diff --git a/clamav-milter/clamav-milter.c b/clamav-milter/clamav-milter.c
index 9c2c8677fe..68b89ac799 100644
--- a/clamav-milter/clamav-milter.c
+++ b/clamav-milter/clamav-milter.c
@@ -178,8 +178,8 @@ int main(int argc, char **argv)
         char myname[255];
 
         if (((opt = optget(opts, "ReportHostname"))->enabled &&
-             strncpy(myname, opt->strarg, sizeof(myname))) ||
-            !gethostname(myname, sizeof(myname))) {
+             strncpy(myname, opt->strarg, sizeof(myname) - 1)) ||
+            !gethostname(myname, sizeof(myname) - 1)) {
 
             myname[sizeof(myname) - 1] = '\0';
             snprintf(xvirushdr, sizeof(xvirushdr), "clamav-milter %s at %s",
diff --git a/clamav-milter/clamfi.c b/clamav-milter/clamfi.c
index e84c49c6d4..417437d14f 100644
--- a/clamav-milter/clamfi.c
+++ b/clamav-milter/clamfi.c
@@ -61,7 +61,7 @@ static sfsistat (*InfectedAction)(SMFICTX *ctx);
 static char *rejectfmt = NULL;
 
 int addxvirus = 0; /* 0 - don't add | 1 - replace | 2 - add */
-char xvirushdr[255];
+char xvirushdr[300];
 char *viraction = NULL;
 int multircpt   = 1;
 
diff --git a/clamav-milter/clamfi.h b/clamav-milter/clamfi.h
index 61e18fbef8..08134277e1 100644
--- a/clamav-milter/clamfi.h
+++ b/clamav-milter/clamfi.h
@@ -27,7 +27,7 @@
 
 extern uint64_t maxfilesize;
 extern int addxvirus;
-extern char xvirushdr[255];
+extern char xvirushdr[300];
 extern int multircpt;
 
 sfsistat clamfi_body(SMFICTX *ctx, unsigned char *bodyp, size_t len);
diff --git a/clamonacc/client/client.c b/clamonacc/client/client.c
index e4ca3d0c02..9055f7de1e 100644
--- a/clamonacc/client/client.c
+++ b/clamonacc/client/client.c
@@ -406,7 +406,6 @@ cl_error_t onas_setup_client(struct onas_context **ctx)
 {
 
     const struct optstruct *opts;
-    const struct optstruct *opt;
     cl_error_t err;
     int remote;
 
diff --git a/examples/ex_cl_cvdunpack.c b/examples/ex_cl_cvdunpack.c
index 5097949703..88e0c3cb74 100644
--- a/examples/ex_cl_cvdunpack.c
+++ b/examples/ex_cl_cvdunpack.c
@@ -41,22 +41,12 @@
  */
 int main(int argc, char **argv)
 {
-    int fd;
     cl_error_t ret;
 
     const char *filename;
     const char *destination_directory;
     bool dont_verify = false;
 
-    char dest_buff[1024];
-
-    unsigned long int size = 0;
-    unsigned int sigs      = 0;
-    long double mb;
-    const char *virname;
-    struct cl_engine *engine;
-    struct cl_scan_options options;
-
     switch (argc) {
         case 2:
             filename              = argv[1];
diff --git a/examples/ex_file_inspection_callback.c b/examples/ex_file_inspection_callback.c
index 111f07b917..e8d9457908 100644
--- a/examples/ex_file_inspection_callback.c
+++ b/examples/ex_file_inspection_callback.c
@@ -94,6 +94,9 @@ cl_error_t post_callback(
     const char *virname,
     void *context) // Could be used to retrieve / store contextual information for app
 {
+    (void)fd;
+    (void)context;
+
     printf("result:             %d\n", result);
     printf("virname:            %s\n", virname);
     printf("\n\n");
@@ -120,7 +123,7 @@ int main(int argc, char **argv)
     long double mb;
     const char *virname;
     const char *filename;
-    struct cl_engine *engine;
+    struct cl_engine *engine = NULL;
     struct cl_scan_options options;
     char database_filepath[256];
     bool created_database = false;
diff --git a/examples/ex_prescan_callback.c b/examples/ex_prescan_callback.c
index 62901e60d6..25392c6ea0 100644
--- a/examples/ex_prescan_callback.c
+++ b/examples/ex_prescan_callback.c
@@ -76,7 +76,7 @@ int main(int argc, char **argv)
     long double mb;
     const char *virname;
     const char *filename;
-    struct cl_engine *engine;
+    struct cl_engine *engine = NULL;
     struct cl_scan_options options;
 
     if (argc != 2) {
diff --git a/libclamav/bytecode_api.c b/libclamav/bytecode_api.c
index 49a35ee83c..54a36045ac 100644
--- a/libclamav/bytecode_api.c
+++ b/libclamav/bytecode_api.c
@@ -2315,7 +2315,7 @@ int32_t cli_bcapi_json_get_string(struct cli_bc_ctx *ctx, int8_t *str, int32_t s
         return str_len;
     } else {
         /* limit on len+1 */
-        strncpy((char *)str, jstr, len);
+        memcpy((char *)str, jstr, len);
         str[len] = '\0';
         return len + 1;
     }
diff --git a/libclamav/bytecode_vm.c b/libclamav/bytecode_vm.c
index 26a9309b17..1452c64789 100644
--- a/libclamav/bytecode_vm.c
+++ b/libclamav/bytecode_vm.c
@@ -388,6 +388,8 @@ static always_inline struct stack_entry *pop_stack(struct stack *stack,
         READ1(op1, BINOP(1));                               \
         sop0 = op0;                                         \
         sop1 = op1;                                         \
+        (void)sop0;                                         \
+        (void)sop1;                                         \
         OP;                                                 \
         W0(inst->dest, res);                                \
         break;                                              \
@@ -399,6 +401,8 @@ static always_inline struct stack_entry *pop_stack(struct stack *stack,
         READ8(op1, BINOP(1));                               \
         sop0 = op0;                                         \
         sop1 = op1;                                         \
+        (void)sop0;                                         \
+        (void)sop1;                                         \
         OP;                                                 \
         W1(inst->dest, res);                                \
         break;                                              \
@@ -410,6 +414,8 @@ static always_inline struct stack_entry *pop_stack(struct stack *stack,
         READ16(op1, BINOP(1));                              \
         sop0 = op0;                                         \
         sop1 = op1;                                         \
+        (void)sop0;                                         \
+        (void)sop1;                                         \
         OP;                                                 \
         W2(inst->dest, res);                                \
         break;                                              \
@@ -421,6 +427,8 @@ static always_inline struct stack_entry *pop_stack(struct stack *stack,
         READ32(op1, BINOP(1));                              \
         sop0 = op0;                                         \
         sop1 = op1;                                         \
+        (void)sop0;                                         \
+        (void)sop1;                                         \
         OP;                                                 \
         W3(inst->dest, res);                                \
         break;                                              \
@@ -432,6 +440,8 @@ static always_inline struct stack_entry *pop_stack(struct stack *stack,
         READ64(op1, BINOP(1));                              \
         sop0 = op0;                                         \
         sop1 = op1;                                         \
+        (void)sop0;                                         \
+        (void)sop1;                                         \
         OP;                                                 \
         W4(inst->dest, res);                                \
         break;                                              \
@@ -534,6 +544,24 @@ static always_inline struct stack_entry *pop_stack(struct stack *stack,
         break;                                                                    \
     }
 
