Fix more problems found by GCC 4.6.0's static checks.

52 files changed, 834 insertions, 378 deletions

diff --git a/ChangeLog b/ChangeLog
index 26fcb77121b..68d780c9c39 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,14 @@
+2011-04-06  Paul Eggert  <eggert@cs.ucla.edu>
+
+	Fix more problems found by GCC 4.6.0's static checks.
+
+	* configure.in (ATTRIBUTE_FORMAT, ATTRIBUTE_FORMAT_PRINTF): New macros.
+
+	Replace 2 copies of readlink code with 1 gnulib version (Bug#8401).
+	* Makefile.in (GNULIB_MODULES): Add careadlinkat.
+	* lib/allocator.h, lib/careadlinkat.c, lib/careadlinkat.h:
+	* m4/ssize_t.m4: New files, automatically generated from gnulib.
+
 2011-04-06  Glenn Morris  <rgm@gnu.org>
 
 	* autogen/update_autogen: Handle loaddefs-like files as well.
diff --git a/Makefile.in b/Makefile.in
index 699589c6920..1ac77ed66ac 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -331,7 +331,7 @@ DOS_gnulib_comp.m4 = gl-comp.m4
 # $(gnulib_srcdir) (relative to $(srcdir) and should have build tools
 # as per $(gnulib_srcdir)/DEPENDENCIES.
 GNULIB_MODULES = \
-  crypto/md5 dtoastr filemode getloadavg getopt-gnu \
+  careadlinkat crypto/md5 dtoastr filemode getloadavg getopt-gnu \
   ignore-value intprops lstat mktime readlink \
   socklen stdio strftime symlink sys_stat
 GNULIB_TOOL_FLAGS = \
diff --git a/configure.in b/configure.in
index 77deef8dba5..fef19f27642 100644
--- a/configure.in
+++ b/configure.in
@@ -3581,6 +3581,20 @@ typedef unsigned size_t;
 #define EXTERNALLY_VISIBLE
 #endif
 
+#if __GNUC__ > 2 || (__GNUC__ == 2 && __GNUC_MINOR__ >= 7)
+# define ATTRIBUTE_FORMAT(spec) __attribute__ ((__format__ spec))
+#else
+# define ATTRIBUTE_FORMAT(spec) /* empty */
+#endif
+
+#if __GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR__ >= 4)
+# define ATTRIBUTE_FORMAT_PRINTF(formatstring_parameter, first_argument) \
+   ATTRIBUTE_FORMAT ((__gnu_printf__, formatstring_parameter, first_argument))
+#else
+# define ATTRIBUTE_FORMAT_PRINTF(formatstring_parameter, first_argument) \
+   ATTRIBUTE_FORMAT ((__printf__, formatstring_parameter, first_argument))
+#endif
+
 /* Some versions of GNU/Linux define noinline in their headers.  */
 #ifdef noinline
 #undef noinline
diff --git a/lib-src/ChangeLog b/lib-src/ChangeLog
index 5007995e14e..eed9dc916b9 100644
--- a/lib-src/ChangeLog
+++ b/lib-src/ChangeLog
@@ -1,3 +1,12 @@
+2011-04-06  Paul Eggert  <eggert@cs.ucla.edu>
+
+	Fix more problems found by GCC 4.6.0's static checks.
+
+	* emacsclient.c (message): Mark it as a printf-like function.
+
+	* make-docfile.c (IF_LINT): New macro, copied from emacsclient.c.
+	(write_c_args): Use it to suppress GCC warning.
+
 2011-03-30  Paul Eggert  <eggert@cs.ucla.edu>
 
 	Fix a problem found by GCC 4.6.0's static checks.
diff --git a/lib-src/emacsclient.c b/lib-src/emacsclient.c
index 737a8d88586..c5231fb9989 100644
--- a/lib-src/emacsclient.c
+++ b/lib-src/emacsclient.c
@@ -487,6 +487,7 @@ ttyname (int fd)
 
