Index: tpm2-tools-4.1/lib/tpm2_hash.c
===================================================================
--- tpm2-tools-4.1.orig/lib/tpm2_hash.c
+++ tpm2-tools-4.1/lib/tpm2_hash.c
@@ -14,7 +14,7 @@ static tool_rc tpm2_hash_common(ESYS_CON
         UINT16 inbuffer_len, TPM2B_DIGEST **result,
         TPMT_TK_HASHCHECK **validation) {
     bool use_left, done;
-    unsigned long left;
+    unsigned long left = 0;
     size_t bytes_read;
     TPM2B_AUTH null_auth = TPM2B_EMPTY_INIT;
     TPMI_DH_OBJECT sequence_handle;
Index: tpm2-tools-4.1/lib/tpm2_attr_util.c
===================================================================
--- tpm2-tools-4.1.orig/lib/tpm2_attr_util.c
+++ tpm2-tools-4.1/lib/tpm2_attr_util.c
@@ -202,7 +202,7 @@ static bool lookup_nt_friendly_name(cons
 
 static bool nt(TPMA_NV *nv, char *arg) {
 
-    uint16_t value;
+    uint16_t value = 0;
     bool result = tpm2_util_string_to_uint16(arg, &value);
     if (!result) {
         result = lookup_nt_friendly_name(arg, &value);
Index: tpm2-tools-4.1/tools/tpm2_policytemplate.c
===================================================================
--- tpm2-tools-4.1.orig/tools/tpm2_policytemplate.c
+++ tpm2-tools-4.1/tools/tpm2_policytemplate.c
@@ -23,7 +23,7 @@ static tpm2_policytemplate_ctx ctx;
 
 static bool process_input_template_hash(char *value) {
 
-    ctx.template_hash.size = UINT16_MAX;
+    ctx.template_hash.size = sizeof(ctx.template_hash.buffer);
     bool result = files_load_bytes_from_buffer_or_file_or_stdin(NULL, value,
             &ctx.template_hash.size, ctx.template_hash.buffer);
     if (!result) {
Index: tpm2-tools-4.1/tools/tpm2_policynamehash.c
===================================================================
--- tpm2-tools-4.1.orig/tools/tpm2_policynamehash.c
+++ tpm2-tools-4.1/tools/tpm2_policynamehash.c
@@ -23,7 +23,7 @@ static tpm2_policynamehash_ctx ctx;
 
 static bool process_input_name_hash(char *value) {
 
-    ctx.name_hash.size = UINT16_MAX;
+    ctx.name_hash.size = sizeof(ctx.name_hash.buffer);
     bool result = files_load_bytes_from_buffer_or_file_or_stdin(NULL, value,
             &ctx.name_hash.size, ctx.name_hash.buffer);
     if (!result) {