+#define DEFINE_OP_BC_RET_VOID(OP, T)                                              \
+    case OP: {                                                                    \
+        operand_t ret;                                                            \
+        CHECK_GT(stack_depth, 0);                                                 \
+        stack_depth--;                                                            \
+        stack_entry = pop_stack(&stack, stack_entry, &func, &ret, &bb,            \
+                                &bb_inst);                                        \
+        values      = stack_entry ? stack_entry->values : ctx->values;            \
+        CHECK_GT(func->numBytes, ret);                                            \
+        if (!bb) {                                                                \
+            stop = CL_BREAK;                                                      \
+            continue;                                                             \
+        }                                                                         \
+        stackid = ptr_register_stack(&ptrinfos, values, 0, func->numBytes) >> 32; \
+        inst    = &bb->insts[bb_inst];                                            \
+        break;                                                                    \
+    }
+
 struct ptr_info {
     uint8_t *base;
     uint32_t size;
@@ -797,11 +825,11 @@ cl_error_t cli_vm_execute(const struct cli_bc *bc, struct cli_bc_ctx *ctx, const
             DEFINE_OP_BC_RET_N(OP_BC_RET * 5 + 3, uint32_t, READ32, WRITE32);
             DEFINE_OP_BC_RET_N(OP_BC_RET * 5 + 4, uint64_t, READ64, WRITE64);
 
-            DEFINE_OP_BC_RET_N(OP_BC_RET_VOID * 5, uint8_t, (void), (void));
-            DEFINE_OP_BC_RET_N(OP_BC_RET_VOID * 5 + 1, uint8_t, (void), (void));
-            DEFINE_OP_BC_RET_N(OP_BC_RET_VOID * 5 + 2, uint8_t, (void), (void));
-            DEFINE_OP_BC_RET_N(OP_BC_RET_VOID * 5 + 3, uint8_t, (void), (void));
-            DEFINE_OP_BC_RET_N(OP_BC_RET_VOID * 5 + 4, uint8_t, (void), (void));
+            DEFINE_OP_BC_RET_VOID(OP_BC_RET_VOID * 5, uint8_t);
+            DEFINE_OP_BC_RET_VOID(OP_BC_RET_VOID * 5 + 1, uint8_t);
+            DEFINE_OP_BC_RET_VOID(OP_BC_RET_VOID * 5 + 2, uint8_t);
+            DEFINE_OP_BC_RET_VOID(OP_BC_RET_VOID * 5 + 3, uint8_t);
+            DEFINE_OP_BC_RET_VOID(OP_BC_RET_VOID * 5 + 4, uint8_t);
 
             DEFINE_ICMPOP(OP_BC_ICMP_EQ, res = (op0 == op1));
             DEFINE_ICMPOP(OP_BC_ICMP_NE, res = (op0 != op1));
diff --git a/libclamav/crtmgr.c b/libclamav/crtmgr.c
index 51c681deea..9ed1cd29f3 100644
--- a/libclamav/crtmgr.c
+++ b/libclamav/crtmgr.c
@@ -394,11 +394,11 @@ static cl_error_t crtmgr_get_recov_data(BIGNUM *sig, cli_crt *x509,
                                         uint8_t **buffer, uint8_t **payload,
                                         int *payload_len)
 {
-    BN_CTX *bnctx;
+    BN_CTX *bnctx = NULL;
     int pad_size;
     int keylen;
-    uint8_t *d;
-    BIGNUM *x;
+    uint8_t *d = NULL;
+    BIGNUM *x = NULL;
     cl_error_t ret;
 
     *buffer      = NULL;
diff --git a/libclamav/disasm.c b/libclamav/disasm.c
index 91274d77aa..54c3f0f38b 100644
--- a/libclamav/disasm.c
+++ b/libclamav/disasm.c
@@ -1316,9 +1316,11 @@ static const uint8_t *disasm_x86(const uint8_t *command, unsigned int len, struc
                     switch (x87_st[table][rm].args) {
                         case X87_S:
                             reversed = 1;
+                            /* fall-through */
                         case X87_R:
                             s->args[reversed ^ 1].access = ACCESS_REG;
                             s->args[reversed ^ 1].reg    = X86_REG_ST0;
+                            /* fall-through */
                         case X87_ONE:
                             s->args[reversed].access = ACCESS_REG;
                             s->args[reversed].reg    = X86_REG_ST0 + (rm & 7);
@@ -1403,11 +1405,13 @@ static const uint8_t *disasm_x86(const uint8_t *command, unsigned int len, struc
                     case ADDR_REG_SS:
                     case ADDR_REG_DS:
                         assert(x86ops[table][s->table_op].dsize == SIZE_WORD);
+                        /* fall-through */
                     case ADDR_REG_ESP:
                     case ADDR_REG_EBP:
                     case ADDR_REG_ESI:
                     case ADDR_REG_EDI:
                         assert(x86ops[table][s->table_op].dsize != SIZE_BYTE && x86ops[table][s->table_op].dsize != SIZE_BYTEH);
+                        /* fall-through */
                     case ADDR_REG_EAX:
                     case ADDR_REG_ECX:
                     case ADDR_REG_EDX:
@@ -1453,6 +1457,7 @@ static const uint8_t *disasm_x86(const uint8_t *command, unsigned int len, struc
                     case ADDR_MRM_GEN_CR:
                     case ADDR_MRM_GEN_DR:
                         reversed = 1;
+                        /* fall-through */
 
                     case ADDR_MRM_GEN_EG:
                     case ADDR_MRM_GEN_ES:
@@ -1500,8 +1505,10 @@ static const uint8_t *disasm_x86(const uint8_t *command, unsigned int len, struc
                                 break;
                             case SIZE_WD:
                                 s->args[reversed].size += (s->opsize == 0);
+                                /* fall-through */
                             case SIZE_WORD:
                                 s->args[reversed].size++;
+                                /* fall-through */
                             case SIZE_BYTE:
                                 break;
                             default:
@@ -1743,6 +1750,7 @@ const uint8_t *cli_disasm_one(const uint8_t *buff, unsigned int len,
                 break;
             case ACCESS_REG:
                 w->arg[i][1] = s.args[i].reg;
+                /* fall-through */
             default:
                 cli_writeint32(&w->arg[i][2], s.args[i].arg.q);
                 cli_writeint32(&w->arg[i][6], s.args[i].arg.q >> 32);
diff --git a/libclamav/dsig.c b/libclamav/dsig.c
index 6daec42939..a587f8ed44 100644
--- a/libclamav/dsig.c
+++ b/libclamav/dsig.c
@@ -86,7 +86,7 @@ static unsigned char *cli_decodesig(const char *sig, unsigned int plen, BIGNUM *
     int i, slen = strlen(sig), dec;
     unsigned char *plain = NULL, *ret_sig = NULL;
     BIGNUM *r = NULL, *p = NULL, *c = NULL;
-    BN_CTX *bn_ctx;
+    BN_CTX *bn_ctx = NULL;
     unsigned int bn_bytes;
     ;
 
