diff -up openssh-7.4p1/auth-pam.c.coverity openssh-7.4p1/auth-pam.c

diff -up openssh-7.4p1/channels.c.coverity openssh-7.4p1/channels.c

--- openssh-7.4p1/channels.c.coverity	2017-02-09 14:58:32.786064600 +0100

+++ openssh-7.4p1/channels.c	2017-02-09 15:01:28.869890219 +0100

@@ -266,11 +266,11 @@ channel_register_fds(Channel *c, int rfd

 	channel_max_fd = MAXIMUM(channel_max_fd, wfd);

 	channel_max_fd = MAXIMUM(channel_max_fd, efd);

-	if (rfd != -1)

+	if (rfd >= 0)

 		fcntl(rfd, F_SETFD, FD_CLOEXEC);

-	if (wfd != -1 && wfd != rfd)

+	if (wfd >= 0 && wfd != rfd)

 		fcntl(wfd, F_SETFD, FD_CLOEXEC);

-	if (efd != -1 && efd != rfd && efd != wfd)

+	if (efd >= 0 && efd != rfd && efd != wfd)

 		fcntl(efd, F_SETFD, FD_CLOEXEC);

 	c->rfd = rfd;

@@ -288,11 +288,11 @@ channel_register_fds(Channel *c, int rfd

 	/* enable nonblocking mode */

 	if (nonblock) {

-		if (rfd != -1)

+		if (rfd >= 0)

 			set_nonblock(rfd);

-		if (wfd != -1)

+		if (wfd >= 0)

 			set_nonblock(wfd);

-		if (efd != -1)

+		if (efd >= 0)

 			set_nonblock(efd);

 	}

 }

diff -up openssh-7.4p1/clientloop.c.coverity openssh-7.4p1/clientloop.c

diff -up openssh-7.4p1/key.c.coverity openssh-7.4p1/key.c

diff -up openssh-7.4p1/monitor.c.coverity openssh-7.4p1/monitor.c

--- openssh-7.4p1/monitor.c.coverity	2017-02-09 14:58:32.793064593 +0100

+++ openssh-7.4p1/monitor.c	2017-02-09 14:58:32.805064581 +0100

@@ -411,7 +411,7 @@ monitor_child_preauth(Authctxt *_authctx

 	mm_get_keystate(pmonitor);

 	/* Drain any buffered messages from the child */

-	while (pmonitor->m_log_recvfd != -1 && monitor_read_log(pmonitor) == 0)

+	while (pmonitor->m_log_recvfd >= 0 && monitor_read_log(pmonitor) == 0)

 		;

 	close(pmonitor->m_sendfd);

diff -up openssh-7.4p1/monitor_wrap.c.coverity openssh-7.4p1/monitor_wrap.c

--- openssh-7.4p1/monitor_wrap.c.coverity	2017-02-09 14:58:32.797064589 +0100

+++ openssh-7.4p1/monitor_wrap.c	2017-02-09 14:58:32.805064581 +0100

@@ -525,10 +525,10 @@ mm_pty_allocate(int *ptyfd, int *ttyfd,

 	if ((tmp1 = dup(pmonitor->m_recvfd)) == -1 ||

 	    (tmp2 = dup(pmonitor->m_recvfd)) == -1) {

 		error("%s: cannot allocate fds for pty", __func__);

-		if (tmp1 > 0)

+		if (tmp1 >= 0)

 			close(tmp1);

-		if (tmp2 > 0)

-			close(tmp2);

+		/*DEAD CODE if (tmp2 >= 0)

+			close(tmp2);*/

 		return 0;

 	}

 	close(tmp1);

diff -up openssh-7.4p1/openbsd-compat/bindresvport.c.coverity openssh-7.4p1/openbsd-compat/bindresvport.c

--- openssh-7.4p1/openbsd-compat/bindresvport.c.coverity	2016-12-19 05:59:41.000000000 +0100

