6 files changed, 14 insertions, 4 deletions
diff --git a/src/internal/floatscan.c b/src/internal/floatscan.c
index 8c0828fc..b15366b6 100644
--- a/src/internal/floatscan.c
+++ b/src/internal/floatscan.c
@@ -347,7 +347,7 @@ static long double hexfloat(FILE *f, int bits, int emin, int sign, int pok)
 			else d = c-'0';
 			if (dc<8) {
 				x = x*16 + d;
-			} else if (dc < LDBL_MANT_DIG/4+1) {
+			} else if (dc < (LDBL_MANT_DIG+3)/4+1) {
 				y += d*(scale/=16);
 			} else if (d && !gottail) {
 				y += 0.5*scale;
diff --git a/src/malloc/mallocng/glue.h b/src/malloc/mallocng/glue.h
index 8c2586fb..c347a4ef 100644
--- a/src/malloc/mallocng/glue.h
+++ b/src/malloc/mallocng/glue.h
@@ -36,8 +36,10 @@
 #define brk(p) ((uintptr_t)__syscall(SYS_brk, p))
 
 #define mmap __mmap
+#define munmap __munmap
 #define madvise __madvise
 #define mremap __mremap
+#define mprotect __mprotect
 
 #define DISABLE_ALIGNED_ALLOC (__malloc_replaced && !__aligned_alloc_replaced)
 
diff --git a/src/malloc/mallocng/meta.h b/src/malloc/mallocng/meta.h
index 61ec53f9..3a27af64 100644
--- a/src/malloc/mallocng/meta.h
+++ b/src/malloc/mallocng/meta.h
@@ -129,12 +129,13 @@ static inline int get_slot_index(const unsigned char *p)
 static inline struct meta *get_meta(const unsigned char *p)
 {
 	assert(!((uintptr_t)p & 15));
-	int offset = *(const uint16_t *)(p - 2);
+	size_t offset = *(const uint16_t *)(p - 2);
 	int index = get_slot_index(p);
 	if (p[-4]) {
 		assert(!offset);
 		offset = *(uint32_t *)(p - 8);
 		assert(offset > 0xffff);
+		assert(offset < PTRDIFF_MAX/UNIT);
 	}
 	const struct group *base = (const void *)(p - UNIT*offset - UNIT);
 	const struct meta *meta = base->meta;
diff --git a/src/math/logbl.c b/src/math/logbl.c
index 962973a7..82dba942 100644
--- a/src/math/logbl.c
+++ b/src/math/logbl.c
@@ -1,4 +1,5 @@
 #include <math.h>
+#include <float.h>
 #if LDBL_MANT_DIG == 53 && LDBL_MAX_EXP == 1024
 long double logbl(long double x)
 {
diff --git a/src/stdio/fmemopen.c b/src/stdio/fmemopen.c
index 343e3e3f..38ba9f85 100644
--- a/src/stdio/fmemopen.c
+++ b/src/stdio/fmemopen.c
@@ -63,13 +63,17 @@ static size_t mwrite(FILE *f, const unsigned char *buf, size_t len)
 	}
 	if (c->mode == 'a') c->pos = c->len;
 	rem = c->size - c->pos;
-	if (len > rem) len = rem;
+	if (len > rem) {
+		errno = ENOSPC;
+		f->wpos = f->wbase = f->wend = 0;
+		f->flags |= F_ERR;
+		len = rem;
+	}
 	memcpy(c->buf+c->pos, buf, len);
 	c->pos += len;
 	if (c->pos > c->len) {
 		c->len = c->pos;
 		if (c->len < c->size) c->buf[c->len] = 0;
-		else if ((f->flags&F_NORD) && c->size) c->buf[c->size-1] = 0;
 	}
 	return len;
 }
diff --git a/src/stdlib/qsort.c b/src/stdlib/qsort.c
index e4bce9f7..28607450 100644
--- a/src/stdlib/qsort.c
+++ b/src/stdlib/qsort.c
@@ -71,6 +71,7 @@ static inline void shl(size_t p[2], int n)
 		n -= 8 * sizeof(size_t);
 		p[1] = p[0];
 		p[0] = 0;
+		if (!n) return;
 	}
 	p[1] <<= n;
 	p[1] |= p[0] >> (sizeof(size_t) * 8 - n);
@@ -83,6 +84,7 @@ static inline void shr(size_t p[2], int n)
 		n -= 8 * sizeof(size_t);
 		p[0] = p[1];
 		p[1] = 0;
+		if (!n) return;
 	}
 	p[0] >>= n;
 	p[0] |= p[1] << (sizeof(size_t) * 8 - n);