@@ -331,7 +331,8 @@ cl_error_t cli_versig(const char *md5, const char *dsig)
 #define BLK_LEN (PAD_LEN - HASH_LEN - 1)
 int cli_versig2(const unsigned char *sha256, const char *dsig_str, const char *n_str, const char *e_str)
 {
-    unsigned char *decoded, digest1[HASH_LEN], digest2[HASH_LEN], digest3[HASH_LEN], *salt;
+    unsigned char *decoded = NULL;
+    unsigned char digest1[HASH_LEN], digest2[HASH_LEN], digest3[HASH_LEN], *salt;
     unsigned char mask[BLK_LEN], data[BLK_LEN], final[8 + 2 * HASH_LEN], c[4];
     unsigned int i, rounds;
     void *ctx;
@@ -360,8 +361,8 @@ int cli_versig2(const unsigned char *sha256, const char *dsig_str, const char *n
     }
 
     if (decoded[PAD_LEN - 1] != 0xbc) {
-        free(decoded);
         ret = CL_EVERIFY;
+        goto done;
     }
     BN_free(n);
     BN_free(e);
@@ -372,6 +373,7 @@ int cli_versig2(const unsigned char *sha256, const char *dsig_str, const char *n
     memcpy(mask, decoded, BLK_LEN);
     memcpy(digest2, &decoded[BLK_LEN], HASH_LEN);
     free(decoded);
+    decoded = NULL;
 
     c[0] = c[1] = 0;
     rounds      = (BLK_LEN + HASH_LEN - 1) / HASH_LEN;
@@ -417,6 +419,7 @@ int cli_versig2(const unsigned char *sha256, const char *dsig_str, const char *n
     return memcmp(digest1, digest2, HASH_LEN) ? CL_EVERIFY : CL_SUCCESS;
 
 done:
+    free(decoded);
     BN_free(n);
     BN_free(e);
     return ret;
diff --git a/libclamav/explode.c b/libclamav/explode.c
index 6a2c8b7b59..0cb8efe65e 100644
--- a/libclamav/explode.c
+++ b/libclamav/explode.c
@@ -198,8 +198,8 @@ int explode_init(struct xplstate *X, uint16_t flags)
         }                                                                 \
     }
 
-#define GETCODES(CASE, WHICH, HOWMANY)                                        \
-    case CASE: {                                                              \
+#define GETCODES(WHICH, HOWMANY)                                              \
+    {                                                                         \
         if (!X->avail_in) return EXPLODE_EBUFF;                               \
         if (!X->got)                                                          \
             need = *X->next_in;                                               \
@@ -227,6 +227,7 @@ int explode_init(struct xplstate *X, uint16_t flags)
 
 #define SETCASE(CASE)         \
     X->state = (CASE);        \
+    /* fall-through */        \
     case (CASE): { /* FAKE */ \
     }
 
@@ -236,14 +237,19 @@ int explode(struct xplstate *X)
     int temp = -1;
 
     switch (X->state) {
-        /* grab compressed coded literals, if present */
-        GETCODES(GRABLITS, lit_tree, 256);
-        /* grab compressed coded lens */
-        GETCODES(GRABLENS, len_tree, 64);
-        /* grab compressed coded dists */
-        GETCODES(GRABDISTS, dist_tree, 64);
+        case GRABLITS: { /* grab compressed coded literals, if present */
+            GETCODES(lit_tree, 256);
+        } /* fall-through */
 
-        case EXPLODE:
+        case GRABLENS: { /* grab compressed coded lens */
+            GETCODES(len_tree, 64);
+        } /* fall-through */
+
+        case GRABDISTS: { /* grab compressed coded dists */
+            GETCODES(dist_tree, 64);
+        } /* fall-through */
+
+        case EXPLODE: {
             while (X->avail_in || X->bits) {
                 GETBIT; /* can't fail */
                 if (val) {
@@ -315,6 +321,7 @@ int explode(struct xplstate *X)
                 }
                 X->state = EXPLODE;
             }
+        }
     }
     return EXPLODE_EBUFF;
 }
diff --git a/libclamav/filtering.c b/libclamav/filtering.c
index 2b27b523f1..7cc5701c72 100644
--- a/libclamav/filtering.c
+++ b/libclamav/filtering.c
@@ -210,7 +210,7 @@ int filter_add_static(struct filter *m, const unsigned char *pattern, unsigned l
     for (j = 0; (best < 100 && j < MAX_CHOICES) || (j < maxlen); j++) {
         uint32_t num = MAXSOPATLEN;
         uint8_t k;
-        if (j + 2 > len)
+        if ((unsigned long)(j + 2) > len)
             break;
         for (k = j; k < len - 1 && (k - j < MAXSOPATLEN); k++) {
             q = cli_readint16(&pattern[k]);
@@ -323,7 +323,7 @@ enum badness {
 };
 static inline void get_score(enum badness badness, unsigned i, const struct filter *m, const struct char_spec *spec0, const struct char_spec *spec1, int32_t *score, int32_t *score_end)
 {
-    int32_t base;
+    int32_t base = 0;
     unsigned k0, k1, num_introduced = 0, num_end_introduced = 0;
     switch (badness) {
         case reject:
diff --git a/libclamav/hwp.c b/libclamav/hwp.c
index bb996e717b..520d4d1322 100644
--- a/libclamav/hwp.c
+++ b/libclamav/hwp.c
@@ -1525,7 +1525,7 @@ static inline cl_error_t parsehwp3_infoblk_1(cli_ctx *ctx, fmap_t *dmap, size_t
     char field[HWP3_FIELD_LENGTH];
 #endif
 #if HAVE_JSON
-    json_object *infoblk_1, *contents, *counter, *entry;
+    json_object *infoblk_1, *contents = NULL, *counter, *entry = NULL;
 #endif
 
     hwp3_debug("HWP3.x: Information Block @ offset %llu\n", infoloc);
@@ -1757,7 +1757,7 @@ static cl_error_t hwp3_cb(void *cbdata, int fd, const char *filepath, cli_ctx *c
     int i, p = 0, last = 0;
     uint16_t nstyles;
 #if HAVE_JSON
-    json_object *fonts;
+    json_object *fonts = NULL;
 #endif
 
     UNUSEDPARAM(filepath);
diff --git a/libclamav/inflate64.c b/libclamav/inflate64.c
index 9ea6776e61..903aba9b8e 100644
--- a/libclamav/inflate64.c
+++ b/libclamav/inflate64.c
@@ -1,9 +1,9 @@
-/* 
+/*
  * This file contains code from zlib library v.1.2.3 with modifications
  * by aCaB <acab@clamav.net> to allow decompression of deflate64 streams
  * (aka zip method 9). The implementation is heavily inspired by InfoZip
  *  and zlib's inf9back.c
- * 
+ *
  * Full copy of the original zlib license follows:
  */
 
