Index: xen-3.1-testing/tools/ioemu/hw/piix4acpi.c
===================================================================
--- xen-3.1-testing.orig/tools/ioemu/hw/piix4acpi.c
+++ xen-3.1-testing/tools/ioemu/hw/piix4acpi.c
@@ -69,6 +69,8 @@ static int piix4acpi_load(QEMUFile *f, v
     if (version_id > 1) 
         return -EINVAL;
     qemu_get_be16s(f, &s->pm1_control);
+
+    return 0;
 }
 
 static void acpiPm1Control_writeb(void *opaque, uint32_t addr, uint32_t val)
Index: xen-3.1-testing/tools/ioemu/hw/usb-hid.c
===================================================================
--- xen-3.1-testing.orig/tools/ioemu/hw/usb-hid.c
+++ xen-3.1-testing/tools/ioemu/hw/usb-hid.c
@@ -557,6 +557,7 @@ int usb_mouse_load(QEMUFile *f, void *op
         fprintf(logfile, "usb_mouse_load:add usb_mouse_event.\n");
         qemu_add_mouse_event_handler(usb_mouse_event, s, 0);
     }
+    return 0;
 }
 
 
Index: xen-3.1-testing/tools/misc/miniterm/miniterm.c
===================================================================
--- xen-3.1-testing.orig/tools/misc/miniterm/miniterm.c
+++ xen-3.1-testing/tools/misc/miniterm/miniterm.c
@@ -157,7 +157,7 @@ int main(int argc, char **argv)
     case 0:
         close(1); /* stdout not needed */
         for ( c = (char)getchar(); c != ENDMINITERM; c = (char)getchar() )
-            write(fd,&c,1);
+            if (write(fd,&c,1)) ;
         tcsetattr(fd,TCSANOW,&oldsertio);
         tcsetattr(0,TCSANOW,&oldstdtio);
         close(fd);
@@ -169,19 +169,19 @@ int main(int argc, char **argv)
         close(fd);
         exit(-1);
     default:
-        write(1, start_str, strlen(start_str));
+        if (write(1, start_str, strlen(start_str))) ;
         close(0); /* stdin not needed */
         sa.sa_handler = child_handler;
         sa.sa_flags = 0;
         sigaction(SIGCHLD,&sa,NULL); /* handle dying child */
         while ( !stop )
         {
-            read(fd,&c,1); /* modem */
+            if (read(fd,&c,1)) ; /* modem */
             c = (char)c;
-            write(1,&c,1); /* stdout */
+            if (write(1,&c,1)) ; /* stdout */
         }
         wait(NULL); /* wait for child to die or it will become a zombie */
-        write(1, end_str, strlen(end_str));
+        if (write(1, end_str, strlen(end_str))) ;
         break;
     }
 
Index: xen-3.1-testing/xen/tools/symbols.c
===================================================================
--- xen-3.1-testing.orig/xen/tools/symbols.c
+++ xen-3.1-testing/xen/tools/symbols.c
@@ -80,7 +80,8 @@ static int read_symbol(FILE *in, struct 
 	if (rc != 3) {
 		if (rc != EOF) {
 			/* skip line */
-			fgets(str, 500, in);
+			if (fgets(str, sizeof(str), in) == NULL)
+				; /* don't care */
 		}
 		return -1;
 	}
Index: xen-3.1-testing/tools/blktap/drivers/blktapctrl.c
===================================================================
--- xen-3.1-testing.orig/tools/blktap/drivers/blktapctrl.c
+++ xen-3.1-testing/tools/blktap/drivers/blktapctrl.c
@@ -143,7 +143,8 @@ static int get_new_dev(int *major, int *
 		return -1;
 	}
 
-	asprintf(&devname,"%s/%s%d",BLKTAP_DEV_DIR, BLKTAP_DEV_NAME, *minor);
+	if (asprintf(&devname,"%s/%s%d",BLKTAP_DEV_DIR, BLKTAP_DEV_NAME, *minor) == -1)
+		return -1;
 	make_blktap_dev(devname,*major,*minor);	
 	DPRINTF("Received device id %d and major %d, "
 		"sent domid %d and be_id %d\n",
@@ -495,20 +496,27 @@ int blktapctrl_new_blkif(blkif_t *blkif)
 
 		if (!exist) {
 			DPRINTF("Process does not exist:\n");
-			asprintf(&rdctldev, 
-				 "%s/tapctrlread%d", BLKTAP_CTRL_DIR, minor);
-			blkif->fds[READ] = open_ctrl_socket(rdctldev);
-
+			if (asprintf(&rdctldev,
+				     "%s/tapctrlread%d", BLKTAP_CTRL_DIR, minor) == -1)
+				return -1;
+			if (asprintf(&wrctldev,
+				     "%s/tapctrlwrite%d", BLKTAP_CTRL_DIR, minor) == -1) {
+				free(rdctldev);
+				return -1;
+			}
+			if (asprintf(&cmd, "tapdisk %s %s", wrctldev, rdctldev) == -1) {
+				free(rdctldev);
+				free(wrctldev);
+				return -1;
+			}
 