+++ openssh-7.4p1/openbsd-compat/bindresvport.c	2017-02-09 14:58:32.805064581 +0100

@@ -58,7 +58,7 @@ bindresvport_sa(int sd, struct sockaddr

 	struct sockaddr_in6 *in6;

 	u_int16_t *portp;

 	u_int16_t port;

-	socklen_t salen;

+	socklen_t salen = sizeof(struct sockaddr_storage);

 	int i;

 	if (sa == NULL) {

diff -up openssh-7.4p1/packet.c.coverity openssh-7.4p1/packet.c

diff -up openssh-7.4p1/progressmeter.c.coverity openssh-7.4p1/progressmeter.c

diff -up openssh-7.4p1/scp.c.coverity openssh-7.4p1/scp.c

--- openssh-7.4p1/scp.c.coverity	2017-02-09 14:58:32.761064625 +0100

+++ openssh-7.4p1/scp.c	2017-02-09 14:58:38.590058852 +0100

@@ -157,7 +157,7 @@ killchild(int signo)

 {

 	if (do_cmd_pid > 1) {

 		kill(do_cmd_pid, signo ? signo : SIGTERM);

-		waitpid(do_cmd_pid, NULL, 0);

+		(void) waitpid(do_cmd_pid, NULL, 0);

 	}

 	if (signo)

diff -up openssh-7.4p1/servconf.c.coverity openssh-7.4p1/servconf.c

--- openssh-7.4p1/servconf.c.coverity	2017-02-09 14:58:32.801064585 +0100

+++ openssh-7.4p1/servconf.c	2017-02-09 14:58:38.591058851 +0100

@@ -1544,7 +1544,7 @@ process_server_config_line(ServerOptions

 			fatal("%s line %d: Missing subsystem name.",

 			    filename, linenum);

 		if (!*activep) {

-			arg = strdelim(&cp;;

+			/*arg =*/ (void) strdelim(&cp;;

 			break;

 		}

 		for (i = 0; i < options->num_subsystems; i++)

@@ -1635,8 +1635,9 @@ process_server_config_line(ServerOptions

 		if (*activep && *charptr == NULL) {

 			*charptr = tilde_expand_filename(arg, getuid());

 			/* increase optional counter */

-			if (intptr != NULL)

-				*intptr = *intptr + 1;

+			/* DEAD CODE intptr is still NULL ;)

+  			 if (intptr != NULL)

+				*intptr = *intptr + 1; */

 		}

 		break;

diff -up openssh-7.4p1/serverloop.c.coverity openssh-7.4p1/serverloop.c

--- openssh-7.4p1/serverloop.c.coverity	2016-12-19 05:59:41.000000000 +0100

+++ openssh-7.4p1/serverloop.c	2017-02-09 14:58:38.592058850 +0100

@@ -125,13 +125,13 @@ notify_setup(void)

 static void

 notify_parent(void)

 {

-	if (notify_pipe[1] != -1)

+	if (notify_pipe[1] >= 0)

 		(void)write(notify_pipe[1], "", 1);

 }

 static void

 notify_prepare(fd_set *readset)

 {

-	if (notify_pipe[0] != -1)

+	if (notify_pipe[0] >= 0)

 		FD_SET(notify_pipe[0], readset);

 }

 static void

@@ -139,8 +139,8 @@ notify_done(fd_set *readset)

 {

 	char c;

-	if (notify_pipe[0] != -1 && FD_ISSET(notify_pipe[0], readset))

-		while (read(notify_pipe[0], &c, 1) != -1)

+	if (notify_pipe[0] >= 0 && FD_ISSET(notify_pipe[0], readset))

+		while (read(notify_pipe[0], &c, 1) >= 0)

 			debug2("notify_done: reading");

 }

@@ -518,7 +518,7 @@ server_request_tun(void)

 	}

 	tun = packet_get_int();

