diff -up libtirpc-0.2.4/src/auth_gss.c.orig libtirpc-0.2.4/src/auth_gss.c
--- libtirpc-0.2.4/src/auth_gss.c.orig	2017-05-25 09:53:19.659862958 -0400
+++ libtirpc-0.2.4/src/auth_gss.c	2018-09-11 13:16:34.644008111 -0400
@@ -176,6 +176,7 @@ authgss_create(CLIENT *clnt, gss_name_t
 			rpc_createerr.cf_stat = RPC_SYSTEMERROR;
 			rpc_createerr.cf_error.re_errno = ENOMEM;
 			free(auth);
+			free(gd);
 			return (NULL);
 		}
 	}
diff -up libtirpc-0.2.4/src/clnt_bcast.c.orig libtirpc-0.2.4/src/clnt_bcast.c
--- libtirpc-0.2.4/src/clnt_bcast.c.orig	2017-05-25 09:53:19.659862958 -0400
+++ libtirpc-0.2.4/src/clnt_bcast.c	2018-09-11 13:16:34.644008111 -0400
@@ -297,6 +297,7 @@ rpc_broadcast_exp(prog, vers, proc, xarg
 	if (nettype == NULL)
 		nettype = "datagram_n";
 	if ((handle = __rpc_setconf(nettype)) == NULL) {
+		AUTH_DESTROY(sys_auth);
 		return (RPC_UNKNOWNPROTO);
 	}
 	while ((nconf = __rpc_getconf(handle)) != NULL) {
diff -up libtirpc-0.2.4/src/getnetconfig.c.orig libtirpc-0.2.4/src/getnetconfig.c
--- libtirpc-0.2.4/src/getnetconfig.c.orig	2013-12-09 15:59:51.000000000 -0500
+++ libtirpc-0.2.4/src/getnetconfig.c	2018-09-11 13:16:34.644008111 -0400
@@ -710,6 +710,8 @@ struct netconfig	*ncp;
     p->nc_lookups = (char **)malloc((size_t)(p->nc_nlookups+1) * sizeof(char *));
     if (p->nc_lookups == NULL) {
 	free(p->nc_netid);
+	free(p);
+	free(tmp);
 	return(NULL);
     }
     for (i=0; i < p->nc_nlookups; i++) {
diff -up libtirpc-0.2.4/src/getnetpath.c.orig libtirpc-0.2.4/src/getnetpath.c
--- libtirpc-0.2.4/src/getnetpath.c.orig	2013-12-09 15:59:51.000000000 -0500
+++ libtirpc-0.2.4/src/getnetpath.c	2018-09-11 13:16:34.645008107 -0400
@@ -90,6 +90,7 @@ setnetpath()
     }
     if ((np_sessionp->nc_handlep = setnetconfig()) == NULL) {
 	syslog (LOG_ERR, "rpc: failed to open " NETCONFIG);
+	free(np_sessionp);
 	return (NULL);
     }
     np_sessionp->valid = NP_VALID;
diff -up libtirpc-0.2.4/src/rpcb_clnt.c.orig libtirpc-0.2.4/src/rpcb_clnt.c
--- libtirpc-0.2.4/src/rpcb_clnt.c.orig	2017-05-25 09:53:19.660862942 -0400
+++ libtirpc-0.2.4/src/rpcb_clnt.c	2018-09-11 13:16:34.645008107 -0400
@@ -493,6 +493,7 @@ try_nconf:
 		if (tmpnconf == NULL) {
  			rpc_createerr.cf_stat = RPC_UNKNOWNPROTO;
 			mutex_unlock(&loopnconf_lock);
+			endnetconfig(nc_handle);
 			return (NULL);
 		}
 		loopnconf = getnetconfigent(tmpnconf->nc_netid);
diff -up libtirpc-0.2.4/src/rpc_generic.c.orig libtirpc-0.2.4/src/rpc_generic.c
--- libtirpc-0.2.4/src/rpc_generic.c.orig	2017-05-25 09:53:19.669862794 -0400
+++ libtirpc-0.2.4/src/rpc_generic.c	2018-09-11 13:16:34.645008107 -0400
@@ -320,6 +320,7 @@ __rpc_setconf(nettype)
 		handle->nflag = FALSE;
 		break;
 	default:
+		free(handle);
 		return (NULL);
 	}
 
