coverity: fix various warnings detected with Coverity

These are (most likely) only warnings and not severe bugs.
Some of these changes are mostly made to get a clean run of
Coverity without any warnings.

Error found by running Coverity scan

https://bugzilla.redhat.com/show_bug.cgi?id=1025894

Co-Authored-By: Jiří Klimeš <jklimes@redhat.com>
Signed-off-by: Thomas Haller <thaller@redhat.com>

40 files changed, 143 insertions, 124 deletions

diff --git a/cli/src/connections.c b/cli/src/connections.c
index d5006be123..e6ec002a04 100644
--- a/cli/src/connections.c
+++ b/cli/src/connections.c
@@ -358,6 +358,7 @@ nmc_connection_detail (NMConnection *connection, NmCli *nmc)
 		nmc->return_value = NMC_RESULT_ERROR_USER_INPUT;
 		return FALSE;
 	}
+	g_assert (print_settings_array);
 
 	/* Main header */
 	nmc->print_fields.header_name = _("Connection details");
@@ -388,8 +389,7 @@ nmc_connection_detail (NMConnection *connection, NmCli *nmc)
 		}
 	}
 
-	if (print_settings_array)
-		g_array_free (print_settings_array, TRUE);
+	g_array_free (print_settings_array, TRUE);
 
 	return TRUE;
 }
@@ -859,6 +859,7 @@ nmc_active_connection_detail (NMActiveConnection *acon, NmCli *nmc)
 		nmc->return_value = NMC_RESULT_ERROR_USER_INPUT;
 		return FALSE;
 	}
+	g_assert (print_groups);
 
 	/* Main header */
 	nmc->print_fields.header_name = _("Active connection details");
@@ -978,8 +979,7 @@ nmc_active_connection_detail (NMActiveConnection *acon, NmCli *nmc)
 		}
 	}
 
-	if (print_groups)
-		g_array_free (print_groups, TRUE);
+	g_array_free (print_groups, TRUE);
 
 	return TRUE;
 }
@@ -5589,6 +5589,8 @@ connection_remove_setting (NMConnection *connection, NMSetting *setting)
 {
 	gboolean mandatory;
 
+	g_return_val_if_fail (setting, FALSE);
+
 	mandatory = is_setting_mandatory (connection, setting);
 	if (!mandatory) {
 		nm_connection_remove_setting (connection, G_OBJECT_TYPE (setting));
@@ -6268,6 +6270,7 @@ editor_menu_main (NmCli *nmc, NMConnection *connection, const char *connection_t
 						if (s_tmp) {
 							/* Remove setting from the connection */
 							connection_remove_setting (connection, s_tmp);
+							/* coverity[copy_paste_error] - suppress Coverity COPY_PASTE_ERROR defect */
 							if (ss == menu_ctx.curr_setting) {
 								/* If we removed the setting we are in, go up */
 								menu_switch_to_level0 (&menu_ctx, BASE_PROMPT, nmc->editor_prompt_color);
@@ -6382,14 +6385,14 @@ editor_menu_main (NmCli *nmc, NMConnection *connection, const char *connection_t
 			if (   menu_ctx.curr_setting
 			    && (!cmd_arg || strcmp (cmd_arg, "all") != 0)) {
 				GError *tmp_err = NULL;
-				nm_setting_verify (menu_ctx.curr_setting, NULL, &tmp_err);
+				(void) nm_setting_verify (menu_ctx.curr_setting, NULL, &tmp_err);
 				printf (_("Verify setting '%s': %s\n"),
 				        nm_setting_get_name (menu_ctx.curr_setting),
 				        tmp_err ? tmp_err->message : "OK");
 				g_clear_error (&tmp_err);
 			} else {
 				GError *tmp_err = NULL;
-				nm_connection_verify (connection, &tmp_err);
+				(void) nm_connection_verify (connection, &tmp_err);
 				printf (_("Verify connection: %s\n"),
 				        tmp_err ? tmp_err->message : "OK");
 				g_clear_error (&tmp_err);
@@ -6939,8 +6942,7 @@ do_connection_edit (NmCli *nmc, int argc, char **argv)
 	return nmc->return_value;
 
 error:
-	if (connection)
-		g_object_unref (connection);
+	g_assert (!connection);
 	g_free (type_ask);
 
 	nmc->should_wait = FALSE;
diff --git a/cli/src/devices.c b/cli/src/devices.c
index a21660d79a..cad0723f9c 100644
--- a/cli/src/devices.c
+++ b/cli/src/devices.c
@@ -424,7 +424,7 @@ fill_output_access_point (gpointer data, gpointer user_data)
 	freq = nm_access_point_get_frequency (ap);
 	mode = nm_access_point_get_mode (ap);
 	bitrate = nm_access_point_get_max_bitrate (ap);
-	strength = CLAMP (nm_access_point_get_strength (ap), 0, 100);
+	strength = MIN (nm_access_point_get_strength (ap), 100);
 
 	/* Convert to strings */
 	ssid_str = nm_utils_ssid_to_utf8 (ssid);
diff --git a/cli/src/settings.c b/cli/src/settings.c
index 1df4c8ce46..4e4903facc 100644
--- a/cli/src/settings.c
+++ b/cli/src/settings.c
@@ -1056,8 +1056,8 @@ nmc_property_connection_get_permissions (NMSetting *setting)
 
 	perm = g_string_new (NULL);
 	for (i = 0; i < nm_setting_connection_get_num_permissions (s_con); i++) {
-		nm_setting_connection_get_permission (s_con, i, &perm_type, &perm_item, NULL);
-		g_string_append_printf (perm, "%s:%s,", perm_type, perm_item);
+		if (nm_setting_connection_get_permission (s_con, i, &perm_type, &perm_item, NULL))
+			g_string_append_printf (perm, "%s:%s,", perm_type, perm_item);
 	}
 	if (perm->len > 0)
 		g_string_truncate (perm, perm->len-1); /* remove trailing , */
diff --git a/cli/src/utils.c b/cli/src/utils.c
index 61fbff8c3c..de246d66a5 100644
--- a/cli/src/utils.c
+++ b/cli/src/utils.c
@@ -131,7 +131,7 @@ nmc_parse_args (nmc_arg_t *arg_arr, gboolean last, int *argc, char ***argv, GErr
 			if (have_mandatory && !last)
 				return TRUE;
 
-			if (p && p->name)
+			if (p->name)
 				g_set_error (error, NMCLI_ERROR, NMC_RESULT_ERROR_USER_INPUT,
 				             _("Error: Argument '%s' was expected, but '%s' provided."), p->name, **argv);
 			else
diff --git a/examples/C/glib/list-connections-dbus-glib.c b/examples/C/glib/list-connections-dbus-glib.c
index 2cb584b59b..3fd3fe765d 100644
--- a/examples/C/glib/list-connections-dbus-glib.c
+++ b/examples/C/glib/list-connections-dbus-glib.c
@@ -40,13 +40,19 @@ list_connections (DBusGProxy *proxy)
 	int i;
 	GError *error = NULL;
 	GPtrArray *con_array;
+	gboolean success;
 