@@ -439,11 +439,13 @@ int flush;
             strm->adler = state->check = REVERSE(hold);
             INITBITS();
             state->mode = DICT;
+            /* fall-through */
         case DICT:
             RESTORE();
             return Z_NEED_DICT;
         case TYPE:
             if (flush == Z_BLOCK) goto inf_leave;
+            /* fall-through */
         case TYPEDO:
             if (state->last) {
                 BYTEBITS();
@@ -487,6 +489,7 @@ int flush;
                     state->length));
             INITBITS();
             state->mode = COPY;
+            /* fall-through */
         case COPY:
             copy = state->length;
             if (copy) {
@@ -611,6 +614,7 @@ int flush;
             }
             Tracev((stderr, "inflate:       codes ok\n"));
             state->mode = LEN;
+            /* fall-through */
         case LEN:
 		/*            if (have >= 6 && left >= 258) {
                 RESTORE();
@@ -654,6 +658,7 @@ int flush;
             }
             state->extra = (unsigned)(this.op) & 31;
             state->mode = LENEXT;
+            /* fall-through */
         case LENEXT:
             if (state->extra) {
                 NEEDBITS(state->extra);
@@ -662,6 +667,7 @@ int flush;
             }
             Tracevv((stderr, "inflate:         length %u\n", state->length));
             state->mode = DIST;
+            /* fall-through */
         case DIST:
             for (;;) {
                 this = state->distcode[BITS(state->distbits)];
@@ -687,6 +693,7 @@ int flush;
             state->offset = (unsigned)this.val;
             state->extra = (unsigned)(this.op) & 15;
             state->mode = DISTEXT;
+            /* fall-through */
         case DISTEXT:
             if (state->extra) {
                 NEEDBITS(state->extra);
@@ -705,6 +712,7 @@ int flush;
             }
             Tracevv((stderr, "inflate:         distance %u\n", state->offset));
             state->mode = MATCH;
+            /* fall-through */
         case MATCH:
             if (left == 0) goto inf_leave;
             copy = out - left;
@@ -755,6 +763,7 @@ int flush;
                 Tracev((stderr, "inflate:   check matches trailer\n"));
             }
             state->mode = DONE;
+            /* fall-through */
         case DONE:
             ret = Z_STREAM_END;
             goto inf_leave;
diff --git a/libclamav/jpeg.c b/libclamav/jpeg.c
index 2baa8720bc..6f3214329c 100644
--- a/libclamav/jpeg.c
+++ b/libclamav/jpeg.c
@@ -314,7 +314,7 @@ cl_error_t cli_parsejpeg(cli_ctx *ctx)
     cl_error_t status = CL_SUCCESS;
 
     fmap_t *map = NULL;
-    jpeg_marker_t marker, prev_marker, prev_segment = JPEG_MARKER_NOT_A_MARKER_0x00;
+    jpeg_marker_t marker = JPEG_MARKER_NOT_A_MARKER_0x00, prev_marker, prev_segment = JPEG_MARKER_NOT_A_MARKER_0x00;
     uint8_t buff[50]; /* 50 should be sufficient for now */
     uint16_t len_u16;
     unsigned int offset = 0, i, len, segment = 0;
diff --git a/libclamav/libmspack.c b/libclamav/libmspack.c
index b64104d14a..edd90d42b2 100644
--- a/libclamav/libmspack.c
+++ b/libclamav/libmspack.c
@@ -290,7 +290,7 @@ static void mspack_fmap_message(struct mspack_file *file, const char *fmt, ...)
         memset(buff, 0, BUFSIZ);
 
         /* Add the prefix */
-        strncpy(buff, "LibClamAV debug: ", len);
+        memcpy(buff, "LibClamAV debug: ", len);
 
         va_start(args, fmt);
         vsnprintf(buff + len, sizeof(buff) - len - 2, fmt, args);
diff --git a/libclamav/mew.c b/libclamav/mew.c
index 020af59de4..1808cc6d9d 100644
--- a/libclamav/mew.c
+++ b/libclamav/mew.c
@@ -340,7 +340,7 @@ int mew_lzma(char *orgsource, const char *buf, uint32_t size_sum, uint32_t vma,
     uint32_t new_eax, new_edx, temp;
     int i, mainloop;
 
-    char var1, var30;
+    char var1;
     const char *source = buf;
     char *dest, *new_ebx;
     const char *new_ecx, *var0C_ecxcopy;
@@ -621,7 +621,6 @@ int mew_lzma(char *orgsource, const char *buf, uint32_t size_sum, uint32_t vma,
                     t       = *(var18 + new_eax);
                     new_eax = (new_eax & 0xffffff00) | t;
 
-                    var30 = t;
                     if (lzma_48635C(t, &new_ecx, &var40, &new_eax, orgsource, size_sum) == 0xffffffff)
                         return -1;
                     var20 = 0;
diff --git a/libclamav/nsis/infblock.c b/libclamav/nsis/infblock.c
index c1ad0277fe..2de3716394 100644
--- a/libclamav/nsis/infblock.c
+++ b/libclamav/nsis/infblock.c
@@ -1,12 +1,12 @@
 /*
  * This file is a part of the zlib compression module for NSIS.
- * 
+ *
  * Copyright and license information can be found below.
  * Modifications Copyright (C) 1999-2007 Nullsoft and Contributors
- * 
+ *
  * The original zlib source code is available at
  * http://www.zlib.net/
- * 
+ *
  * This software is provided 'as-is', without any express or implied
  * warranty.
  */
@@ -382,7 +382,7 @@ int ZEXPORT nsis_inflate(nsis_z_streamp z)
             {
               int _k;              /* temporary variable */
               uInt f = 0;         /* number of hufts used in fixed_mem */
-              
+
               /* literal table */
               for (_k = 0; _k < 288; _k++)
               {
@@ -574,11 +574,14 @@ int ZEXPORT nsis_inflate(nsis_z_streamp z)
 #define f (_state.f)
 
     /* waiting for "i:"=input, "o:"=output, "x:"=nothing */
+    /* fall-through */
 
     case CODES_START:         /* x: set up for LEN */
       c->sub.code.need = c->lbits;
       c->sub.code.tree = c->ltree;
       s->mode = CODES_LEN;
+      /* fall-through */
+
     case CODES_LEN:           /* i: get length/literal/eob next */
       t = c->sub.code.need;
       NEEDBITS(t)
@@ -618,6 +621,8 @@ int ZEXPORT nsis_inflate(nsis_z_streamp z)
       c->sub.code.need = c->dbits;
       c->sub.code.tree = c->dtree;
       s->mode = CODES_DIST;
+      /* fall-through */
+
     case CODES_DIST:          /* i: get distance next */
       t = c->sub.code.need;
       NEEDBITS(t)
@@ -644,6 +649,8 @@ int ZEXPORT nsis_inflate(nsis_z_streamp z)
       c->sub.copy.dist += (uInt)b & (uInt)inflate_mask[t];
       DUMPBITS(t)
       s->mode = CODES_COPY;
+      /* fall-through */
+
     case CODES_COPY:          /* o: copying bytes in window, waiting for space */
       f = (uInt)(q - s->window) < c->sub.copy.dist ?
           s->end - (c->sub.copy.dist - (q - s->window)) :
@@ -665,7 +672,7 @@ int ZEXPORT nsis_inflate(nsis_z_streamp z)
       s->mode = CODES_START;
       break;
     case CODES_WASH:          /* o: got eob, possibly more output */
-      if (k > 7)        /* return unused byte, if any */
+      if (k > 7)
       {
         k -= 8;
         n++;
@@ -676,6 +683,7 @@ int ZEXPORT nsis_inflate(nsis_z_streamp z)
 #undef j
 #undef e
 #undef f
+      /* fall-through */
 
