} else {

+		g_warning ("Bookmarking of a page failed.");

+	}

 }

 static void