 	/* Call ListConnections D-Bus method */
-	dbus_g_proxy_call (proxy, "ListConnections", &error,
-	                   /* No input arguments */
-	                   G_TYPE_INVALID,
-	                   DBUS_TYPE_G_ARRAY_OF_OBJECT_PATH, &con_array, /* Return values */
-	                   G_TYPE_INVALID);
+	success = dbus_g_proxy_call (proxy, "ListConnections", &error,
+	                             /* No input arguments */
+	                             G_TYPE_INVALID,
+	                             DBUS_TYPE_G_ARRAY_OF_OBJECT_PATH, &con_array, /* Return values */
+	                             G_TYPE_INVALID);
+	if (!success) {
+		printf ("ListConnections failed: %s", error->message);
+		g_error_free (error);
+		return;
+	}
 
 	for (i = 0; con_array && i < con_array->len; i++) {
 		char *connection_path = g_ptr_array_index (con_array, i);
diff --git a/libnm-glib/nm-client.c b/libnm-glib/nm-client.c
index 1ffb8668f7..68ad41245d 100644
--- a/libnm-glib/nm-client.c
+++ b/libnm-glib/nm-client.c
@@ -1824,8 +1824,13 @@ static void
 constructed (GObject *object)
 {
 	NMClientPrivate *priv = NM_CLIENT_GET_PRIVATE (object);
+	GError *error = NULL;
 
-	nm_utils_init (NULL);
+	if (!nm_utils_init (&error)) {
+		g_warning ("Couldn't initilize nm-utils/crypto system: %d %s",
+		           error->code, error->message);
+		g_clear_error (&error);
+	}
 
 	G_OBJECT_CLASS (nm_client_parent_class)->constructed (object);
 
diff --git a/libnm-util/nm-setting-bond.c b/libnm-util/nm-setting-bond.c
index bf9e529e29..3fe5f51903 100644
--- a/libnm-util/nm-setting-bond.c
+++ b/libnm-util/nm-setting-bond.c
@@ -245,13 +245,13 @@ validate_list (const char *name, const char *value, const BondDefault *def)
 {
 	guint i;
 
-	for (i = 0; def->list && i < G_N_ELEMENTS (def->list) && def->list[i]; i++) {
+	for (i = 0; i < G_N_ELEMENTS (def->list) && def->list[i]; i++) {
 		if (g_strcmp0 (def->list[i], value) == 0)
 			return TRUE;
 	}
 
 	/* empty validation list means all values pass */
-	return (def->list == NULL || def->list[0] == NULL) ? TRUE : FALSE;
+	return def->list[0] == NULL ? TRUE : FALSE;
 }
 
 static gboolean
diff --git a/libnm-util/nm-setting-vlan.c b/libnm-util/nm-setting-vlan.c
index e56ccb4de5..c9c1827f01 100644
--- a/libnm-util/nm-setting-vlan.c
+++ b/libnm-util/nm-setting-vlan.c
@@ -250,7 +250,6 @@ nm_setting_vlan_add_priority_str (NMSettingVlan *setting,
                                   NMVlanPriorityMap map,
                                   const char *str)
 {
-	NMSettingVlanPrivate *priv = NULL;
 	GSList *list = NULL, *iter = NULL;
 	PriorityMap *item = NULL;
 
@@ -258,7 +257,6 @@ nm_setting_vlan_add_priority_str (NMSettingVlan *setting,
 	g_return_val_if_fail (map == NM_VLAN_INGRESS_MAP || map == NM_VLAN_EGRESS_MAP, FALSE);
 	g_return_val_if_fail (str && str[0], FALSE);
 
-	priv = NM_SETTING_VLAN_GET_PRIVATE (setting);
 	list = get_map (setting, map);
 
 	item = priority_map_new_from_str (map, str);
diff --git a/libnm-util/nm-setting-wireless.c b/libnm-util/nm-setting-wireless.c
index 817569df12..baab945776 100644
--- a/libnm-util/nm-setting-wireless.c
+++ b/libnm-util/nm-setting-wireless.c
@@ -146,7 +146,7 @@ match_cipher (const char *cipher,
  *
  * Returns: %TRUE if the given settings are compatible with the access point's
  * security flags and mode, %FALSE if they are not.
- */ 
+ */
 gboolean
 nm_setting_wireless_ap_security_compatible (NMSettingWireless *s_wireless,
                                             NMSettingWirelessSecurity *s_wireless_sec,
@@ -155,15 +155,12 @@ nm_setting_wireless_ap_security_compatible (NMSettingWireless *s_wireless,
                                             NM80211ApSecurityFlags ap_rsn,
                                             NM80211Mode ap_mode)
 {
-	NMSettingWirelessPrivate *priv;
 	const char *key_mgmt = NULL, *cipher;
 	guint32 num, i;
 	gboolean found = FALSE;
 
 	g_return_val_if_fail (NM_IS_SETTING_WIRELESS (s_wireless), FALSE);
 
-	priv = NM_SETTING_WIRELESS_GET_PRIVATE (s_wireless);
-
 	if (!s_wireless_sec) {
 		if (   (ap_flags & NM_802_11_AP_FLAGS_PRIVACY)
 		    || (ap_wpa != NM_802_11_AP_SEC_NONE)
diff --git a/libnm-util/nm-utils.c b/libnm-util/nm-utils.c
index 2a629b3c62..e9c2593fab 100644
--- a/libnm-util/nm-utils.c
+++ b/libnm-util/nm-utils.c
@@ -416,7 +416,7 @@ nm_utils_same_ssid (const GByteArray * ssid1,
 
 	if (ssid1 == ssid2)
 		return TRUE;
-	if ((ssid1 && !ssid2) || (!ssid1 && ssid2))
+	if (!ssid1 || !ssid2)
 		return FALSE;
 
 	ssid1_len = ssid1->len;
@@ -724,6 +724,7 @@ nm_utils_security_valid (NMUtilsSecurityType type,
 			/* Ad-Hoc WPA APs won't necessarily have the PSK flag set, and
 			 * they don't have any pairwise ciphers. */
 			if (adhoc) {
+				/* coverity[dead_error_line] */
 				if (   (ap_wpa & NM_802_11_AP_SEC_GROUP_TKIP)
 				    && (wifi_caps & NM_WIFI_DEVICE_CAP_CIPHER_TKIP))
 					return TRUE;
@@ -752,6 +753,7 @@ nm_utils_security_valid (NMUtilsSecurityType type,
 			/* Ad-Hoc WPA APs won't necessarily have the PSK flag set, and
 			 * they don't have any pairwise ciphers, nor any RSA flags yet. */
 			if (adhoc) {
+				/* coverity[dead_error_line] */
 				if (wifi_caps & NM_WIFI_DEVICE_CAP_CIPHER_TKIP)
 					return TRUE;
 				if (wifi_caps & NM_WIFI_DEVICE_CAP_CIPHER_CCMP)
diff --git a/src/config/nm-config.c b/src/config/nm-config.c
index 19692fc339..e241b74754 100644
--- a/src/config/nm-config.c
+++ b/src/config/nm-config.c
@@ -147,7 +147,7 @@ nm_config_get_connectivity_interval (NMConfig *config)
 	/* We store interval as signed internally to track whether it's
 	 * set or not, but report as unsigned to callers.
 	 */
-	return CLAMP (NM_CONFIG_GET_PRIVATE (config)->connectivity_interval, 0, G_MAXINT32);
+	return MAX (NM_CONFIG_GET_PRIVATE (config)->connectivity_interval, 0);
 }
 