 /* Display a normal or error message.
    On Windows, use a message box if compiled as a Windows app.  */
+static void message (int, const char *, ...) ATTRIBUTE_FORMAT_PRINTF (2, 3);
 static void
 message (int is_error, const char *format, ...)
 {
diff --git a/lib-src/make-docfile.c b/lib-src/make-docfile.c
index f900ea42e91..9b804684a12 100644
--- a/lib-src/make-docfile.c
+++ b/lib-src/make-docfile.c
@@ -66,6 +66,13 @@ along with GNU Emacs.  If not, see <http://www.gnu.org/licenses/>.  */
 #define IS_DIRECTORY_SEP(_c_) ((_c_) == DIRECTORY_SEP)
 #endif
 
+/* Use this to suppress gcc's `...may be used before initialized' warnings. */
+#ifdef lint
+# define IF_LINT(Code) Code
+#else
+# define IF_LINT(Code) /* empty */
+#endif
+
 static int scan_file (char *filename);
 static int scan_lisp_file (const char *filename, const char *mode);
 static int scan_c_file (char *filename, const char *mode);
@@ -481,7 +488,7 @@ write_c_args (FILE *out, char *func, char *buf, int minargs, int maxargs)
 {
   register char *p;
   int in_ident = 0;
-  char *ident_start;
+  char *ident_start IF_LINT (= NULL);
   size_t ident_length = 0;
 