     case DRY:
       FLUSH
diff --git a/libclamav/others_common.c b/libclamav/others_common.c
index 5041eb073e..fbbf23068a 100644
--- a/libclamav/others_common.c
+++ b/libclamav/others_common.c
@@ -142,7 +142,7 @@ void cl_set_clcb_msg(clcb_msg callback)
     va_list args;                                         \
     size_t len = sizeof(x) - 1;                           \
     char buff[MSGBUFSIZ];                                 \
-    strncpy(buff, x, len);                                \
+    memcpy(buff, x, len);                                 \
     va_start(args, str);                                  \
     vsnprintf(buff + len, sizeof(buff) - len, str, args); \
     va_end(args)
diff --git a/libclamav/pe.c b/libclamav/pe.c
index 688129d870..1aa2002ec8 100644
--- a/libclamav/pe.c
+++ b/libclamav/pe.c
@@ -3440,7 +3440,7 @@ int cli_scanpe(cli_ctx *ctx)
                   ) ||
                  (                                                                                                         /* upack 1.1/1.2, based on 2 samples */
                   epbuff[0] == '\xbe' && cli_readint32(epbuff + 1) - EC32(peinfo->pe_opt.opt32.ImageBase) < peinfo->min && /* mov esi */
-                  cli_readint32(epbuff + 1) > EC32(peinfo->pe_opt.opt32.ImageBase) &&
+                  cli_readint32(epbuff + 1) > (int32_t)EC32(peinfo->pe_opt.opt32.ImageBase) &&
                   epbuff[5] == '\xad' && epbuff[6] == '\x8b' && epbuff[7] == '\xf8' /* loads;  mov edi, eax */
                   )))) {
             uint32_t vma, off;
@@ -4508,7 +4508,7 @@ cl_error_t cli_peheader(fmap_t *map, struct cli_exe_info *peinfo, uint32_t opts,
     uint32_t stored_opt_hdr_size;
     struct pe_image_file_hdr *file_hdr;
     struct pe_image_optional_hdr32 *opt32;
-    struct pe_image_optional_hdr64 *opt64;
+    struct pe_image_optional_hdr64 *opt64 = NULL;
     struct pe_image_section_hdr *section_hdrs = NULL;
     size_t i, j, section_pe_idx;
     unsigned int err;
@@ -4811,7 +4811,7 @@ cl_error_t cli_peheader(fmap_t *map, struct cli_exe_info *peinfo, uint32_t opts,
             goto done;
         }
 
-        if (fmap_readn(map, (void *)(((size_t) & (peinfo->pe_opt.opt64)) + sizeof(struct pe_image_optional_hdr32)), at, OPT_HDR_SIZE_DIFF) != OPT_HDR_SIZE_DIFF) {
+        if (fmap_readn(map, (void *)((size_t)&peinfo->pe_opt.opt64 + sizeof(struct pe_image_optional_hdr32)), at, OPT_HDR_SIZE_DIFF) != OPT_HDR_SIZE_DIFF) {
             cli_dbgmsg("cli_peheader: Can't read additional optional file header bytes\n");
             ret = CL_EFORMAT;
             goto done;
@@ -4932,10 +4932,10 @@ cl_error_t cli_peheader(fmap_t *map, struct cli_exe_info *peinfo, uint32_t opts,
 #endif
     }
 
-    salign = (peinfo->is_pe32plus) ? EC32(opt64->SectionAlignment) : EC32(opt32->SectionAlignment);
-    falign = (peinfo->is_pe32plus) ? EC32(opt64->FileAlignment) : EC32(opt32->FileAlignment);
+    salign = (peinfo->is_pe32plus && opt64 != NULL) ? EC32(opt64->SectionAlignment) : EC32(opt32->SectionAlignment);
+    falign = (peinfo->is_pe32plus && opt64 != NULL) ? EC32(opt64->FileAlignment) : EC32(opt32->FileAlignment);
 
-    switch (peinfo->is_pe32plus ? EC16(opt64->Subsystem) : EC16(opt32->Subsystem)) {
+    switch ((peinfo->is_pe32plus && opt64 != NULL) ? EC16(opt64->Subsystem) : EC16(opt32->Subsystem)) {
         case 0:
             subsystem = "Unknown";
             break;
@@ -5045,10 +5045,14 @@ cl_error_t cli_peheader(fmap_t *map, struct cli_exe_info *peinfo, uint32_t opts,
     }
 
     for (i = 0; i < peinfo->ndatadirs; i++) {
+        uint32_t tmp;
         struct pe_image_data_dir *dir = peinfo->dirs;
 
-        dir[i].VirtualAddress = EC32(dir[i].VirtualAddress);
-        dir[i].Size           = EC32(dir[i].Size);
+        tmp                   = EC32(dir[i].VirtualAddress);
+        dir[i].VirtualAddress = tmp;
+
+        tmp         = EC32(dir[i].Size);
+        dir[i].Size = tmp;
     }
 
     at += data_dirs_size;
diff --git a/libclamav/phishcheck.c b/libclamav/phishcheck.c
index 9153b69523..77d768fde2 100644
--- a/libclamav/phishcheck.c
+++ b/libclamav/phishcheck.c
@@ -264,7 +264,7 @@ static int string_assign_concatenated(struct string* dest, const char* prefix, c
         cli_errmsg("Phishcheck: Unable to allocate memory for string_assign_concatenated\n");
         return CL_EMEM;
     }
-    strncpy(ret, prefix, prefix_len);
+    strncpy(ret, prefix, prefix_len + end - begin + 1);
     strncpy(ret + prefix_len, begin, end - begin);
     ret[prefix_len + end - begin] = '\0';
     string_free(dest);
diff --git a/libclamav/readdb.c b/libclamav/readdb.c
index 007aa4ea20..fc4ca4d108 100644
--- a/libclamav/readdb.c
+++ b/libclamav/readdb.c
@@ -1193,6 +1193,7 @@ static int cli_chkpua(const char *signame, const char *pua_cats, unsigned int op
 {
     char cat[32], *cat_pt, *pt1, *pt2, *endsig;
     const char *sig;
+    size_t catlen;
     int ret;
 
     cli_dbgmsg("cli_chkpua: Checking signature [%s]\n", signame);
@@ -1219,9 +1220,15 @@ static int cli_chkpua(const char *signame, const char *pua_cats, unsigned int op
     }
 