-	if (forced_tun_device != -1) {

+	if (forced_tun_device >= 0) {

 		if (tun != SSH_TUNID_ANY && forced_tun_device != tun)

 			goto done;

 		tun = forced_tun_device;

diff -up openssh-7.4p1/sftp.c.coverity openssh-7.4p1/sftp.c

--- openssh-7.4p1/sftp.c.coverity	2016-12-19 05:59:41.000000000 +0100

+++ openssh-7.4p1/sftp.c	2017-02-09 14:58:38.598058844 +0100

@@ -224,7 +224,7 @@ killchild(int signo)

 {

 	if (sshpid > 1) {

 		kill(sshpid, SIGTERM);

-		waitpid(sshpid, NULL, 0);

+		(void) waitpid(sshpid, NULL, 0);

 	}

 	_exit(1);

diff -up openssh-7.4p1/sftp-client.c.coverity openssh-7.4p1/sftp-client.c

--- openssh-7.4p1/sftp-client.c.coverity	2017-02-09 14:58:38.596058846 +0100

+++ openssh-7.4p1/sftp-client.c	2017-02-09 15:20:18.893624636 +0100

@@ -973,7 +973,7 @@ do_symlink(struct sftp_conn *conn, const

 }

 int

-do_fsync(struct sftp_conn *conn, u_char *handle, u_int handle_len)

+do_fsync(struct sftp_conn *conn, const u_char *handle, u_int handle_len)

 {

 	struct sshbuf *msg;

 	u_int status, id;

--- openssh-7.4p1/sftp-client.h.coverity        2017-02-10 09:28:10.951155129 +0100

+++ openssh-7.4p1/sftp-client.h 2017-02-10 09:27:28.685069870 +0100

@@ -107,7 +107,7 @@ int do_hardlink(struct sftp_conn *, cons

 int do_symlink(struct sftp_conn *, const char *, const char *);

 /* Call fsync() on open file 'handle' */

-int do_fsync(struct sftp_conn *conn, u_char *, u_int);

+int do_fsync(struct sftp_conn *conn, const u_char *, u_int);

 /*

  * Download 'remote_path' to 'local_path'. Preserve permissions and times

diff -up openssh-7.4p1/ssh-agent.c.coverity openssh-7.4p1/ssh-agent.c

--- openssh-7.4p1/ssh-agent.c.coverity	2017-02-09 14:58:38.599058843 +0100

+++ openssh-7.4p1/ssh-agent.c	2017-02-09 15:29:21.938917065 +0100

@@ -1220,8 +1220,8 @@ main(int ac, char **av)

 	sanitise_stdfd();

 	/* drop */

-	setegid(getgid());

-	setgid(getgid());

+	(void) setegid(getgid());

+	(void) setgid(getgid());

 	platform_disable_tracing(0);	/* strict=no */

diff -up openssh-7.4p1/sshd.c.coverity openssh-7.4p1/sshd.c

--- openssh-7.4p1/sshd.c.coverity	2017-02-09 14:58:38.600058842 +0100

+++ openssh-7.4p1/sshd.c	2017-02-09 15:30:33.403800831 +0100

@@ -679,8 +679,10 @@ privsep_preauth(Authctxt *authctxt)

 		privsep_preauth_child();

 		setproctitle("%s", "[net]");

-		if (box != NULL)

+		if (box != NULL) {

 			ssh_sandbox_child(box);

+			free(box);

+		}

 		return 0;

 	}

@@ -1382,6 +1384,9 @@ server_accept_loop(int *sock_in, int *so

 		if (num_listen_socks < 0)

 			break;

 	}

+

+	if (fdset != NULL)

+		free(fdset);

 }

 /*

diff --git a/auth-pam.c b/auth-pam.c

index e554ec4..bd16d80 100644

--- a/auth-pam.c

+++ b/auth-pam.c

@@ -834,6 +834,8 @@ fake_password(const char *wire_password)

 		fatal("%s: password length too long: %zu", __func__, l);

 	ret = malloc(l + 1);

+	if (ret == NULL)