 const char *
diff --git a/src/config/tests/test-config.c b/src/config/tests/test-config.c
index 02567979c0..caf93ff6f2 100644
--- a/src/config/tests/test-config.c
+++ b/src/config/tests/test-config.c
@@ -35,6 +35,7 @@ setup_config (const char *config_file, const char *config_dir, ...)
 	char **argv, *arg;
 	int argc;
 	GOptionContext *context;
+	gboolean success;
 
 	args = g_ptr_array_new ();
 	g_ptr_array_add (args, "test-config");
@@ -53,9 +54,12 @@ setup_config (const char *config_file, const char *config_dir, ...)
 
 	context = g_option_context_new (NULL);
 	g_option_context_add_main_entries (context, nm_config_get_options (), NULL);
-	g_option_context_parse (context, &argc, &argv, NULL);
+	success = g_option_context_parse (context, &argc, &argv, NULL);
 	g_option_context_free (context);
 
+	if (!success)
+		g_printerr ("Invalid options.\n");
+
 	g_ptr_array_free (args, TRUE);
 }
 
@@ -87,10 +91,12 @@ test_config_simple (void)
 	g_free (value);
 
 	value = nm_config_get_value (config, "extra-section", "no-key", &error);
+	g_assert (!value);
 	g_assert_error (error, G_KEY_FILE_ERROR, G_KEY_FILE_ERROR_KEY_NOT_FOUND);
 	g_clear_error (&error);
 
 	value = nm_config_get_value (config, "no-section", "no-key", &error);
+	g_assert (!value);
 	g_assert_error (error, G_KEY_FILE_ERROR, G_KEY_FILE_ERROR_GROUP_NOT_FOUND);
 	g_clear_error (&error);
 
@@ -105,6 +111,7 @@ test_config_non_existent (void)
 
 	setup_config (SRCDIR "/no-such-file", "/no/such/dir", NULL);
 	config = nm_config_new (&error);
+	g_assert (!config);
 	g_assert_error (error, G_KEY_FILE_ERROR, G_KEY_FILE_ERROR_NOT_FOUND);
 }
 
@@ -116,6 +123,7 @@ test_config_parse_error (void)
 
 	setup_config (SRCDIR "/bad.conf", "/no/such/dir", NULL);
 	config = nm_config_new (&error);
+	g_assert (!config);
 	g_assert_error (error, G_KEY_FILE_ERROR, G_KEY_FILE_ERROR_PARSE);
 }
 
@@ -266,6 +274,7 @@ test_config_confdir_parse_error (void)
 	/* Using SRCDIR as the conf dir will pick up bad.conf */
 	setup_config (SRCDIR "/NetworkManager.conf", SRCDIR, NULL);
 	config = nm_config_new (&error);
+	g_assert (!config);
 	g_assert_error (error, G_KEY_FILE_ERROR, G_KEY_FILE_ERROR_PARSE);
 }
 
diff --git a/src/devices/nm-device-ethernet.c b/src/devices/nm-device-ethernet.c
index c0b7861eaf..062134b54a 100644
--- a/src/devices/nm-device-ethernet.c
+++ b/src/devices/nm-device-ethernet.c
@@ -228,7 +228,6 @@ constructor (GType type,
 			 GObjectConstructParam *construct_params)
 {
 	GObject *object;
-	NMDeviceEthernetPrivate *priv;
 	NMDevice *self;
 	int ifindex;
 
@@ -237,7 +236,6 @@ constructor (GType type,
 	                                                                        construct_params);
 	if (object) {
 		self = NM_DEVICE (object);
-		priv = NM_DEVICE_ETHERNET_GET_PRIVATE (self);
 		ifindex = nm_device_get_ifindex (self);
 
 		g_assert (   nm_platform_link_get_type (ifindex) == NM_LINK_TYPE_ETHERNET
@@ -1262,7 +1260,7 @@ update_connection (NMDevice *device, NMConnection *connection)
 	/* If the device reports a permanent address, use that for the MAC address
 	 * and the current MAC, if different, is the cloned MAC.
 	 */
-	if (priv->perm_hw_addr && memcmp (priv->perm_hw_addr, null_mac, ETH_ALEN)) {
+	if (memcmp (priv->perm_hw_addr, null_mac, ETH_ALEN)) {
 		array = g_byte_array_sized_new (ETH_ALEN);
 		g_byte_array_append (array, priv->perm_hw_addr, ETH_ALEN);
 		g_object_set (s_wired, NM_SETTING_WIRED_MAC_ADDRESS, array, NULL);
diff --git a/src/devices/nm-device-infiniband.c b/src/devices/nm-device-infiniband.c
index 1c91449e4e..2d1f142e02 100644
--- a/src/devices/nm-device-infiniband.c
+++ b/src/devices/nm-device-infiniband.c
@@ -68,22 +68,19 @@ constructor (GType type,
 			 GObjectConstructParam *construct_params)
 {
 	GObject *object;
-	NMDeviceInfinibandPrivate *priv;
 	NMDevice *self;
 
 	object = G_OBJECT_CLASS (nm_device_infiniband_parent_class)->constructor (type,
-	                                                                        n_construct_params,
-	                                                                        construct_params);
+	                                                                          n_construct_params,
+	                                                                          construct_params);
 	if (!object)
 		return NULL;
 
 	self = NM_DEVICE (object);
-	priv = NM_DEVICE_INFINIBAND_GET_PRIVATE (self);
 
 	nm_log_dbg (LOGD_HW | LOGD_INFINIBAND, "(%s): kernel ifindex %d",
-	            nm_device_get_iface (NM_DEVICE (self)),
-	            nm_device_get_ifindex (NM_DEVICE (self)));
-
+	            nm_device_get_iface (self),
+	            nm_device_get_ifindex (self));
 	return object;
 }
 
diff --git a/src/devices/nm-device-vlan.c b/src/devices/nm-device-vlan.c
index ea74d65385..0cf2800b73 100644
--- a/src/devices/nm-device-vlan.c
+++ b/src/devices/nm-device-vlan.c
@@ -318,7 +318,7 @@ update_connection (NMDevice *device, NMConnection *connection)
 		g_object_set (s_vlan, NM_SETTING_VLAN_INTERFACE_NAME, nm_device_get_iface (device), NULL);
 	}
 