     endsig = strrchr(sig, '.');
-    strncpy(cat, sig, strlen(sig) - strlen(endsig) + 1);
-    cat[strlen(sig) - strlen(endsig) + 1] = 0;
-    cat_pt                                = strstr(cat, pua_cats);
+
+    catlen = MIN(sizeof(cat), strlen(sig) - strlen(endsig));
+
+    memcpy(cat, sig, catlen + 1);
+
+    // Add null terminator.
+    cat[catlen + 1] = '\0';
+
+    cat_pt = strstr(cat, pua_cats);
     cli_dbgmsg("cli_chkpua:                cat=[%s]\n", cat);
     cli_dbgmsg("cli_chkpua:                sig=[%s]\n", sig);
     if (options & CL_DB_PUA_INCLUDE)
@@ -2736,7 +2743,7 @@ static int cli_loadign(FILE *fs, struct cl_engine *engine, unsigned int options,
             int pad = 3 - len;
             /* patch-up for Boyer-Moore minimum length of 3: pad with spaces */
             if (signame != buffer) {
-                strncpy(buffer, signame, len);
+                memcpy(buffer, signame, len);
                 signame = buffer;
             }
             buffer[3] = '\0';
diff --git a/libclamav/rebuildpe.c b/libclamav/rebuildpe.c
index 8b00670d6d..621091570a 100644
--- a/libclamav/rebuildpe.c
+++ b/libclamav/rebuildpe.c
@@ -174,7 +174,14 @@ int cli_rebuildpe_align(char *buffer, struct cli_exe_section *sections, int sect
     }
 
     for (i = 0; i < sects; i++) {
-        snprintf(curpe, 8, ".clam%.2d", i + 1);
+        int snprintf_ret;
+        snprintf_ret = snprintf(curpe, 8, ".clam%.2d", i + 1);
+        if (snprintf_ret < 0) {
+            // More sections than expect -- the section number in the name was trunctated. Whatever. Don't really care.
+            // The act of checking for an error stops GCC from warning about possible truncation at compile time.
+            // See: https://stackoverflow.com/questions/51534284/how-to-circumvent-format-truncation-warning-in-gcc
+            cli_dbgmsg("More sections than expect (%d). The section number in the rebuilt pe section name was trunctated.\n", i);
+        }
         if (!align) {
             cli_writeint32(curpe + 8, sections[i].vsz);
             cli_writeint32(curpe + 12, sections[i].rva);
diff --git a/libclamav/regex_list.c b/libclamav/regex_list.c
index 26bc71e091..119fddbf12 100644
--- a/libclamav/regex_list.c
+++ b/libclamav/regex_list.c
@@ -206,7 +206,7 @@ cl_error_t regex_list_match(struct regex_matcher *matcher, char *real_url, const
         return CL_EMEM;
     }
 
-    strncpy(buffer, real_url, real_len);
+    strncpy(buffer, real_url, buffer_len);
     buffer[real_len] = (!is_allow_list_lookup && hostOnly) ? '/' : ':';
 
     /*
@@ -215,7 +215,7 @@ cl_error_t regex_list_match(struct regex_matcher *matcher, char *real_url, const
      */
     if (!hostOnly || is_allow_list_lookup) {
         /* For all other PDB and WDB signatures concatenate Real:Displayed. */
-        strncpy(buffer + real_len + 1, display_url, display_len);
+        strncpy(buffer + real_len + 1, display_url, buffer_len - real_len);
     }
     buffer[buffer_len - 1] = '/';
     buffer[buffer_len]     = 0;
diff --git a/libclamav/rtf.c b/libclamav/rtf.c
index 0f7465bf9d..041df7a031 100644
--- a/libclamav/rtf.c
+++ b/libclamav/rtf.c
@@ -156,7 +156,6 @@ static int compare_state(const struct rtf_state* a, const struct rtf_state* b)
 static int push_state(struct stack* stack, struct rtf_state* state)
 {
     int toplevel;
-    size_t defelements;
 
     stack->elements++;
     if (compare_state(state, &base_state)) {
@@ -175,7 +174,6 @@ static int push_state(struct stack* stack, struct rtf_state* state)
     }
     stack->states[stack->stack_cnt++] = *state;
     toplevel                          = state->encounteredTopLevel;
-    defelements                       = state->default_elements;
 
     *state = base_state;
 
diff --git a/libclamav/scanners.c b/libclamav/scanners.c
index c8482aaa50..9d5d397ebd 100644
--- a/libclamav/scanners.c
+++ b/libclamav/scanners.c
@@ -2045,6 +2045,10 @@ static cl_error_t cli_ole2_tempdir_scan_vba(const char *dir, cli_ctx *ctx, struc
         free(fullname);
     }
 
+    if (fd >= 0) {
+        close(fd);
+    }
+
     return status;
 }
 
diff --git a/libclamav/spin.c b/libclamav/spin.c
index 0f4bf6ce25..3feeda1888 100644
--- a/libclamav/spin.c
+++ b/libclamav/spin.c
@@ -72,8 +72,10 @@ static char exec86(uint8_t aelle, uint8_t cielle, char *curremu, int *retval)
         switch (opcode) {
             case 0xeb:
                 len++;
+                /* fall-through */
             case 0x0a:
                 len++;
+                /* fall-through */
             case 0x90:
             case 0xf8:
             case 0xf9:
diff --git a/libclamav/stats.c b/libclamav/stats.c
index a627b221a5..8f749a4f3e 100644
--- a/libclamav/stats.c
+++ b/libclamav/stats.c
@@ -572,12 +572,13 @@ char *clamav_stats_get_hostid(void *cbdata)
 #else
 char *clamav_stats_get_hostid(void *cbdata)
 {
-    char *sysctls[] = {
-        "kern.hostuuid",
-        NULL};
-    size_t bufsz, i;
     char *buf;
 
+#if HAVE_SYSCTLBYNAME
+    char *sysctls[] = {"kern.hostuuid", NULL};
+    size_t bufsz, i;
+#endif
+
     UNUSEDPARAM(cbdata);
 
 #if HAVE_SYSCTLBYNAME
diff --git a/libclamav/textnorm.c b/libclamav/textnorm.c
index 55ef778eea..8daf9ef80a 100644
--- a/libclamav/textnorm.c
+++ b/libclamav/textnorm.c
@@ -96,6 +96,10 @@ size_t text_normalize_buffer(struct text_norm_state *state, const unsigned char
     const unsigned char *out_end = state->out + state->out_len;
     unsigned char *p             = state->out + state->out_pos;
 
+    if (NULL == buf) {
+        return 0;
+    }
+
     for (i = 0; i < buf_len && p < out_end; i++) {
         unsigned char c = buf[i];
         switch (char_action[c]) {
diff --git a/libclamav/unarj.c b/libclamav/unarj.c
index 483819f1c4..5d3e106667 100644
--- a/libclamav/unarj.c
+++ b/libclamav/unarj.c
@@ -972,7 +972,7 @@ static int arj_read_main_header(arj_metadata_t *metadata)
 static cl_error_t arj_read_file_header(arj_metadata_t *metadata)
 {
     uint16_t header_size, count;
-    const char *filename, *comment;
+    const char *filename = NULL, *comment = NULL;
     arj_file_hdr_t file_hdr;
     struct text_norm_state fnstate, comstate;
     unsigned char *fnnorm  = NULL;
diff --git a/libclamav/unzip.c b/libclamav/unzip.c
index 1f063d7b77..0316b08585 100644
--- a/libclamav/unzip.c
+++ b/libclamav/unzip.c
@@ -1061,7 +1061,7 @@ cl_error_t index_the_central_directory(
                 goto done;
             }
 