+		return NULL;

 	for (i = 0; i < l; i++)

 		ret[i] = junk[i % (sizeof(junk) - 1)];

 	ret[i] = '\0';

diff --git a/clientloop.c b/clientloop.c

index c6a4138..9b00e12 100644

--- a/clientloop.c

+++ b/clientloop.c

@@ -2290,7 +2290,7 @@ update_known_hosts(struct hostkeys_update_ctx *ctx)

 			free(response);

 			response = read_passphrase("Accept updated hostkeys? "

 			    "(yes/no): ", RP_ECHO);

-			if (strcasecmp(response, "yes") == 0)

+			if (response != NULL && strcasecmp(response, "yes") == 0)

 				break;

 			else if (quit_pending || response == NULL ||

 			    strcasecmp(response, "no") == 0) {

diff --git a/digest-openssl.c b/digest-openssl.c

index 13b63c2..dfa9b8d 100644

--- a/digest-openssl.c

+++ b/digest-openssl.c

@@ -158,7 +158,7 @@ ssh_digest_final(struct ssh_digest_ctx *ctx, u_char *d, size_t dlen)

 	const struct ssh_digest *digest = ssh_digest_by_alg(ctx->alg);

 	u_int l = dlen;

-	if (dlen > UINT_MAX)

+	if (digest == NULL || dlen > UINT_MAX)

 		return SSH_ERR_INVALID_ARGUMENT;

 	if (dlen < digest->digest_len) /* No truncation allowed */

 		return SSH_ERR_INVALID_ARGUMENT;

diff --git a/kex.c b/kex.c

index a30dabe..a8ac91f 100644

--- a/kex.c

+++ b/kex.c

@@ -178,7 +178,7 @@ kex_names_valid(const char *names)

 char *

 kex_names_cat(const char *a, const char *b)

 {

-	char *ret = NULL, *tmp = NULL, *cp, *p;

+	char *ret = NULL, *tmp = NULL, *cp, *p, *m;

 	size_t len;

 	if (a == NULL || *a == '\0')

@@ -195,8 +195,10 @@ kex_names_cat(const char *a, const char *b)

 	}

 	strlcpy(ret, a, len);

 	for ((p = strsep(&cp, ",")); p && *p != '\0'; (p = strsep(&cp, ","))) {

-		if (match_list(ret, p, NULL) != NULL)

+		if ((m = match_list(ret, p, NULL)) != NULL) {

+			free(m);

 			continue; /* Algorithm already present */

+		}

 		if (strlcat(ret, ",", len) >= len ||

 		    strlcat(ret, p, len) >= len) {

 			free(tmp);

@@ -651,8 +653,10 @@ choose_enc(struct sshenc *enc, char *client, char *server)

 #endif

 		return SSH_ERR_NO_CIPHER_ALG_MATCH;

 	}

-	if ((enc->cipher = cipher_by_name(name)) == NULL)

+	if ((enc->cipher = cipher_by_name(name)) == NULL) {

+		free(name);

 		return SSH_ERR_INTERNAL_ERROR;

+	}

 	enc->name = name;

 	enc->enabled = 0;

 	enc->iv = NULL;

@@ -670,8 +674,10 @@ choose_mac(struct ssh *ssh, struct sshmac *mac, char *client, char *server)

 #endif

 		return SSH_ERR_NO_MAC_ALG_MATCH;

 	}

-	if (mac_setup(mac, name) < 0)

+	if (mac_setup(mac, name) < 0) {

+		free(name);

 		return SSH_ERR_INTERNAL_ERROR;

+	}

 	/* truncate the key */

 	if (ssh->compat & SSH_BUG_HMAC)

 		mac->key_len = 16;

@@ -695,6 +701,7 @@ choose_comp(struct sshcomp *comp, char *client, char *server)

 	} else if (strcmp(name, "none") == 0) {

 		comp->type = COMP_NONE;

 	} else {

+		free(name);

 		return SSH_ERR_INTERNAL_ERROR;

