diff --git libsepol-2.8/cil/src/cil_binary.c libsepol-2.8/cil/src/cil_binary.c

index 0cc6eeb..d1c7b14 100644

--- libsepol-2.8/cil/src/cil_binary.c

+++ libsepol-2.8/cil/src/cil_binary.c

@@ -912,6 +912,8 @@ int cil_sensalias_to_policydb(policydb_t *pdb, struct cil_alias *cil_alias)

 	key = cil_strdup(cil_alias->datum.fqn);

 	rc = symtab_insert(pdb, SYM_LEVELS, key, sepol_alias, SCOPE_DECL, 0, NULL);

 	if (rc != SEPOL_OK) {

+		if (rc == 1)

+			free(sepol_alias);

 		goto exit;

 	}

@@ -1763,11 +1765,13 @@ int __cil_avrulex_ioctl_to_hashtable(hashtab_t h, uint16_t kind, uint32_t src, u

 		hashtab_xperms = cil_malloc(sizeof(*hashtab_xperms));

 		rc = ebitmap_cpy(hashtab_xperms, xperms);

 		if (rc != SEPOL_OK) {

+			free(hashtab_xperms);

 			free(avtab_key);

 			goto exit;

 		}

 		rc = hashtab_insert(h, (hashtab_key_t)avtab_key, hashtab_xperms);

 		if (rc != SEPOL_OK) {

+			free(hashtab_xperms);

 			free(avtab_key);

 			goto exit;

 		}

@@ -2157,6 +2161,7 @@ static int __cil_cond_expr_to_sepol_expr_helper(policydb_t *pdb, struct cil_list

 			op->expr_type = COND_NEQ;

 			break;

 		default:

+			free(op);

 			goto exit;

 		}

@@ -2283,6 +2288,7 @@ int cil_booleanif_to_policydb(policydb_t *pdb, const struct cil_db *db, struct c

 	cond_expr_destroy(tmp_cond->expr);

 	free(tmp_cond);

+	tmp_cond = NULL;

 	for (cb_node = node->cl_head; cb_node != NULL; cb_node = cb_node->next) {

 		if (cb_node->flavor == CIL_CONDBLOCK) {

@@ -2327,6 +2333,11 @@ int cil_booleanif_to_policydb(policydb_t *pdb, const struct cil_db *db, struct c

 	return SEPOL_OK;

 exit:

+	if (tmp_cond) {

+		if (tmp_cond->expr)

+			cond_expr_destroy(tmp_cond->expr);

+		free(tmp_cond);

+	}

 	return rc;

 }

@@ -4797,6 +4808,8 @@ static struct cil_list *cil_classperms_from_sepol(policydb_t *pdb, uint16_t clas

 	return cp_list;

 exit:

+	if (cp)

+		free(cp);

 	cil_log(CIL_ERR,"Failed to create CIL class-permissions from sepol values\n");

 	return NULL;

 }

diff --git libsepol-2.8/cil/src/cil_resolve_ast.c libsepol-2.8/cil/src/cil_resolve_ast.c

index 0225924..3ea070c 100644

--- libsepol-2.8/cil/src/cil_resolve_ast.c

+++ libsepol-2.8/cil/src/cil_resolve_ast.c

@@ -1522,6 +1522,7 @@ int cil_resolve_sidorder(struct cil_tree_node *current, void *extra_args)

 		rc = cil_resolve_name(current, (char *)curr->data, CIL_SYM_SIDS, extra_args, &datum);

 		if (rc != SEPOL_OK) {

 			cil_log(CIL_ERR, "Failed to resolve sid %s in sidorder\n", (char *)curr->data);

+			free(new);

 			goto exit;

 		}

 		cil_list_append(new, CIL_SID, datum);

@@ -1591,6 +1592,8 @@ int cil_resolve_catorder(struct cil_tree_node *current, void *extra_args)

 	return SEPOL_OK;

 exit:

+	if (new)

+		free(new);

 	return rc;

 }

@@ -1624,6 +1627,7 @@ int cil_resolve_sensitivityorder(struct cil_tree_node *current, void *extra_args

 	return SEPOL_OK;

 exit:

+	free(new);

 	return rc;

 }

@@ -2853,6 +2857,7 @@ int cil_resolve_call1(struct cil_tree_node *current, void *extra_args)

 					rc = cil_fill_cats(pc, &catset->cats);

 					if (rc != SEPOL_OK) {

 						cil_destroy_catset(catset);

+						cil_destroy_args(new_arg);

 						goto exit;

 					}

 					cil_tree_node_init(&cat_node);

@@ -2877,6 +2882,7 @@ int cil_resolve_call1(struct cil_tree_node *current, void *extra_args)

 					if (rc != SEPOL_OK) {

 						cil_log(CIL_ERR, "Failed to create anonymous level, rc: %d\n", rc);

 						cil_destroy_level(level);

+						cil_destroy_args(new_arg);

 						goto exit;

 					}

 					cil_tree_node_init(&lvl_node);