   fprintf (out, "(fn");
diff --git a/lib/allocator.h b/lib/allocator.h
new file mode 100644
index 00000000000..4ac863b224c
--- /dev/null
+++ b/lib/allocator.h
@@ -0,0 +1,53 @@
+/* Memory allocators such as malloc+free.
+
+   Copyright (C) 2011 Free Software Foundation, Inc.
+
+   This program is free software: you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
+
+/* Written by Paul Eggert.  */
+
+#ifndef _GL_ALLOCATOR_H
+
+#include <stddef.h>
+
+/* An object describing a memory allocator family.  */
+
+struct allocator
+{
+  /* Do not use GCC attributes such as __attribute__ ((malloc)) with
+     the function types pointed at by these members, because these
+     attributes do not work with pointers to functions.  See
+     <http://lists.gnu.org/archive/html/bug-gnulib/2011-04/msg00007.html>.  */
+
+  /* Call MALLOC to allocate memory, like 'malloc'.  On failure MALLOC
+     should return NULL, though not necessarily set errno.  When given
+     a zero size it may return NULL even if successful.  */
+  void *(*malloc) (size_t);
+
+  /* If nonnull, call REALLOC to reallocate memory, like 'realloc'.
+     On failure REALLOC should return NULL, though not necessarily set
+     errno.  When given a zero size it may return NULL even if
+     successful.  */
+  void *(*realloc) (void *, size_t);
+
+  /* Call FREE to free memory, like 'free'.  */
+  void (*free) (void *);
+
+  /* If nonnull, call DIE if MALLOC or REALLOC fails.  DIE should not
+     return.  DIE can be used by code that detects memory overflow
+     while calculating sizes to be passed to MALLOC or REALLOC.  */
+  void (*die) (void);
+};
+
+#endif
diff --git a/lib/careadlinkat.c b/lib/careadlinkat.c
new file mode 100644
index 00000000000..15ffe24c0f4
--- /dev/null
+++ b/lib/careadlinkat.c
@@ -0,0 +1,175 @@
+/* Read symbolic links into a buffer without size limitation, relative to fd.
+
+   Copyright (C) 2001, 2003-2004, 2007, 2009-2011 Free Software Foundation,
+   Inc.
+
+   This program is free software: you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
+
+/* Written by Paul Eggert, Bruno Haible, and Jim Meyering.  */
+
+#include <config.h>
+
+#include "careadlinkat.h"
+
+#include "allocator.h"
+
+#include <errno.h>
+#include <limits.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+/* Use the system functions, not the gnulib overrides, because this
+   module does not depend on GNU or POSIX semantics.  */
+#undef malloc
+#undef realloc
+
+/* Define this independently so that stdint.h is not a prerequisite.  */
+#ifndef SIZE_MAX
+# define SIZE_MAX ((size_t) -1)
+#endif
+
+#ifndef SSIZE_MAX
+# define SSIZE_MAX ((ssize_t) (SIZE_MAX / 2))
+#endif
+
+#if ! HAVE_READLINKAT
+/* Ignore FD.  Get the symbolic link value of FILENAME and put it into
+   BUFFER, with size BUFFER_SIZE.  This function acts like readlink
+   but has readlinkat's signature.  */
+ssize_t
+careadlinkatcwd (int fd, char const *filename, char *buffer,
+                 size_t buffer_size)
+{
+  (void) fd;
+  return readlink (filename, buffer, buffer_size);
+}
+#endif
+
+/* A standard allocator.  For now, only careadlinkat needs this, but
+   perhaps it should be moved to the allocator module.  */
+static struct allocator const standard_allocator =
+  { malloc, realloc, free, NULL };
+
+/* Assuming the current directory is FD, get the symbolic link value
+   of FILENAME as a null-terminated string and put it into a buffer.
+   If FD is AT_FDCWD, FILENAME is interpreted relative to the current
+   working directory, as in openat.
+
+   If the link is small enough to fit into BUFFER put it there.
+   BUFFER's size is BUFFER_SIZE, and BUFFER can be null
+   if BUFFER_SIZE is zero.
+
+   If the link is not small, put it into a dynamically allocated
+   buffer managed by ALLOC.  It is the caller's responsibility to free
+   the returned value if it is nonnull and is not BUFFER.  A null
+   ALLOC stands for the standard allocator.
+
+   The PREADLINKAT function specifies how to read links.
+
+   If successful, return the buffer address; otherwise return NULL and
+   set errno.  */
+
+char *
+careadlinkat (int fd, char const *filename,
+              char *buffer, size_t buffer_size,
+              struct allocator const *alloc,
+              ssize_t (*preadlinkat) (int, char const *, char *, size_t))
+{
+  char *buf;
+  size_t buf_size;
+  size_t buf_size_max =
+    SSIZE_MAX < SIZE_MAX ? (size_t) SSIZE_MAX + 1 : SIZE_MAX;
+  char stack_buf[1024];
+
+  if (! alloc)
+    alloc = &standard_allocator;
+
+  if (! buffer_size)
+    {
+      /* Allocate the initial buffer on the stack.  This way, in the
+         common case of a symlink of small size, we get away with a
+         single small malloc() instead of a big malloc() followed by a
+         shrinking realloc().  */
+      buffer = stack_buf;
+      buffer_size = sizeof stack_buf;
+    }
+
+  buf = buffer;