-	nm_platform_vlan_get_info (ifindex, &parent_ifindex, &vlan_id);
+	(void) nm_platform_vlan_get_info (ifindex, &parent_ifindex, &vlan_id);
 	if (priv->vlan_id != vlan_id) {
 		priv->vlan_id = vlan_id;
 		g_object_notify (G_OBJECT (device), NM_DEVICE_VLAN_ID);
diff --git a/src/dhcp-manager/nm-dhcp-client.c b/src/dhcp-manager/nm-dhcp-client.c
index 7f6e6e5799..aa34a20db4 100644
--- a/src/dhcp-manager/nm-dhcp-client.c
+++ b/src/dhcp-manager/nm-dhcp-client.c
@@ -328,7 +328,7 @@ machine_id_parse (const char *in, uuid_t uu)
 	g_return_val_if_fail (in != NULL, FALSE);
 	g_return_val_if_fail (strlen (in) == 32, FALSE);
 
-	for (i = 0; i < 32; i++, cp++) {
+	for (i = 0; i < 32; i++) {
 		if (!g_ascii_isxdigit (in[i]))
 			return FALSE;
 	}
@@ -521,7 +521,9 @@ nm_dhcp_client_stop_existing (const char *pid_file, const char *binary_name)
 		}
 	}
 
-	remove (pid_file);
+	if (remove (pid_file) == -1)
+		nm_log_dbg (LOGD_DHCP, "Could not remove dhcp pid file \"%s\": %d (%s)", pid_file, errno, g_strerror (errno));
+
 	g_free (proc_path);
 	g_free (pid_contents);
 	g_free (proc_contents);
diff --git a/src/dhcp-manager/nm-dhcp-dhclient.c b/src/dhcp-manager/nm-dhcp-dhclient.c
index 5f9acf39f9..d9ecdd9b74 100644
--- a/src/dhcp-manager/nm-dhcp-dhclient.c
+++ b/src/dhcp-manager/nm-dhcp-dhclient.c
@@ -526,9 +526,11 @@ stop (NMDHCPClient *client, gboolean release, const GByteArray *duid)
 	NM_DHCP_CLIENT_CLASS (nm_dhcp_dhclient_parent_class)->stop (client, release, duid);
 
 	if (priv->conf_file)
-		remove (priv->conf_file);
+		if (remove (priv->conf_file) == -1)
+			nm_log_dbg (LOGD_DHCP, "Could not remove dhcp config file \"%s\": %d (%s)", priv->conf_file, errno, g_strerror (errno));
 	if (priv->pid_file) {
-		remove (priv->pid_file);
+		if (remove (priv->pid_file) == -1)
+			nm_log_dbg (LOGD_DHCP, "Could not remove dhcp pid file \"%s\": %d (%s)", priv->pid_file, errno, g_strerror (errno));
 		g_free (priv->pid_file);
 		priv->pid_file = NULL;
 	}
diff --git a/src/dhcp-manager/nm-dhcp-dhcpcd.c b/src/dhcp-manager/nm-dhcp-dhcpcd.c
index 2a1e0681cc..9a9ec8af6f 100644
--- a/src/dhcp-manager/nm-dhcp-dhcpcd.c
+++ b/src/dhcp-manager/nm-dhcp-dhcpcd.c
@@ -96,12 +96,11 @@ ip4_start (NMDHCPClient *client,
 	GPid pid = -1;
 	GError *error = NULL;
 	char *pid_contents = NULL, *binary_name, *cmd_str;
-	const char *iface, *uuid;
+	const char *iface;
 
 	g_return_val_if_fail (priv->pid_file == NULL, -1);
 
 	iface = nm_dhcp_client_get_iface (client);
-	uuid = nm_dhcp_client_get_uuid (client);
 
 	priv->pid_file = g_strdup_printf (NMSTATEDIR "/dhcpcd-%s.pid", iface);
 
@@ -175,7 +174,8 @@ stop (NMDHCPClient *client, gboolean release, const GByteArray *duid)
 	NM_DHCP_CLIENT_CLASS (nm_dhcp_dhcpcd_parent_class)->stop (client, release, duid);
 
 	if (priv->pid_file)
-		remove (priv->pid_file);
+		if (remove (priv->pid_file) == -1)
+			nm_log_dbg (LOGD_DHCP, "Could not remove dhcp pid file \"%s\": %d (%s)", priv->pid_file, errno, g_strerror (errno));
 
 	/* FIXME: implement release... */
 }
diff --git a/src/dhcp-manager/nm-dhcp-manager.c b/src/dhcp-manager/nm-dhcp-manager.c
index 89d651864e..c0e4a56d32 100644
--- a/src/dhcp-manager/nm-dhcp-manager.c
+++ b/src/dhcp-manager/nm-dhcp-manager.c
@@ -193,17 +193,13 @@ nm_dhcp_manager_handle_event (DBusGProxy *proxy,
                               GHashTable *options,
                               gpointer user_data)
 {
-	NMDHCPManager *manager;
-	NMDHCPManagerPrivate *priv;
+	NMDHCPManager *manager = NM_DHCP_MANAGER (user_data);
 	NMDHCPClient *client;
 	char *iface = NULL;
 	char *pid_str = NULL;
 	char *reason = NULL;
 	unsigned long temp;
 
-	manager = NM_DHCP_MANAGER (user_data);
-	priv = NM_DHCP_MANAGER_GET_PRIVATE (manager);
-
 	iface = get_option (options, "interface");
 	if (iface == NULL) {
 		nm_log_warn (LOGD_DHCP, "DHCP event didn't have associated interface.");
@@ -299,8 +295,10 @@ get_client_type (const char *client, GError **error)
 	/* If a client was disabled at build-time, its *_PATH define will be
 	 * an empty string.
 	 */
+	/* coverity[array_null] */
 	if (DHCLIENT_PATH && strlen (DHCLIENT_PATH))
 		dhclient_path = nm_dhcp_dhclient_get_path (DHCLIENT_PATH);
+	/* coverity[array_null] */
 	if (DHCPCD_PATH && strlen (DHCPCD_PATH))
 		dhcpcd_path = nm_dhcp_dhcpcd_get_path (DHCPCD_PATH);
 
diff --git a/src/dns-manager/nm-dns-utils.c b/src/dns-manager/nm-dns-utils.c
index 0125107ee3..3e564ace33 100644
--- a/src/dns-manager/nm-dns-utils.c
+++ b/src/dns-manager/nm-dns-utils.c
@@ -46,7 +46,10 @@ add_ip4_to_rdns_array (guint32 ip, GPtrArray *domains) /* network byte order */
 	else if (defprefix == 24)
 		str = g_strdup_printf ("%u.%u.%u.in-addr.arpa", p[2] & 0xFF, p[1] & 0xFF, p[0] & 0xFF);
 
-	g_return_if_fail (str != NULL);
+	if (!str) {
+		g_return_if_fail (str != NULL);
+		return;
+	}
 