@@ -2901,6 +2907,7 @@ int cil_resolve_call1(struct cil_tree_node *current, void *extra_args)

 					if (rc != SEPOL_OK) {

 						cil_log(CIL_ERR, "Failed to create anonymous levelrange, rc: %d\n", rc);

 						cil_destroy_levelrange(range);

+						cil_destroy_args(new_arg);

 						goto exit;

 					}

 					cil_tree_node_init(&range_node);

@@ -2925,6 +2932,7 @@ int cil_resolve_call1(struct cil_tree_node *current, void *extra_args)

 					if (rc != SEPOL_OK) {

 						cil_log(CIL_ERR, "Failed to create anonymous ip address, rc; %d\n", rc);

 						cil_destroy_ipaddr(ipaddr);

+						cil_destroy_args(new_arg);

 						goto exit;

 					}

 					cil_tree_node_init(&addr_node);

@@ -2955,6 +2963,7 @@ int cil_resolve_call1(struct cil_tree_node *current, void *extra_args)

 					if (rc != SEPOL_OK) {

 						cil_log(CIL_ERR, "Failed to create anonymous classpermission\n");

 						cil_destroy_classpermission(cp);

+						cil_destroy_args(new_arg);

 						goto exit;

 					}

 					cil_tree_node_init(&cp_node);

@@ -2970,6 +2979,7 @@ int cil_resolve_call1(struct cil_tree_node *current, void *extra_args)

 			default:

 				cil_log(CIL_ERR, "Unexpected flavor: %d\n", 

 						(((struct cil_param*)item->data)->flavor));

+				cil_destroy_args(new_arg);

 				rc = SEPOL_ERR;

 				goto exit;

 			}

diff --git libsepol-2.8/cil/src/cil_symtab.c libsepol-2.8/cil/src/cil_symtab.c

index 3769979..2970b86 100644

--- libsepol-2.8/cil/src/cil_symtab.c

+++ libsepol-2.8/cil/src/cil_symtab.c

@@ -185,6 +185,7 @@ int cil_complex_symtab_insert(struct cil_complex_symtab *symtab,

 			ckey->key2 == curr->ckey->key2 &&

 			ckey->key3 == curr->ckey->key3 &&

 			ckey->key4 == curr->ckey->key4) {

+			free(node);

 			return SEPOL_EEXIST;

 		}

diff --git libsepol-2.8/src/expand.c libsepol-2.8/src/expand.c

index 6f1b235..125a680 100644

--- libsepol-2.8/src/expand.c

+++ libsepol-2.8/src/expand.c

@@ -1451,6 +1451,7 @@ static int expand_filename_trans(expand_state_t *state, filename_trans_rule_t *r

 				new_trans->name = strdup(cur_rule->name);

 				if (!new_trans->name) {

 					ERR(state->handle, "Out of memory!");

+					free(new_trans);

 					return -1;

 				}

 				new_trans->stype = i + 1;

@@ -1460,6 +1461,8 @@ static int expand_filename_trans(expand_state_t *state, filename_trans_rule_t *r

 				otype = calloc(1, sizeof(*otype));

 				if (!otype) {

 					ERR(state->handle, "Out of memory!");

+					free(new_trans->name);

+					free(new_trans);

 					return -1;

 				}

 				otype->otype = mapped_otype;

diff --git libsepol-2.8/src/kernel_to_cil.c libsepol-2.8/src/kernel_to_cil.c

index b1eb66d..8d58e04 100644

--- libsepol-2.8/src/kernel_to_cil.c

+++ libsepol-2.8/src/kernel_to_cil.c

@@ -2019,6 +2019,8 @@ static int write_cond_av_list_to_cil(FILE *out, struct policydb *pdb, cond_av_li

 	return 0;

 exit:

+	strs_free_all(strs);

+	strs_destroy(&strs;;

 	return rc;

 }

diff --git libsepol-2.8/src/kernel_to_common.c libsepol-2.8/src/kernel_to_common.c

index 342bc3c..19a8c0e 100644

--- libsepol-2.8/src/kernel_to_common.c

+++ libsepol-2.8/src/kernel_to_common.c

@@ -80,10 +80,12 @@ static char *create_str_helper(const char *fmt, int num, va_list vargs)

 		goto exit;

 	}

+	va_end(vargs2);

 	return str;

 exit:

 	free(str);

+	va_end(vargs2);

 	return NULL;

 }

diff --git libsepol-2.8/src/kernel_to_conf.c libsepol-2.8/src/kernel_to_conf.c

index 9540520..a74e6c4 100644

--- libsepol-2.8/src/kernel_to_conf.c

+++ libsepol-2.8/src/kernel_to_conf.c

@@ -1987,6 +1987,8 @@ static int write_cond_av_list_to_conf(FILE *out, struct policydb *pdb, cond_av_l

 	return 0;

 exit:

+	strs_free_all(strs);

+	strs_destroy(&strs;;

 	return rc;

 }