+  buf_size = buffer_size;
+
+  do
+    {
+      /* Attempt to read the link into the current buffer.  */
+      ssize_t link_length = preadlinkat (fd, filename, buf, buf_size);
+      size_t link_size;
+      if (link_length < 0)
+        {
+          /* On AIX 5L v5.3 and HP-UX 11i v2 04/09, readlink returns -1
+             with errno == ERANGE if the buffer is too small.  */
+          int readlinkat_errno = errno;
+          if (readlinkat_errno != ERANGE)
+            {
+              if (buf != buffer)
+                {
+                  alloc->free (buf);
+                  errno = readlinkat_errno;
+                }
+              return NULL;
+            }
+        }
+
+      link_size = link_length;
+
+      if (link_size < buf_size)
+        {
+          buf[link_size++] = '\0';
+
+          if (buf == stack_buf)
+            {
+              char *b = (char *) alloc->malloc (link_size);
+              if (! b)
+                break;
+              memcpy (b, buf, link_size);
+              buf = b;
+            }
+          else if (link_size < buf_size && buf != buffer && alloc->realloc)
+            {
+              /* Shrink BUF before returning it.  */
+              char *b = (char *) alloc->realloc (buf, link_size);
+              if (b)
+                buf = b;
+            }
+
+          return buf;
+        }
+
+      if (buf != buffer)
+        alloc->free (buf);
+
+      if (buf_size <= buf_size_max / 2)
+        buf_size *= 2;
+      else if (buf_size < buf_size_max)
+        buf_size = buf_size_max;
+      else
+        break;
+      buf = (char *) alloc->malloc (buf_size);
+    }
+  while (buf);
+
+  if (alloc->die)
+    alloc->die ();
+  errno = ENOMEM;
+  return NULL;
+}
diff --git a/lib/careadlinkat.h b/lib/careadlinkat.h
new file mode 100644
index 00000000000..c5e4bcfc15f
--- /dev/null
+++ b/lib/careadlinkat.h
@@ -0,0 +1,67 @@
+/* Read symbolic links into a buffer without size limitation, relative to fd.
+
+   Copyright (C) 2011 Free Software Foundation, Inc.
+
+   This program is free software: you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
+
+/* Written by Paul Eggert, Bruno Haible, and Jim Meyering.  */
+
+#ifndef _GL_CAREADLINKAT_H
+
+#include <fcntl.h>
+#include <unistd.h>
+
+struct allocator;
+
+/* Assuming the current directory is FD, get the symbolic link value
+   of FILENAME as a null-terminated string and put it into a buffer.
+   If FD is AT_FDCWD, FILENAME is interpreted relative to the current
+   working directory, as in openat.
+
+   If the link is small enough to fit into BUFFER put it there.
+   BUFFER's size is BUFFER_SIZE, and BUFFER can be null
+   if BUFFER_SIZE is zero.
+
+   If the link is not small, put it into a dynamically allocated
+   buffer managed by ALLOC.  It is the caller's responsibility to free
+   the returned value if it is nonnull and is not BUFFER.
+
+   The PREADLINKAT function specifies how to read links.
+
+   If successful, return the buffer address; otherwise return NULL and
+   set errno.  */
+
+char *careadlinkat (int fd, char const *filename,
+                    char *buffer, size_t buffer_size,
+                    struct allocator const *alloc,
+                    ssize_t (*preadlinkat) (int, char const *,
+                                            char *, size_t));
+
+/* Suitable values for careadlinkat's FD and PREADLINKAT arguments,
+   when doing a plain readlink.  */
+#if HAVE_READLINKAT
+# define careadlinkatcwd readlinkat
+#else
+/* Define AT_FDCWD independently, so that the careadlinkat module does
+   not depend on the fcntl-h module.  The value does not matter, since
+   careadlinkatcwd ignores it, but we might as well use the same value
+   as fcntl-h.  */
+# ifndef AT_FDCWD
+#  define AT_FDCWD (-3041965)
+# endif
+ssize_t careadlinkatcwd (int fd, char const *filename,
+                         char *buffer, size_t buffer_size);
+#endif
+
+#endif /* _GL_CAREADLINKAT_H */
diff --git a/lib/gnulib.mk b/lib/gnulib.mk
index 030f95b7a68..bb5bdcf852e 100644
--- a/lib/gnulib.mk
+++ b/lib/gnulib.mk
@@ -9,7 +9,7 @@
 # the same distribution terms as the rest of that program.
 #
 # Generated by gnulib-tool.
-# Reproduce by: gnulib-tool --import --dir=. --lib=libgnu --source-base=lib --m4-base=m4 --doc-base=doc --tests-base=tests --aux-dir=. --makefile-name=gnulib.mk --no-libtool --macro-prefix=gl --no-vc-files crypto/md5 dtoastr filemode getloadavg getopt-gnu ignore-value intprops lstat mktime readlink socklen stdio strftime symlink sys_stat
+# Reproduce by: gnulib-tool --import --dir=. --lib=libgnu --source-base=lib --m4-base=m4 --doc-base=doc --tests-base=tests --aux-dir=. --makefile-name=gnulib.mk --no-libtool --macro-prefix=gl --no-vc-files careadlinkat crypto/md5 dtoastr filemode getloadavg getopt-gnu ignore-value intprops lstat mktime readlink socklen stdio strftime symlink sys_stat
 