-			asprintf(&wrctldev, 
-				 "%s/tapctrlwrite%d", BLKTAP_CTRL_DIR, minor);
+			blkif->fds[READ] = open_ctrl_socket(rdctldev);
 			blkif->fds[WRITE] = open_ctrl_socket(wrctldev);
 			
 			if (blkif->fds[READ] == -1 || blkif->fds[WRITE] == -1) 
 				goto fail;
 
 			/*launch the new process*/
-			asprintf(&cmd, "tapdisk %s %s", wrctldev, rdctldev);
 			DPRINTF("Launching process, CMDLINE [%s]\n",cmd);
 			if (system(cmd) == -1) {
 				DPRINTF("Unable to fork, cmdline: [%s]\n",cmd);
@@ -678,7 +686,10 @@ int main(int argc, char *argv[])
 	__init_blkif();
 	snprintf(buf, sizeof(buf), "BLKTAPCTRL[%d]", getpid());
 	openlog(buf, LOG_CONS|LOG_ODELAY, LOG_DAEMON);
-	daemon(0,0);
+	if (daemon(0,0)) {
+		DPRINTF("daemon failed (%d)\n", errno);
+		goto open_failed;
+	}
 
 	print_drivers();
 	init_driver_list();
@@ -689,7 +700,8 @@ int main(int argc, char *argv[])
 	register_new_unmap_hook(unmap_blktapctrl);
 
 	/* Attach to blktap0 */
-	asprintf(&devname,"%s/%s0", BLKTAP_DEV_DIR, BLKTAP_DEV_NAME);
+	if (asprintf(&devname,"%s/%s0", BLKTAP_DEV_DIR, BLKTAP_DEV_NAME) == -1)
+		goto open_failed;
 	if ((ret = xc_find_device_number("blktap0")) < 0)
 		goto open_failed;
 	blktap_major = major(ret);
Index: xen-3.1-testing/tools/blktap/drivers/block-vmdk.c
===================================================================
--- xen-3.1-testing.orig/tools/blktap/drivers/block-vmdk.c
+++ xen-3.1-testing/tools/blktap/drivers/block-vmdk.c
@@ -283,8 +283,9 @@ static uint64_t get_cluster_offset(struc
         	if (!allocate)
             		return 0;
         	cluster_offset = lseek(prv->fd, 0, SEEK_END);
-        	ftruncate(prv->fd, cluster_offset + 
-			  (prv->cluster_sectors << 9));
+        	if (ftruncate(prv->fd, cluster_offset +
+			      (prv->cluster_sectors << 9)))
+			return 0;
         	cluster_offset >>= 9;
         	/* update L2 table */
         	tmp = cpu_to_le32(cluster_offset);
Index: xen-3.1-testing/tools/blktap/drivers/block-qcow.c
===================================================================
--- xen-3.1-testing.orig/tools/blktap/drivers/block-qcow.c
+++ xen-3.1-testing/tools/blktap/drivers/block-qcow.c
@@ -745,7 +745,10 @@ found:
 		}
 		memcpy(tmp_ptr2, l2_ptr, 4096);
 		lseek(s->fd, l2_offset + (l2_sector << 12), SEEK_SET);
-		write(s->fd, tmp_ptr2, 4096);
+		if (write(s->fd, tmp_ptr2, 4096) != 4096) {
+			free(tmp_ptr2);
+			return -1;
+		}
 		free(tmp_ptr2);
 	}
 	return cluster_offset;
@@ -868,7 +871,10 @@ int tdqcow_open (struct disk_driver *dd,
 	}
 
 	s->fd = fd;
-	asprintf(&s->name,"%s", name);
+	if (asprintf(&s->name,"%s", name) == -1) {
+		close(fd);
+		return -1;
+	}
 
 	ASSERT(sizeof(QCowHeader) + sizeof(QCowHeader_ext) < 512);
 
@@ -1162,7 +1168,7 @@ int tdqcow_close(struct disk_driver *dd)
 		offset = sizeof(QCowHeader) + sizeof(uint32_t);
 		lseek(fd, offset, SEEK_SET);
 		out = cpu_to_be32(cksum);
-		write(fd, &out, sizeof(uint32_t));
+		if (write(fd, &out, sizeof(uint32_t))) ;
 		close(fd);
 	}
 