 	/* Suppress duplicates */
 	for (i = 0; i < domains->len; i++) {
diff --git a/src/modem-manager/nm-modem-manager.c b/src/modem-manager/nm-modem-manager.c
index c125c5e401..427d98c289 100644
--- a/src/modem-manager/nm-modem-manager.c
+++ b/src/modem-manager/nm-modem-manager.c
@@ -187,23 +187,22 @@ poke_modem_cb (gpointer user_data)
 	NMModemManager *self = NM_MODEM_MANAGER (user_data);
 	DBusGConnection *g_connection;
 	DBusGProxy *proxy;
-	DBusGProxyCall *call;
 
 	g_connection = nm_dbus_manager_get_connection (self->priv->dbus_mgr);
 	proxy = dbus_g_proxy_new_for_name (g_connection,
-									   MM_OLD_DBUS_SERVICE,
-									   MM_OLD_DBUS_PATH,
-									   MM_OLD_DBUS_INTERFACE);
+	                                   MM_OLD_DBUS_SERVICE,
+	                                   MM_OLD_DBUS_PATH,
+	                                   MM_OLD_DBUS_INTERFACE);
 
 	nm_log_dbg (LOGD_MB, "Requesting to (re)launch modem-manager...");
 
-	call = dbus_g_proxy_begin_call_with_timeout (proxy,
-	                                             "EnumerateDevices",
-	                                             mm_poke_cb,
-	                                             NULL,
-	                                             NULL,
-	                                             5000,
-	                                             G_TYPE_INVALID);
+	dbus_g_proxy_begin_call_with_timeout (proxy,
+	                                      "EnumerateDevices",
+	                                      mm_poke_cb,
+	                                      NULL,
+	                                      NULL,
+	                                      5000,
+	                                      G_TYPE_INVALID);
 	return TRUE;
 }
 
diff --git a/src/nm-dbus-manager.c b/src/nm-dbus-manager.c
index e9d5fce5c1..b1aa61be6d 100644
--- a/src/nm-dbus-manager.c
+++ b/src/nm-dbus-manager.c
@@ -23,6 +23,7 @@
 #include <unistd.h>
 #include <sys/stat.h>
 #include <sys/types.h>
+#include <errno.h>
 
 #include "NetworkManager.h"
 #include "nm-dbus-manager.h"
@@ -476,7 +477,8 @@ nm_dbus_manager_init (NMDBusManager *self)
 
 #if HAVE_DBUS_GLIB_100
 	/* Set up our main private DBus socket */
-	mkdir (NMRUNDIR, 0700);
+	if (mkdir (NMRUNDIR, 0700) == -1)
+		nm_log_warn (LOGD_CORE, "Error creating directory \"%s\": %d (%s)", NMRUNDIR, errno, g_strerror (errno));
 	priv->priv_server = private_server_new (PRIV_SOCK_PATH, PRIV_SOCK_TAG, self);
 	if (priv->priv_server) {
 		priv->private_servers = g_slist_append (priv->private_servers, priv->priv_server);
diff --git a/src/nm-dispatcher.c b/src/nm-dispatcher.c
index 45715a9911..fafc9041a5 100644
--- a/src/nm-dispatcher.c
+++ b/src/nm-dispatcher.c
@@ -213,8 +213,8 @@ dispatcher_done_cb (DBusGProxy *proxy, DBusGProxyCall *call, gpointer user_data)
 			err = g_value_get_string (tmp);
 
 			if (result != DISPATCH_RESULT_SUCCESS) {
-				nm_log_warn (LOGD_CORE, "Dispatcher script %s: %s",
-				             dispatch_result_to_string (result), err);
+				nm_log_warn (LOGD_CORE, "Dispatcher script \"%s\" failed with %s: %s",
+				             script, dispatch_result_to_string (result), err);
 			}
 
 next:
@@ -282,7 +282,6 @@ _dispatcher_call (DispatcherAction action,
 	GHashTable *device_dhcp6_props;
 	GHashTable *vpn_ip4_props;
 	GHashTable *vpn_ip6_props;
-	DBusGProxyCall *call;
 	DispatchInfo *info;
 
 	/* All actions except 'hostname' require a device */
@@ -339,23 +338,23 @@ _dispatcher_call (DispatcherAction action,
 	info->user_data = user_data;
 
 	/* Send the action to the dispatcher */
-	call = dbus_g_proxy_begin_call_with_timeout (proxy, "Action",
-	                                             dispatcher_done_cb,
-	                                             info,
-	                                             (GDestroyNotify) dispatcher_info_free,
-	                                             15000,
-	                                             G_TYPE_STRING, action_to_string (action),
-	                                             DBUS_TYPE_G_MAP_OF_MAP_OF_VARIANT, connection_hash,
-	                                             DBUS_TYPE_G_MAP_OF_VARIANT, connection_props,
-	                                             DBUS_TYPE_G_MAP_OF_VARIANT, device_props,
-	                                             DBUS_TYPE_G_MAP_OF_VARIANT, device_ip4_props,
-	                                             DBUS_TYPE_G_MAP_OF_VARIANT, device_ip6_props,
-	                                             DBUS_TYPE_G_MAP_OF_VARIANT, device_dhcp4_props,
-	                                             DBUS_TYPE_G_MAP_OF_VARIANT, device_dhcp6_props,
-	                                             G_TYPE_STRING, vpn_iface ? vpn_iface : "",
-	                                             DBUS_TYPE_G_MAP_OF_VARIANT, vpn_ip4_props,
-	                                             DBUS_TYPE_G_MAP_OF_VARIANT, vpn_ip6_props,
-	                                             G_TYPE_INVALID);
+	dbus_g_proxy_begin_call_with_timeout (proxy, "Action",
+	                                      dispatcher_done_cb,
+	                                      info,
+	                                      (GDestroyNotify) dispatcher_info_free,
+	                                      15000,
+	                                      G_TYPE_STRING, action_to_string (action),
+	                                      DBUS_TYPE_G_MAP_OF_MAP_OF_VARIANT, connection_hash,
+	                                      DBUS_TYPE_G_MAP_OF_VARIANT, connection_props,
+	                                      DBUS_TYPE_G_MAP_OF_VARIANT, device_props,
+	                                      DBUS_TYPE_G_MAP_OF_VARIANT, device_ip4_props,
+	                                      DBUS_TYPE_G_MAP_OF_VARIANT, device_ip6_props,
+	                                      DBUS_TYPE_G_MAP_OF_VARIANT, device_dhcp4_props,
+	                                      DBUS_TYPE_G_MAP_OF_VARIANT, device_dhcp6_props,
+	                                      G_TYPE_STRING, vpn_iface ? vpn_iface : "",
+	                                      DBUS_TYPE_G_MAP_OF_VARIANT, vpn_ip4_props,
+	                                      DBUS_TYPE_G_MAP_OF_VARIANT, vpn_ip6_props,
+	                                      G_TYPE_INVALID);
 	g_hash_table_destroy (connection_hash);
 	g_hash_table_destroy (connection_props);
 	g_hash_table_destroy (device_props);
diff --git a/src/nm-manager.c b/src/nm-manager.c
index 313b67bbad..7555930d7a 100644
--- a/src/nm-manager.c
+++ b/src/nm-manager.c
@@ -2662,6 +2662,10 @@ _internal_activate_device (NMManager *self, NMActiveConnection *active, GError *
 	NMConnection *connection;
 	NMConnection *master_connection = NULL;
 