-            zip_catalogue_new = cli_realloc2(zip_catalogue, sizeof(struct zip_record) * ZIP_RECORDS_CHECK_BLOCKSIZE * (num_record_blocks + 1));
+            zip_catalogue_new = cli_realloc(zip_catalogue, sizeof(struct zip_record) * ZIP_RECORDS_CHECK_BLOCKSIZE * (num_record_blocks + 1));
             if (NULL == zip_catalogue_new) {
                 status = CL_EMEM;
                 goto done;
diff --git a/libclamav/wwunpack.c b/libclamav/wwunpack.c
index 3bc903b543..7cb6d92240 100644
--- a/libclamav/wwunpack.c
+++ b/libclamav/wwunpack.c
@@ -150,9 +150,11 @@ cl_error_t wwunpack(uint8_t *exe, uint32_t exesz, uint8_t *wwsect, struct cli_ex
                 switch (bits) {
                     case 4: /* 10,11 */
                         backbytes++;
+                        /* fall-through */
                     case 3: /* 8,9 */
                         BIT;
                         backbytes += bits;
+                        /* fall-through */
                     case 0:
                     case 1:
                     case 2: /* 5,6,7 */
diff --git a/sigtool/sigtool.c b/sigtool/sigtool.c
index 1aa6400ae8..2f32cf93cf 100644
--- a/sigtool/sigtool.c
+++ b/sigtool/sigtool.c
@@ -434,6 +434,143 @@ static int fuzzy_img(const struct optstruct *opts)
     return status;
 }
 
+static cli_ctx *convenience_ctx(int fd)
+{
+    cl_error_t status        = CL_EMEM;
+    cli_ctx *ctx             = NULL;
+    struct cl_engine *engine = NULL;
+    cl_fmap_t *new_map       = NULL;
+
+    /* build engine */
+    engine = cl_engine_new();
+    if (NULL == engine) {
+        printf("convenience_ctx: engine initialization failed\n");
+        goto done;
+    }
+
+    cl_engine_set_num(engine, CL_ENGINE_AC_ONLY, 1);
+
+    if (cli_initroots(engine, 0) != CL_SUCCESS) {
+        printf("convenience_ctx: cli_initroots() failed\n");
+        goto done;
+    }
+
+    if (cli_add_content_match_pattern(engine->root[0], "test", "deadbeef", 0, 0, 0, "*", NULL, 0) != CL_SUCCESS) {
+        printf("convenience_ctx: Can't parse signature\n");
+        goto done;
+    }
+
+    if (CL_SUCCESS != cl_engine_compile(engine)) {
+        printf("convenience_ctx: failed to compile engine.");
+        goto done;
+    }
+
+    /* fake input fmap */
+    new_map = fmap(fd, 0, 0, NULL);
+    if (NULL == new_map) {
+        printf("convenience_ctx: fmap failed\n");
+        goto done;
+    }
+
+    /* prepare context */
+    ctx = cli_calloc(1, sizeof(cli_ctx));
+    if (!ctx) {
+        printf("convenience_ctx: ctx allocation failed\n");
+        goto done;
+    }
+
+    ctx->engine = (const struct cl_engine *)engine;
+
+    ctx->evidence = evidence_new();
+
+    ctx->dconf = (struct cli_dconf *)engine->dconf;
+
+    ctx->recursion_stack_size = ctx->engine->max_recursion_level;
+    ctx->recursion_stack      = cli_calloc(sizeof(recursion_level_t), ctx->recursion_stack_size);
+    if (!ctx->recursion_stack) {
+        status = CL_EMEM;
+        goto done;
+    }
+
+    // ctx was calloc'd, so recursion_level starts at 0.
+    ctx->recursion_stack[ctx->recursion_level].fmap = new_map;
+    ctx->recursion_stack[ctx->recursion_level].type = CL_TYPE_ANY; // ANY for the top level, because we don't yet know the type.
+    ctx->recursion_stack[ctx->recursion_level].size = new_map->len;
+
+    ctx->fmap = ctx->recursion_stack[ctx->recursion_level].fmap;
+
+    ctx->options = cli_calloc(1, sizeof(struct cl_scan_options));
+    if (!ctx->options) {
+        printf("convenience_ctx: scan options allocation failed\n");
+        goto done;
+    }
+    ctx->options->general |= CL_SCAN_GENERAL_HEURISTICS;
+    ctx->options->parse = ~(0);
+
+    status = CL_SUCCESS;
+
+done:
+    if (CL_SUCCESS != status) {
+        if (NULL != new_map) {
+            funmap(new_map);
+        }
+        if (NULL != ctx) {
+            if (NULL != ctx->options) {
+                free(ctx->options);
+            }
+            if (NULL != ctx->recursion_stack) {
+                free(ctx->recursion_stack);
+            }
+            free(ctx);
+            ctx = NULL;
+        }
+        if (NULL != engine) {
+            cl_engine_free(engine);
+        }
+    }
+
+    return ctx;
+}
+
+static void destroy_ctx(cli_ctx *ctx)
+{
+    if (NULL != ctx) {
+        if (NULL != ctx->recursion_stack) {
+            /* Clean up any fmaps */
+            while (ctx->recursion_level > 0) {
+                if (NULL != ctx->recursion_stack[ctx->recursion_level].fmap) {
+                    funmap(ctx->recursion_stack[ctx->recursion_level].fmap);
+                    ctx->recursion_stack[ctx->recursion_level].fmap = NULL;
+                }
+                ctx->recursion_level -= 1;
+            }
+            if (NULL != ctx->recursion_stack[0].fmap) {
+                funmap(ctx->recursion_stack[0].fmap);
+                ctx->recursion_stack[0].fmap = NULL;
+            }
+
+            free(ctx->recursion_stack);
+            ctx->recursion_stack = NULL;
+        }
+
+        if (NULL != ctx->engine) {
+            cl_engine_free((struct cl_engine *)ctx->engine);
+            ctx->engine = NULL;
+        }
+
+        if (NULL != ctx->options) {
+            free(ctx->options);
+            ctx->options = NULL;
+        }
+
+        if (NULL != ctx->evidence) {
+            evidence_free(ctx->evidence);
+        }
+
+        free(ctx);
+    }
+}
+
 static int htmlnorm(const struct optstruct *opts)
 {
     int fd;
@@ -452,6 +589,8 @@ static int htmlnorm(const struct optstruct *opts)
 
     close(fd);
 
+    destroy_ctx(ctx);
+
     return 0;
 }
 
@@ -619,7 +758,7 @@ static int writeinfo(const char *dbname, const char *builder, const char *header
 {
     FILE *fh;
     unsigned int i, bytes;
-    char file[32], *pt, dbfile[32];
+    char file[4096], *pt, dbfile[4096];
     unsigned char digest[32], buffer[FILEBUFF];
     void *ctx;
 