 	}

 	comp->name = name;

diff --git a/readconf.c b/readconf.c

index 3e7a5d8..acc1391 100644

--- a/readconf.c

+++ b/readconf.c

@@ -1500,6 +1500,7 @@ parse_keytypes:

 			if (r == GLOB_NOMATCH) {

 				debug("%.200s line %d: include %s matched no "

 				    "files",filename, linenum, arg2);

+				free(arg2);

 				continue;

 			} else if (r != 0 || gl.gl_pathc < 0)

 				fatal("%.200s line %d: glob failed for %s.",

diff --git a/servconf.c b/servconf.c

index 6ab1cb4..5f2464a 100644

--- a/servconf.c

+++ b/servconf.c

@@ -2284,8 +2284,6 @@ dump_cfg_fmtint(ServerOpCodes code, int val)

 static void

 dump_cfg_string(ServerOpCodes code, const char *val)

 {

-	if (val == NULL)

-		return;

 	printf("%s %s\n", lookup_opcode_name(code),

 	    val == NULL ? "none" : val);

 }

diff --git a/sshconnect.c b/sshconnect.c

index 07f80cd..5d4b41b 100644

--- a/sshconnect.c

+++ b/sshconnect.c

@@ -1533,6 +1533,7 @@ maybe_add_key_to_agent(char *authfile, Key *private, char *comment,

 	if (options.add_keys_to_agent == 2 &&

 	    !ask_permission("Add key %s (%s) to agent?", authfile, comment)) {

 		debug3("user denied adding this key");

+		close(auth_sock);

 		return;

 	}

@@ -1541,4 +1542,5 @@ maybe_add_key_to_agent(char *authfile, Key *private, char *comment,

 		debug("identity added to agent: %s", authfile);

 	else

 		debug("could not add identity to agent: %s (%d)", authfile, r);

+	close(auth_sock);

 }

diff --git a/sshconnect2.c b/sshconnect2.c

index f31c24c..aecf765 100644

--- a/sshconnect2.c

+++ b/sshconnect2.c

@@ -1061,6 +1061,7 @@ sign_and_send_pubkey(Authctxt *authctxt, Identity *id)

 	if (key_to_blob(id->key, &blob, &bloblen) == 0) {

 		/* we cannot handle this key */

+		free(blob);

 		debug3("sign_and_send_pubkey: cannot handle key");

 		return 0;

 	}

@@ -1170,6 +1171,7 @@ send_pubkey_test(Authctxt *authctxt, Identity *id)

 	if (key_to_blob(id->key, &blob, &bloblen) == 0) {

 		/* we cannot handle this key */

+		free(blob);

 		debug3("send_pubkey_test: cannot handle key");

 		return 0;

 	}

diff --git a/sshkey.c b/sshkey.c

index 85fd1bd..58c1051 100644

--- a/sshkey.c

+++ b/sshkey.c

@@ -1375,8 +1375,6 @@ sshkey_read(struct sshkey *ret, char **cpp)

 		retval = 0;

 /*XXXX*/

 		sshkey_free(k);

-		if (retval != 0)

-			break;

 		break;

 	default:

 		return SSH_ERR_INVALID_ARGUMENT;

diff --git a/krl.c b/krl.c

index e271a19..69bec99 100644

--- a/krl.c

+++ b/krl.c

@@ -1089,7 +1089,7 @@ ssh_krl_from_blob(struct sshbuf *buf, struct ssh_krl **krlp,

 			break;

 		case KRL_SECTION_SIGNATURE:

 			/* Handled above, but still need to stay in synch */

-			sshbuf_reset(sect);

+			sshbuf_free(sect);

 			sect = NULL;

 			if ((r = sshbuf_skip_string(copy)) != 0)

 				goto out;

@@ -1288,7 +1288,8 @@ ssh_krl_file_contains_key(const char *path, const struct sshkey *key)

 	debug2("%s: checking KRL %s", __func__, path);

 	r = ssh_krl_check_key(krl, key);

  out:

-	close(fd);