+	g_return_val_if_fail (NM_IS_MANAGER (self), FALSE);
+	g_return_val_if_fail (NM_IS_ACTIVE_CONNECTION (active), FALSE);
+	g_return_val_if_fail (error == NULL || *error == NULL, FALSE);
+
 	g_assert (NM_IS_VPN_CONNECTION (active) == FALSE);
 
 	connection = nm_active_connection_get_connection (active);
@@ -2937,8 +2941,8 @@ _internal_activation_auth_done (NMActiveConnection *active,
 	if (success) {
 		if (_internal_activate_generic (self, active, &error))
 			return;
-		g_assert (error);
 	}
+	g_assert (error_desc || error);
 
 	active_connection_remove (self, active);
 	nm_log_warn (LOGD_CORE, "Failed to activate '%s': %s",
@@ -2955,7 +2959,6 @@ nm_manager_activate_connection (NMManager *self,
                                 NMAuthSubject *subject,
                                 GError **error)
 {
-	NMManagerPrivate *priv;
 	NMActiveConnection *active;
 
 	g_return_val_if_fail (self != NULL, NULL);
@@ -2963,8 +2966,6 @@ nm_manager_activate_connection (NMManager *self,
 	g_return_val_if_fail (error != NULL, NULL);
 	g_return_val_if_fail (*error == NULL, NULL);
 
-	priv = NM_MANAGER_GET_PRIVATE (self);
-
 	active = _new_active_connection (self,
 	                                 connection,
 	                                 specific_object,
diff --git a/src/nm-policy.c b/src/nm-policy.c
index 35ca1811d5..fe21d40e51 100644
--- a/src/nm-policy.c
+++ b/src/nm-policy.c
@@ -677,7 +677,7 @@ update_ip4_routing (NMPolicy *policy, gboolean force_update)
 		int mss = nm_ip4_config_get_mss (ip4_config);
 
 		if (!nm_platform_ip4_route_add (ip_ifindex, 0, 0, int_gw, 0, mss)) {
-			nm_platform_ip4_route_add (parent_ifindex, gw_addr, 32, 0, 0, parent_mss);
+			(void) nm_platform_ip4_route_add (parent_ifindex, gw_addr, 32, 0, 0, parent_mss);
 			if (!nm_platform_ip4_route_add (ip_ifindex, 0, 0, int_gw, 0, mss)) {
 				nm_log_err (LOGD_IP4 | LOGD_VPN, "Failed to set default route.");
 			}
@@ -688,7 +688,7 @@ update_ip4_routing (NMPolicy *policy, gboolean force_update)
 		int mss = nm_ip4_config_get_mss (ip4_config);
 
 		if (!nm_platform_ip4_route_add (ip_ifindex, 0, 0, gw_addr, 0, mss)) {
-			nm_platform_ip4_route_add (ip_ifindex, gw_addr, 32, 0, 0, mss);
+			(void) nm_platform_ip4_route_add (ip_ifindex, gw_addr, 32, 0, 0, mss);
 			if (!nm_platform_ip4_route_add (ip_ifindex, 0, 0, gw_addr, 0, mss)) {
 				nm_log_err (LOGD_IP4, "Failed to set default route.");
 			}
@@ -867,7 +867,7 @@ update_ip6_routing (NMPolicy *policy, gboolean force_update)
 			int_gw = &in6addr_any;
 
 		if (!nm_platform_ip6_route_add (ip_ifindex, in6addr_any, 0, *int_gw, 0, mss)) {
-			nm_platform_ip6_route_add (parent_ifindex, *gw_addr, 128, in6addr_any, 0, parent_mss);
+			(void) nm_platform_ip6_route_add (parent_ifindex, *gw_addr, 128, in6addr_any, 0, parent_mss);
 			if (!nm_platform_ip6_route_add (ip_ifindex, in6addr_any, 0, *int_gw, 0, mss)) {
 				nm_log_err (LOGD_IP6 | LOGD_VPN, "Failed to set default route.");
 			}
@@ -878,7 +878,7 @@ update_ip6_routing (NMPolicy *policy, gboolean force_update)
 		int mss = nm_ip6_config_get_mss (ip6_config);
 
 		if (!nm_platform_ip6_route_add (ip_ifindex, in6addr_any, 0, *gw_addr, 0, mss)) {
-			nm_platform_ip6_route_add (ip_ifindex, *gw_addr, 128, in6addr_any, 0, mss);
+			(void) nm_platform_ip6_route_add (ip_ifindex, *gw_addr, 128, in6addr_any, 0, mss);
 			if (!nm_platform_ip6_route_add (ip_ifindex, in6addr_any, 0, *gw_addr, 0, mss)) {
 				nm_log_err (LOGD_IP6, "Failed to set default route.");
 			}
@@ -1740,15 +1740,10 @@ vpn_connection_deactivated (NMPolicy *policy, NMVPNConnection *vpn)
 	NMDnsManager *mgr;
 	NMIP4Config *ip4_config;
 	NMIP6Config *ip6_config;
-	const char *ip_iface;
-	NMDevice *parent;
 
 	mgr = nm_dns_manager_get ();
 	nm_dns_manager_begin_updates (mgr, __func__);
 
-	ip_iface = nm_vpn_connection_get_ip_iface (vpn);
-	parent = nm_active_connection_get_device (NM_ACTIVE_CONNECTION (vpn));
-
 	ip4_config = nm_vpn_connection_get_ip4_config (vpn);
 	if (ip4_config) {
 		/* Remove the VPN connection's IP4 config from DNS */
diff --git a/src/nm-wifi-ap-utils.c b/src/nm-wifi-ap-utils.c
index 24fb980af2..26886e86d0 100644
--- a/src/nm-wifi-ap-utils.c
+++ b/src/nm-wifi-ap-utils.c
@@ -302,7 +302,7 @@ verify_wpa_psk (NMSettingWirelessSecurity *s_wsec,
 			/* Ad-Hoc WPA requires 'wpa' proto, 'none' pairwise, and 'tkip' group */
 			n = nm_setting_wireless_security_get_num_protos (s_wsec);
 			tmp = (n > 0) ? nm_setting_wireless_security_get_proto (s_wsec, 0) : NULL;
-			if (n > 1 || strcmp (tmp, "wpa")) {
+			if (n > 1 || !tmp || strcmp (tmp, "wpa")) {
 				g_set_error_literal (error,
 				                     NM_SETTING_WIRELESS_SECURITY_ERROR,
 				                     NM_SETTING_WIRELESS_SECURITY_ERROR_INVALID_PROPERTY,
@@ -312,7 +312,7 @@ verify_wpa_psk (NMSettingWirelessSecurity *s_wsec,
 