diff -up libtirpc-0.2.4/src/rpc_soc.c.orig libtirpc-0.2.4/src/rpc_soc.c
--- libtirpc-0.2.4/src/rpc_soc.c.orig	2013-12-09 15:59:51.000000000 -0500
+++ libtirpc-0.2.4/src/rpc_soc.c	2018-09-11 13:16:34.645008107 -0400
@@ -627,15 +627,17 @@ svcunix_create(sock, sendsize, recvsize,
 		    strcmp(nconf->nc_protofmly, NC_LOOPBACK) == 0)
 			break;
 	}
-	if (nconf == NULL)
+	if (nconf == NULL) {
+		endnetconfig(localhandle);
 		return(xprt);
+	}
 
 	if ((sock = __rpc_nconf2fd(nconf)) < 0)
 		goto done;
 
 	memset(&sun, 0, sizeof sun);
 	sun.sun_family = AF_LOCAL;
-	strncpy(sun.sun_path, path, sizeof(sun.sun_path));
+	strncpy(sun.sun_path, path, (sizeof(sun.sun_path)-1));
 	addrlen = sizeof(struct sockaddr_un);
 	sa = (struct sockaddr *)&sun;
 
@@ -656,6 +658,8 @@ svcunix_create(sock, sendsize, recvsize,
 	}
 
 	xprt = (SVCXPRT *)svc_tli_create(sock, nconf, &taddr, sendsize, recvsize);
+	if (xprt == NULL)
+		close(sock);
 
 done:
 	endnetconfig(localhandle);
diff -up libtirpc-0.2.4/src/rtime.c.orig libtirpc-0.2.4/src/rtime.c
--- libtirpc-0.2.4/src/rtime.c.orig	2017-05-25 09:53:19.667862827 -0400
+++ libtirpc-0.2.4/src/rtime.c	2018-09-11 13:16:34.645008107 -0400
@@ -90,6 +90,7 @@ rtime(addrp, timep, timeout)
 
 	/* TCP and UDP port are the same in this case */
 	if ((serv = getservbyname("time", "tcp")) == NULL) {
+		do_close(s);
 		return(-1);
 	}
 
diff -up libtirpc-0.2.4/src/svc_generic.c.orig libtirpc-0.2.4/src/svc_generic.c
--- libtirpc-0.2.4/src/svc_generic.c.orig	2017-05-25 09:53:19.657862991 -0400
+++ libtirpc-0.2.4/src/svc_generic.c	2018-09-11 13:16:34.645008107 -0400
@@ -112,6 +112,7 @@ svc_create(dispatch, prognum, versnum, n
 				if (l == NULL) {
 					warnx("svc_create: no memory");
 					mutex_unlock(&xprtlist_lock);
+					__rpc_endconf(handle);
 					return (0);
 				}
 				l->xprt = xprt;
diff -up libtirpc-0.2.4/src/svc_simple.c.orig libtirpc-0.2.4/src/svc_simple.c
--- libtirpc-0.2.4/src/svc_simple.c.orig	2013-12-09 15:59:51.000000000 -0500
+++ libtirpc-0.2.4/src/svc_simple.c	2018-09-11 13:16:34.646008103 -0400
@@ -158,6 +158,7 @@ rpc_reg(prognum, versnum, procnum, progn
 				((netid = strdup(nconf->nc_netid)) == NULL)) {
 				warnx(rpc_reg_err, rpc_reg_msg, __no_mem_str);
 				SVC_DESTROY(svcxprt);
+				free(xdrbuf);
 				break;
 			}
 			madenow = TRUE;
diff -up libtirpc-0.2.4/src/xdr.c.orig libtirpc-0.2.4/src/xdr.c
--- libtirpc-0.2.4/src/xdr.c.orig	2017-05-25 09:53:19.669862794 -0400
+++ libtirpc-0.2.4/src/xdr.c	2017-05-25 11:50:19.154648294 -0400
@@ -636,9 +636,11 @@ xdr_bytes(xdrs, cpp, sizep, maxsize)
 	/*
 	 * first deal with the length since xdr bytes are counted
 	 */
+	
 	if (! xdr_u_int(xdrs, sizep)) {
 		return (FALSE);
 	}
+
 	nodesize = *sizep;
 	if ((nodesize > maxsize) && (xdrs->x_op != XDR_FREE)) {
 		return (FALSE);