+	if (fd != -1)

+		close(fd);

 	sshbuf_free(krlbuf);

 	ssh_krl_free(krl);

 	if (r != 0)

diff --git a/readconf.c b/readconf.c

index acc1391..c4dff15 100644

--- a/readconf.c

+++ b/readconf.c

@@ -1185,7 +1185,7 @@ parse_int:

 		value = cipher_number(arg);

 		if (value == -1)

 			fatal("%.200s line %d: Bad cipher '%s'.",

-			    filename, linenum, arg ? arg : "<NONE>");

+			    filename, linenum, arg);

 		if (*activep && *intptr == -1)

 			*intptr = value;

 		break;

@@ -1196,7 +1196,7 @@ parse_int:

 			fatal("%.200s line %d: Missing argument.", filename, linenum);

 		if (!ciphers_valid(*arg == '+' ? arg + 1 : arg))

 			fatal("%.200s line %d: Bad SSH2 cipher spec '%s'.",

-			    filename, linenum, arg ? arg : "<NONE>");

+			    filename, linenum, arg);

 		if (*activep && options->ciphers == NULL)

 			options->ciphers = xstrdup(arg);

 		break;

@@ -1207,7 +1207,7 @@ parse_int:

 			fatal("%.200s line %d: Missing argument.", filename, linenum);

 		if (!mac_valid(*arg == '+' ? arg + 1 : arg))

 			fatal("%.200s line %d: Bad SSH2 Mac spec '%s'.",

-			    filename, linenum, arg ? arg : "<NONE>");

+			    filename, linenum, arg);

 		if (*activep && options->macs == NULL)

 			options->macs = xstrdup(arg);

 		break;

@@ -1220,7 +1220,7 @@ parse_int:

 			    filename, linenum);

 		if (!kex_names_valid(*arg == '+' ? arg + 1 : arg))

 			fatal("%.200s line %d: Bad SSH2 KexAlgorithms '%s'.",

-			    filename, linenum, arg ? arg : "<NONE>");

+			    filename, linenum, arg);

 		if (*activep && options->kex_algorithms == NULL)

 			options->kex_algorithms = xstrdup(arg);

 		break;

@@ -1235,7 +1235,7 @@ parse_keytypes:

 			    filename, linenum);

 		if (!sshkey_names_valid2(*arg == '+' ? arg + 1 : arg, 1))

 			fatal("%s line %d: Bad key types '%s'.",

-				filename, linenum, arg ? arg : "<NONE>");

+				filename, linenum, arg);

 		if (*activep && *charptr == NULL)

 			*charptr = xstrdup(arg);

 		break;

@@ -1248,7 +1248,7 @@ parse_keytypes:

 		value = proto_spec(arg);

 		if (value == SSH_PROTO_UNKNOWN)

 			fatal("%.200s line %d: Bad protocol spec '%s'.",

-			    filename, linenum, arg ? arg : "<NONE>");

+			    filename, linenum, arg);

 		if (*activep && *intptr == SSH_PROTO_UNKNOWN)

 			*intptr = value;

 		break;

diff --git a/servconf.c b/servconf.c

index 5f2464a..4564494 100644

--- a/servconf.c

+++ b/servconf.c

@@ -1217,7 +1217,7 @@ process_server_config_line_depth(ServerOptions *options, char *line,

 			    filename, linenum);

 		if (!sshkey_names_valid2(*arg == '+' ? arg + 1 : arg, 1))

 			fatal("%s line %d: Bad key types '%s'.",

-			    filename, linenum, arg ? arg : "<NONE>");

+			    filename, linenum, arg);

 		if (*activep && *charptr == NULL)

 			*charptr = xstrdup(arg);

 		break;

@@ -1476,7 +1476,7 @@ process_server_config_line_depth(ServerOptions *options, char *line,

 			fatal("%s line %d: Missing argument.", filename, linenum);

 		if (!ciphers_valid(*arg == '+' ? arg + 1 : arg))

 			fatal("%s line %d: Bad SSH2 cipher spec '%s'.",

-			    filename, linenum, arg ? arg : "<NONE>");