@@ -724,7 +863,7 @@ static int build(const struct optstruct *opts)
     STATBUF foo;
     unsigned char buffer[FILEBUFF];
     char *tarfile, header[513], smbuff[32], builder[33], *pt, olddb[512];
-    char patch[50], broken[57], dbname[32], dbfile[36];
+    char patch[50], broken[57], dbname[32], dbfile[4096];
     const char *newcvd, *localdbdir = NULL;
     struct cl_engine *engine;
     FILE *cvd, *fh;
@@ -2579,12 +2718,13 @@ static int decodehex(const char *hexsig)
     int asterisk = 0;
     unsigned int i, j, hexlen, dlen, parts = 0;
     int mindist = 0, maxdist = 0, error = 0;
+    ssize_t bytes_written;
 
     hexlen = strlen(hexsig);
     if ((wild = strchr(hexsig, '/'))) {
         /* ^offset:trigger-logic/regex/options$ */
         char *trigger, *regex, *regex_end, *cflags;
-        size_t tlen = wild - hexsig, rlen, clen;
+        size_t tlen = wild - hexsig, rlen = 0, clen;
 
         /* check for trigger */
         if (!tlen) {
@@ -2649,7 +2789,7 @@ static int decodehex(const char *hexsig)
         /* print components of regex subsig */
         mprintf(LOGG_INFO, "     +-> TRIGGER: %s\n", trigger);
         mprintf(LOGG_INFO, "     +-> REGEX: %s\n", regex);
-        mprintf(LOGG_INFO, "     +-> CFLAGS: %s\n", cflags);
+        mprintf(LOGG_INFO, "     +-> CFLAGS: %s\n", cflags != NULL ? cflags : "null");
 
         free(trigger);
         free(regex);
@@ -2705,7 +2845,10 @@ static int decodehex(const char *hexsig)
                 free(hexcpy);
                 return -1;
             }
-            (void)write(1, decoded, dlen);
+            bytes_written = write(1, decoded, dlen);
+            if (bytes_written != dlen) {
+                mprintf(LOGG_WARNING, "Failed to print all decoded bytes\n");
+            }
             free(decoded);
 
             if (i == parts)
@@ -2786,7 +2929,10 @@ static int decodehex(const char *hexsig)
                 free(pt);
                 return -1;
             }
-            (void)write(1, decoded, dlen);
+            bytes_written = write(1, decoded, dlen);
+            if (bytes_written != dlen) {
+                mprintf(LOGG_WARNING, "Failed to print all decoded bytes\n");
+            }
             free(decoded);
             if (i < parts)
                 mprintf(LOGG_INFO, "{WILDCARD_ANY_STRING}");
@@ -2798,7 +2944,10 @@ static int decodehex(const char *hexsig)
             mprintf(LOGG_ERROR, "Decoding failed\n");
             return -1;
         }
-        (void)write(1, decoded, dlen);
+        bytes_written = write(1, decoded, dlen);
+        if (bytes_written != dlen) {
+            mprintf(LOGG_WARNING, "Failed to print all decoded bytes\n");
+        }
         free(decoded);
     }
 
diff --git a/sigtool/vba.c b/sigtool/vba.c
index 54304e9fe1..0a07c246e3 100644
--- a/sigtool/vba.c
+++ b/sigtool/vba.c
@@ -56,104 +56,6 @@ typedef struct mac_token2_tag {
 
 } mac_token2_t;
 
-cli_ctx *convenience_ctx(int fd)
-{
-    cl_error_t status        = CL_EMEM;
-    cli_ctx *ctx             = NULL;
-    struct cl_engine *engine = NULL;
-    cl_fmap_t *new_map       = NULL;
-
-    /* build engine */
-    engine = cl_engine_new();
-    if (NULL == engine) {
-        printf("convenience_ctx: engine initialization failed\n");
-        goto done;
-    }
-
-    cl_engine_set_num(engine, CL_ENGINE_AC_ONLY, 1);
-
-    if (cli_initroots(engine, 0) != CL_SUCCESS) {
-        printf("convenience_ctx: cli_initroots() failed\n");
-        goto done;
-    }
-
-    if (cli_add_content_match_pattern(engine->root[0], "test", "deadbeef", 0, 0, 0, "*", NULL, 0) != CL_SUCCESS) {
-        printf("convenience_ctx: Can't parse signature\n");
-        goto done;
-    }
-
-    if (CL_SUCCESS != cl_engine_compile(engine)) {
-        printf("convenience_ctx: failed to compile engine.");
-        goto done;
-    }
-
-    /* fake input fmap */
-    new_map = fmap(fd, 0, 0, NULL);
-    if (NULL == new_map) {
-        printf("convenience_ctx: fmap failed\n");
-        goto done;
-    }
-
-    /* prepare context */
-    ctx = cli_calloc(1, sizeof(cli_ctx));
-    if (!ctx) {
-        printf("convenience_ctx: ctx allocation failed\n");
-        goto done;
-    }
-
-    ctx->engine = (const struct cl_engine *)engine;
-
-    ctx->evidence = evidence_new();
-
-    ctx->dconf = (struct cli_dconf *)engine->dconf;
-
-    ctx->recursion_stack_size = ctx->engine->max_recursion_level;
-    ctx->recursion_stack      = cli_calloc(sizeof(recursion_level_t), ctx->recursion_stack_size);
-    if (!ctx->recursion_stack) {
-        status = CL_EMEM;
-        goto done;
-    }
-
-    // ctx was calloc'd, so recursion_level starts at 0.
-    ctx->recursion_stack[ctx->recursion_level].fmap = new_map;
-    ctx->recursion_stack[ctx->recursion_level].type = CL_TYPE_ANY; // ANY for the top level, because we don't yet know the type.
-    ctx->recursion_stack[ctx->recursion_level].size = new_map->len;
-
-    ctx->fmap = ctx->recursion_stack[ctx->recursion_level].fmap;
-
-    ctx->options = cli_calloc(1, sizeof(struct cl_scan_options));
-    if (!ctx->options) {
-        printf("convenience_ctx: scan options allocation failed\n");
-        goto done;
-    }
-    ctx->options->general |= CL_SCAN_GENERAL_HEURISTICS;
-    ctx->options->parse = ~(0);
-
-    status = CL_SUCCESS;
-
-done:
-    if (CL_SUCCESS != status) {
-        if (NULL != new_map) {
-            funmap(new_map);
-        }
-        if (NULL != ctx) {
-            if (NULL != ctx->options) {
-                free(ctx->options);
-            }
-            if (NULL != ctx->recursion_stack) {
-                free(ctx->recursion_stack);
-            }
-            free(ctx);
-            ctx = NULL;
-        }
-        if (NULL != engine) {
-            cl_engine_free(engine);
-        }
-    }
-
-    return ctx;
-}
-
 /*only called by wm_decode_macro*/
 static char *get_unicode_name(char *name, int size)
 {
diff --git a/sigtool/vba.h b/sigtool/vba.h
index 410fd9cd87..db48f68fb9 100644
--- a/sigtool/vba.h
+++ b/sigtool/vba.h
@@ -27,7 +27,4 @@
 struct optstruct;
 int sigtool_vba_scandir(const struct optstruct *opts, const char *dirname, int hex_output, struct uniq *U);
 
-cli_ctx *convenience_ctx(int fd);
-void destroy_ctx(cli_ctx *ctx);
-
 #endif