@@ -1252,8 +1258,8 @@ int qcow_create(const char *filename, ui
 				strncpy(backing_filename, backing_file,
 					sizeof(backing_filename));
 			} else {
-				realpath(backing_file, backing_filename);
-				if (stat(backing_filename, &st) != 0) {
+				if (realpath(backing_file, backing_filename) == NULL ||
+				    stat(backing_filename, &st) != 0) {
 					return -1;
 				}
 			}
Index: xen-3.1-testing/tools/xenstore/utils.c
===================================================================
--- xen-3.1-testing.orig/tools/xenstore/utils.c
+++ xen-3.1-testing/tools/xenstore/utils.c
@@ -27,33 +27,38 @@ void xprintf(const char *fmt, ...)
 void barf(const char *fmt, ...)
 {
 	char *str;
+	int bytes;
 	va_list arglist;
 
 	xprintf("FATAL: ");
 
 	va_start(arglist, fmt);
-	vasprintf(&str, fmt, arglist);
+	bytes = vasprintf(&str, fmt, arglist);
 	va_end(arglist);
 
-	xprintf("%s\n", str);
-	free(str);
+ 	if (bytes >= 0) {
+		xprintf("%s\n", str);
+		free(str);
+	}
 	exit(1);
 }
 
 void barf_perror(const char *fmt, ...)
 {
 	char *str;
-	int err = errno;
+	int bytes, err = errno;
 	va_list arglist;
 
 	xprintf("FATAL: ");
 
 	va_start(arglist, fmt);
-	vasprintf(&str, fmt, arglist);
+	bytes = vasprintf(&str, fmt, arglist);
 	va_end(arglist);
 
-	xprintf("%s: %s\n", str, strerror(err));
-	free(str);
+ 	if (bytes >= 0) {
+		xprintf("%s: %s\n", str, strerror(err));
+		free(str);
+	}
 	exit(1);
 }
 
Index: xen-3.1-testing/tools/console/daemon/io.c
===================================================================
--- xen-3.1-testing.orig/tools/console/daemon/io.c
+++ xen-3.1-testing/tools/console/daemon/io.c
@@ -233,7 +233,10 @@ int xs_gather(struct xs_handle *xs, cons
 		void *result = va_arg(ap, void *);
 		char *p;
 
-		asprintf(&path, "%s/%s", dir, name);
+		if (asprintf(&path, "%s/%s", dir, name) == -1) {
+			ret = ENOMEM;
+			break;
+		}
 		p = xs_read(xs, XBT_NULL, path, NULL);
 		free(path);
 		if (p == NULL) {
Index: xen-3.1-testing/tools/blktap/lib/xenbus.c
===================================================================
--- xen-3.1-testing.orig/tools/blktap/lib/xenbus.c
+++ xen-3.1-testing/tools/blktap/lib/xenbus.c
@@ -360,8 +360,7 @@ int add_blockdevice_probe_watch(struct x
 	char *path;
 	struct xenbus_watch *vbd_watch;
 	
-	asprintf(&path, "/local/domain/%s/backend/tap", domid);
-	if (path == NULL) 
+	if (asprintf(&path, "/local/domain/%s/backend/tap", domid) == -1)
 		return -ENOMEM;
 	
 	vbd_watch = (struct xenbus_watch *)malloc(sizeof(struct xenbus_watch));
@@ -399,8 +398,7 @@ int watch_for_domid(struct xs_handle *h)
 	struct xenbus_watch *domid_watch;
 	char *path = NULL;
 
-	asprintf(&path, "/local/domain");
-	if (path == NULL) 
+	if (asprintf(&path, "/local/domain") == -1)
 		return -ENOMEM;
 
 	domid_watch = malloc(sizeof(struct xenbus_watch));
Index: xen-3.1-testing/tools/blktap/lib/xs_api.c
===================================================================
--- xen-3.1-testing.orig/tools/blktap/lib/xs_api.c
+++ xen-3.1-testing/tools/blktap/lib/xs_api.c
@@ -126,10 +126,12 @@ int xs_printf(struct xs_handle *h, const
 	ret = vasprintf(&buf, fmt, ap);
 	va_end(ap);
 	
-	asprintf(&path, "%s/%s", dir, node);
-	
-	if ((path == NULL) || (buf == NULL))
-		return 0;
+	if (ret == -1)
+		return ENOMEM;
+	if (asprintf(&path, "%s/%s", dir, node) == -1) {
+		free(buf);
+		return ENOMEM;
+	}
 
 	ret = xs_write(h, XBT_NULL, path, buf, strlen(buf)+1);
 	