 			n = nm_setting_wireless_security_get_num_pairwise (s_wsec);
 			tmp = (n > 0) ? nm_setting_wireless_security_get_pairwise (s_wsec, 0) : NULL;
-			if (n > 1 || strcmp (tmp, "none")) {
+			if (n > 1 || !tmp || strcmp (tmp, "none")) {
 				g_set_error_literal (error,
 				                     NM_SETTING_WIRELESS_SECURITY_ERROR,
 				                     NM_SETTING_WIRELESS_SECURITY_ERROR_INVALID_PROPERTY,
@@ -322,7 +322,7 @@ verify_wpa_psk (NMSettingWirelessSecurity *s_wsec,
 
 			n = nm_setting_wireless_security_get_num_groups (s_wsec);
 			tmp = (n > 0) ? nm_setting_wireless_security_get_group (s_wsec, 0) : NULL;
-			if (n > 1 || strcmp (tmp, "tkip")) {
+			if (n > 1 || !tmp || strcmp (tmp, "tkip")) {
 				g_set_error_literal (error,
 				                     NM_SETTING_WIRELESS_SECURITY_ERROR,
 				                     NM_SETTING_WIRELESS_SECURITY_ERROR_INVALID_PROPERTY,
diff --git a/src/platform/nm-platform.c b/src/platform/nm-platform.c
index f132f2997b..788e695081 100644
--- a/src/platform/nm-platform.c
+++ b/src/platform/nm-platform.c
@@ -1147,7 +1147,6 @@ nm_platform_ip4_address_add (int ifindex, in_addr_t address, int plen, guint32 l
 	g_return_val_if_fail (ifindex > 0, FALSE);
 	g_return_val_if_fail (plen > 0, FALSE);
 	g_return_val_if_fail (lifetime > 0, FALSE);
-	g_return_val_if_fail (preferred >= 0, FALSE);
 	g_return_val_if_fail (klass->ip4_address_add, FALSE);
 
 	debug ("address: adding or updating IPv4 address");
@@ -1162,7 +1161,6 @@ nm_platform_ip6_address_add (int ifindex, struct in6_addr address, int plen, gui
 	g_return_val_if_fail (ifindex > 0, FALSE);
 	g_return_val_if_fail (plen > 0, FALSE);
 	g_return_val_if_fail (lifetime > 0, FALSE);
-	g_return_val_if_fail (preferred >= 0, FALSE);
 	g_return_val_if_fail (klass->ip6_address_add, FALSE);
 
 	debug ("address: adding or updating IPv6 address");
diff --git a/src/platform/tests/dump.c b/src/platform/tests/dump.c
index 038082afec..6399585170 100644
--- a/src/platform/tests/dump.c
+++ b/src/platform/tests/dump.c
@@ -43,7 +43,8 @@ dump_interface (NMPlatformLink *link)
 	if (link->driver)
 		printf ("    driver: %s\n", link->driver);
 	printf ("    UDI: %s\n", link->udi);
-	nm_platform_vlan_get_info (link->ifindex, &vlan_parent, &vlan_id);
+	if (!nm_platform_vlan_get_info (link->ifindex, &vlan_parent, &vlan_id))
+		g_assert_not_reached ();
 	if (vlan_parent)
 		printf ("    vlan parent %d id %d\n", vlan_parent, vlan_id);
 
diff --git a/src/platform/tests/test-common.c b/src/platform/tests/test-common.c
index 5911cce9fa..3cf0864512 100644
--- a/src/platform/tests/test-common.c
+++ b/src/platform/tests/test-common.c
@@ -101,8 +101,8 @@ run_command (const char *format, ...)
 	va_list ap;
 
 	va_start (ap, format);
-
 	command = g_strdup_vprintf (format, ap);
+	va_end (ap);
 	debug ("Running command: %s", command);
 	g_assert (!system (command));
 	debug ("Command finished.");
diff --git a/src/ppp-manager/nm-pppd-plugin.c b/src/ppp-manager/nm-pppd-plugin.c
index e2e5c70995..2f9903a24a 100644
--- a/src/ppp-manager/nm-pppd-plugin.c
+++ b/src/ppp-manager/nm-pppd-plugin.c
@@ -264,17 +264,16 @@ get_credentials (char *username, char *password)
 		return 1;
 	}
 
+	g_return_val_if_fail (username && password, -1);
 	g_return_val_if_fail (DBUS_IS_G_PROXY (proxy), -1);
 
 	g_message ("nm-ppp-plugin: (%s): passwd-hook, requesting credentials...", __func__);
 
-	dbus_g_proxy_call (proxy, "NeedSecrets", &err,
-	                   G_TYPE_INVALID,
-	                   G_TYPE_STRING, &my_username,
-	                   G_TYPE_STRING, &my_password,
-	                   G_TYPE_INVALID);
-
-	if (err) {
+	if (!dbus_g_proxy_call (proxy, "NeedSecrets", &err,
+	                        G_TYPE_INVALID,
+	                        G_TYPE_STRING, &my_username,
+	                        G_TYPE_STRING, &my_password,
+	                        G_TYPE_INVALID)) {
 		g_warning ("nm-ppp-plugin: (%s): could not get secrets: (%d) %s",
 		           __func__,
 		           err ? err->code : -1,
diff --git a/src/settings/nm-agent-manager.c b/src/settings/nm-agent-manager.c
index 33fbbe7ff3..89cfd3030c 100644
--- a/src/settings/nm-agent-manager.c
+++ b/src/settings/nm-agent-manager.c
@@ -887,7 +887,7 @@ get_agent_request_secrets (ConnectionRequest *req, gboolean include_system_secre
 	nm_connection_clear_secrets (tmp);
 	if (include_system_secrets) {
 		if (req->existing_secrets)
-			nm_connection_update_secrets (tmp, req->setting_name, req->existing_secrets, NULL);
+			(void) nm_connection_update_secrets (tmp, req->setting_name, req->existing_secrets, NULL);
 	} else {
 		/* Update secret flags in the temporary connection to indicate that
 		 * the system secrets we're not sending to the agent aren't required,
diff --git a/src/settings/nm-settings-connection.c b/src/settings/nm-settings-connection.c
index 7dce397b8c..f1bc3c324a 100644
--- a/src/settings/nm-settings-connection.c
+++ b/src/settings/nm-settings-connection.c
@@ -462,7 +462,7 @@ nm_settings_connection_replace_settings (NMSettingsConnection *self,
 		if (priv->agent_secrets) {
 			hash = nm_connection_to_hash (priv->agent_secrets, NM_SETTING_HASH_FLAG_ONLY_SECRETS);
 			if (hash) {
-				nm_connection_update_secrets (NM_CONNECTION (self), NULL, hash, NULL);
+				(void) nm_connection_update_secrets (NM_CONNECTION (self), NULL, hash, NULL);
 				g_hash_table_destroy (hash);
 			}
 		}
diff --git a/src/settings/plugins/ifcfg-rh/reader.c b/src/settings/plugins/ifcfg-rh/reader.c
index e923eaab2d..e2cff0b2cf 100644
--- a/src/settings/plugins/ifcfg-rh/reader.c
+++ b/src/settings/plugins/ifcfg-rh/reader.c
@@ -3254,6 +3254,7 @@ make_wpa_setting (shvarFile *ifcfg,
 		g_free (allow_rsn);
 	}
 