+			    filename, linenum, arg);

 		if (options->ciphers == NULL)

 			options->ciphers = xstrdup(arg);

 		break;

@@ -1487,7 +1487,7 @@ process_server_config_line_depth(ServerOptions *options, char *line,

 			fatal("%s line %d: Missing argument.", filename, linenum);

 		if (!mac_valid(*arg == '+' ? arg + 1 : arg))

 			fatal("%s line %d: Bad SSH2 mac spec '%s'.",

-			    filename, linenum, arg ? arg : "<NONE>");

+			    filename, linenum, arg);

 		if (options->macs == NULL)

 			options->macs = xstrdup(arg);

 		break;

@@ -1500,7 +1500,7 @@ process_server_config_line_depth(ServerOptions *options, char *line,

 			    filename, linenum);

 		if (!kex_names_valid(*arg == '+' ? arg + 1 : arg))

 			fatal("%s line %d: Bad SSH2 KexAlgorithms '%s'.",

-			    filename, linenum, arg ? arg : "<NONE>");

+			    filename, linenum, arg);

 		if (options->kex_algorithms == NULL)

 			options->kex_algorithms = xstrdup(arg);

 		break;

diff --git a/ssh-pkcs11.c b/ssh-pkcs11.c

index aaf712d..62a76b3 100644

--- a/ssh-pkcs11.c

+++ b/ssh-pkcs11.c

@@ -536,8 +536,8 @@ pkcs11_fetch_keys_filter(struct pkcs11_provider *p, CK_ULONG slotidx,

 				X509_free(x509);

 		}

 		if (rsa && rsa->n && rsa->e &&

-		    pkcs11_rsa_wrap(p, slotidx, &attribs[0], rsa) == 0) {

-			key = sshkey_new(KEY_UNSPEC);

+		    pkcs11_rsa_wrap(p, slotidx, &attribs[0], rsa) == 0 &&

+		    (key = sshkey_new(KEY_UNSPEC)) != NULL) {

 			key->rsa = rsa;

 			key->type = KEY_RSA;

 			key->flags |= SSHKEY_FLAG_EXT;

diff --git a/sshconnect1.c b/sshconnect1.c

index a045361..0e1a506 100644

--- a/sshconnect1.c

+++ b/sshconnect1.c

@@ -520,7 +520,8 @@ ssh_kex(char *host, struct sockaddr *hostaddr)

 		cookie[i] = packet_get_char();

 	/* Get the public key. */

-	server_key = key_new(KEY_RSA1);

+	if ((server_key = key_new(KEY_RSA1)) == NULL)

+		fatal("%s: key_new(KEY_RSA1) failed", __func__);

 	bits = packet_get_int();

 	packet_get_bignum(server_key->rsa->e);

 	packet_get_bignum(server_key->rsa->n);

@@ -532,7 +533,8 @@ ssh_kex(char *host, struct sockaddr *hostaddr)

 		logit("Warning: This may be due to an old implementation of ssh.");

 	}

 	/* Get the host key. */

-	host_key = key_new(KEY_RSA1);

+	if ((host_key = key_new(KEY_RSA1)) == NULL)

+		fatal("%s: key_new(KEY_RSA1) failed", __func__);

 	bits = packet_get_int();

 	packet_get_bignum(host_key->rsa->e);

 	packet_get_bignum(host_key->rsa->n);

diff --git a/sshkey.c b/sshkey.c

index 58c1051..6afacb5 100644

--- a/sshkey.c

+++ b/sshkey.c

@@ -1239,6 +1239,9 @@ sshkey_read(struct sshkey *ret, char **cpp)

 	u_long bits;

 #endif /* WITH_SSH1 */

+	if (ret == NULL)

+		return SSH_ERR_INVALID_ARGUMENT;

+

 	cp = *cpp;

 	switch (ret->type) {