@@ -180,10 +182,11 @@ char *get_dom_domid(struct xs_handle *h)
 	
 	e = xs_directory(h, xth, "/local/domain", &num);
 	if (e == NULL)
-		return NULL;
+		goto done;
 
 	for (i = 0; (i < num) && (domid == NULL); i++) {
-		asprintf(&path, "/local/domain/%s/name", e[i]);
+		if (asprintf(&path, "/local/domain/%s/name", e[i]) == -1)
+			break;
 		val = xs_read(h, xth, path, &len);
 		free(path);
 		if (val == NULL)
@@ -191,29 +194,31 @@ char *get_dom_domid(struct xs_handle *h)
 		
 		if (strcmp(val, DOMNAME) == 0) {
 			/* match! */
-			asprintf(&path, "/local/domain/%s/domid", e[i]);
+			if (asprintf(&path, "/local/domain/%s/domid", e[i]) == -1) {
+				free(val);
+				break;
+			}
 			domid = xs_read(h, xth, path, &len);
 			free(path);
 		}
 		free(val);
 	}
+done:
 	xs_transaction_end(h, xth, 0);
-	
-	free(e);
+	if (e)
+		free(e);
 	return domid;
 }
 
 int convert_dev_name_to_num(char *name) {
-	char *p_sd, *p_hd, *p_xvd, *p_plx, *p, *alpha,*ptr;
+	char *p, *ptr;
 	int majors[10] = {3,22,33,34,56,57,88,89,90,91};
 	int maj,i,ret = 0;
-
-	asprintf(&p_sd,"/dev/sd");
-	asprintf(&p_hd,"/dev/hd");
-	asprintf(&p_xvd,"/dev/xvd");
-	asprintf(&p_plx,"plx");
-	asprintf(&alpha,"abcdefghijklmnop");
-	
+	char *p_sd = "/dev/sd";
+	char *p_hd = "/dev/hd";
+	char *p_xvd = "/dev/xvd";
+	char *p_plx = "plx";
+	char *alpha = "abcdefghijklmnop";
 
 	if (strstr(name, p_sd) != NULL) {
 		p = name + strlen(p_sd);
@@ -251,12 +256,6 @@ int convert_dev_name_to_num(char *name) 
 		ret = BASE_DEV_VAL;
 	}
 
-	free(p_sd);
-	free(p_hd);
-	free(p_xvd);
-	free(p_plx);
-	free(alpha);
-
 	return ret;
 }
 
Index: xen-3.1-testing/tools/blktap/drivers/tapdisk.c
===================================================================
--- xen-3.1-testing.orig/tools/blktap/drivers/tapdisk.c
+++ xen-3.1-testing/tools/blktap/drivers/tapdisk.c
@@ -220,7 +220,8 @@ static int map_new_dev(struct td_state *
 	fd_list_entry_t *ptr;
 	int page_size;
 
-	asprintf(&devname,"%s/%s%d", BLKTAP_DEV_DIR, BLKTAP_DEV_NAME, minor);
+	if (asprintf(&devname,"%s/%s%d", BLKTAP_DEV_DIR, BLKTAP_DEV_NAME, minor) == -1)
+		return -1;
 	tap_fd = open(devname, O_RDWR);
 	if (tap_fd == -1) 
 	{
Index: xen-3.1-testing/tools/libxc/xc_core.c
===================================================================
--- xen-3.1-testing.orig/tools/libxc/xc_core.c
+++ xen-3.1-testing/tools/libxc/xc_core.c
@@ -156,7 +156,7 @@ struct xc_core_section_headers {
     Elf64_Shdr  *shdrs;
 };
 #define SHDR_INIT       16
-#define SHDR_INC        4
+#define SHDR_INC        4U
 
 static struct xc_core_section_headers*
 xc_core_shdr_init(void)
Index: xen-3.1-testing/tools/libxc/xc_dom_elfloader.c
===================================================================
--- xen-3.1-testing.orig/tools/libxc/xc_dom_elfloader.c
+++ xen-3.1-testing/tools/libxc/xc_dom_elfloader.c
@@ -195,8 +195,9 @@ static int xc_dom_load_elf_symtab(struct
 
             if ( load )
             {
+                void * dst = (void*)elf_section_start(&syms, shdr);
                 shdr2 = elf_shdr_by_index(elf, h);
-                memcpy((void*)elf_section_start(&syms, shdr),
+                memcpy(dst,
                        elf_section_start(elf, shdr2),
                        size);
             }