+	/* coverity[dereference] */
 	if (!strcmp (value, "WPA-PSK")) {
 		NMSettingSecretFlags psk_flags;
 
diff --git a/src/settings/plugins/ifcfg-rh/shvar.c b/src/settings/plugins/ifcfg-rh/shvar.c
index 7e64816c17..d6283bb65c 100644
--- a/src/settings/plugins/ifcfg-rh/shvar.c
+++ b/src/settings/plugins/ifcfg-rh/shvar.c
@@ -366,6 +366,8 @@ svWriteFile(shvarFile *s, int mode)
 	    return -1;
 
 	tmpfd = dup(s->fd);
+	if (tmpfd == -1)
+		return -1;
 	f = fdopen(tmpfd, "w");
 	fseek(f, 0, SEEK_SET);
 	for (s->current = s->lineList; s->current; s->current = s->current->next) {
diff --git a/src/settings/plugins/keyfile/reader.c b/src/settings/plugins/keyfile/reader.c
index 9dae93a7e4..e8c06ff4af 100644
--- a/src/settings/plugins/keyfile/reader.c
+++ b/src/settings/plugins/keyfile/reader.c
@@ -1009,7 +1009,7 @@ read_one_setting_value (NMSetting *setting,
 	/* If there's a custom parser for this key, handle that before the generic
 	 * parsers below.
 	 */
-	if (parser && parser->setting_name) {
+	if (parser->setting_name) {
 		(*parser->parser) (setting, key, info->keyfile, info->keyfile_path);
 		return;
 	}
diff --git a/src/settings/plugins/keyfile/writer.c b/src/settings/plugins/keyfile/writer.c
index c94ca46fed..dc205f1d10 100644
--- a/src/settings/plugins/keyfile/writer.c
+++ b/src/settings/plugins/keyfile/writer.c
@@ -712,7 +712,10 @@ cert_writer (GKeyFile *file,
 			break;
 		}
 	}
-	g_return_if_fail (objtype != NULL);
+	if (!objtype) {
+		g_return_if_fail (objtype);
+		return;
+	}
 
 	scheme = objtype->scheme_func (NM_SETTING_802_1X (setting));
 	if (scheme == NM_SETTING_802_1X_CK_SCHEME_PATH) {
@@ -902,7 +905,7 @@ write_setting_value (NMSetting *setting,
 	 * the secret flags there are in a third-level hash in the 'secrets'
 	 * property.
 	 */
-	if (pspec->flags & NM_SETTING_PARAM_SECRET && !NM_IS_SETTING_VPN (setting)) {
+	if (pspec && (pspec->flags & NM_SETTING_PARAM_SECRET) && !NM_IS_SETTING_VPN (setting)) {
 		NMSettingSecretFlags secret_flags = NM_SETTING_SECRET_FLAG_NONE;
 
 		nm_setting_get_secret_flags (setting, key, &secret_flags, NULL);
diff --git a/src/supplicant-manager/nm-supplicant-config.c b/src/supplicant-manager/nm-supplicant-config.c
index 446dc21df3..229f5e0025 100644
--- a/src/supplicant-manager/nm-supplicant-config.c
+++ b/src/supplicant-manager/nm-supplicant-config.c
@@ -246,7 +246,7 @@ nm_supplicant_config_set_ap_scan (NMSupplicantConfig * self,
                                   guint32 ap_scan)
 {
 	g_return_if_fail (NM_IS_SUPPLICANT_CONFIG (self));
-	g_return_if_fail (ap_scan >= 0 && ap_scan <= 2);
+	g_return_if_fail (ap_scan <= 2);
 
 	NM_SUPPLICANT_CONFIG_GET_PRIVATE (self)->ap_scan = ap_scan;
 }
diff --git a/src/tests/test-dhcp-options.c b/src/tests/test-dhcp-options.c
index 095f8e570c..effe658647 100644
--- a/src/tests/test-dhcp-options.c
+++ b/src/tests/test-dhcp-options.c
@@ -235,6 +235,7 @@ test_wins_options (const char *client)
 	ASSERT (nm_ip4_config_get_num_addresses (ip4_config) == 1,
 	        "dhcp-wins", "unexpected number of IP addresses");
 	address = nm_ip4_config_get_address (ip4_config, 0);
+	ASSERT (address != NULL, "dhcp-wins", "unexpectedly did not get address #0");
 
 	ASSERT (nm_ip4_config_get_num_wins (ip4_config) == 2,
 	        "dhcp-wins", "unexpected number of WINS servers");
diff --git a/src/vpn-manager/nm-vpn-connection.c b/src/vpn-manager/nm-vpn-connection.c
index 7d3582ad2b..a3b09f28f7 100644
--- a/src/vpn-manager/nm-vpn-connection.c
+++ b/src/vpn-manager/nm-vpn-connection.c
@@ -147,12 +147,12 @@ call_plugin_disconnect (NMVPNConnection *self)
 	GError *error = NULL;
 
 	if (priv->proxy) {
-		dbus_g_proxy_call (priv->proxy, "Disconnect", &error,
-		                   G_TYPE_INVALID,
-		                   G_TYPE_INVALID);
-		if (error)
+		if (!dbus_g_proxy_call (priv->proxy, "Disconnect", &error,
+		                        G_TYPE_INVALID,
+		                        G_TYPE_INVALID)) {
 			nm_log_warn (LOGD_VPN, "error disconnecting VPN: %s", error->message);
-		g_clear_error (&error);
+			g_error_free (error);
+		}
 
 		g_object_unref (priv->proxy);
 		priv->proxy = NULL;
diff --git a/src/wifi/wifi-utils.c b/src/wifi/wifi-utils.c
index fc491ec4f8..aa07a66089 100644
--- a/src/wifi/wifi-utils.c
+++ b/src/wifi/wifi-utils.c
@@ -199,7 +199,6 @@ gboolean
 wifi_utils_set_mesh_channel (WifiData *data, guint32 channel)
 {
 	g_return_val_if_fail (data != NULL, FALSE);
-	g_return_val_if_fail (channel >= 0, FALSE);
 	g_return_val_if_fail (channel <= 13, FALSE);
 	g_return_val_if_fail (data->set_mesh_channel != NULL, FALSE);
 	return data->set_mesh_channel (data, channel);