 
 MOSTLYCLEANFILES += core *.stackdump
@@ -69,6 +69,14 @@ EXTRA_DIST += $(top_srcdir)/./c++defs.h
 
 ## end   gnulib module c++defs
 
+## begin gnulib module careadlinkat
+
+libgnu_a_SOURCES += careadlinkat.c
+
+EXTRA_DIST += allocator.h careadlinkat.h
+
+## end   gnulib module careadlinkat
+
 ## begin gnulib module crypto/md5
 
 
diff --git a/m4/gl-comp.m4 b/m4/gl-comp.m4
index af3cae75abb..43cce9b3676 100644
--- a/m4/gl-comp.m4
+++ b/m4/gl-comp.m4
@@ -28,6 +28,7 @@ AC_DEFUN([gl_EARLY],
   AC_REQUIRE([AC_PROG_RANLIB])
   # Code from module arg-nonnull:
   # Code from module c++defs:
+  # Code from module careadlinkat:
   # Code from module crypto/md5:
   # Code from module dosname:
   # Code from module dtoastr:
@@ -46,6 +47,7 @@ AC_DEFUN([gl_EARLY],
   # Code from module multiarch:
   # Code from module readlink:
   # Code from module socklen:
+  # Code from module ssize_t:
   # Code from module stat:
   # Code from module stdbool:
   # Code from module stddef:
@@ -79,6 +81,8 @@ AC_DEFUN([gl_INIT],
   gl_source_base='lib'
   # Code from module arg-nonnull:
   # Code from module c++defs:
+  # Code from module careadlinkat:
+  AC_CHECK_FUNCS_ONCE([readlinkat])
   # Code from module crypto/md5:
   gl_MD5
   # Code from module dosname:
@@ -115,6 +119,8 @@ AC_DEFUN([gl_INIT],
   gl_UNISTD_MODULE_INDICATOR([readlink])
   # Code from module socklen:
   gl_TYPE_SOCKLEN_T
+  # Code from module ssize_t:
+  gt_TYPE_SSIZE_T
   # Code from module stat:
   gl_FUNC_STAT
   gl_SYS_STAT_MODULE_INDICATOR([stat])
@@ -287,6 +293,9 @@ AC_DEFUN([gl_FILE_LIST], [
   build-aux/arg-nonnull.h
   build-aux/c++defs.h
   build-aux/warn-on-use.h
+  lib/allocator.h
+  lib/careadlinkat.c
+  lib/careadlinkat.h
   lib/dosname.h
   lib/dtoastr.c
   lib/filemode.c
@@ -335,6 +344,7 @@ AC_DEFUN([gl_FILE_LIST], [
   m4/multiarch.m4
   m4/readlink.m4
   m4/socklen.m4
+  m4/ssize_t.m4
   m4/st_dm_mode.m4
   m4/stat.m4
   m4/stdbool.m4
diff --git a/m4/ssize_t.m4 b/m4/ssize_t.m4
new file mode 100644
index 00000000000..d7127521ebe
--- /dev/null
+++ b/m4/ssize_t.m4
@@ -0,0 +1,23 @@
+# ssize_t.m4 serial 5 (gettext-0.18.2)
+dnl Copyright (C) 2001-2003, 2006, 2010-2011 Free Software Foundation, Inc.
+dnl This file is free software; the Free Software Foundation
+dnl gives unlimited permission to copy and/or distribute it,
+dnl with or without modifications, as long as this notice is preserved.
+
+dnl From Bruno Haible.
+dnl Test whether ssize_t is defined.
+
+AC_DEFUN([gt_TYPE_SSIZE_T],
+[
+  AC_CACHE_CHECK([for ssize_t], [gt_cv_ssize_t],
+    [AC_COMPILE_IFELSE(
+       [AC_LANG_PROGRAM(
+          [[#include <sys/types.h>]],
+          [[int x = sizeof (ssize_t *) + sizeof (ssize_t);
+            return !x;]])],
+       [gt_cv_ssize_t=yes], [gt_cv_ssize_t=no])])
+  if test $gt_cv_ssize_t = no; then
+    AC_DEFINE([ssize_t], [int],
+              [Define as a signed type of the same size as size_t.])
+  fi
+])
diff --git a/src/ChangeLog b/src/ChangeLog
index d12969fe46a..8a2e2396d74 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,167 @@
+2011-04-06  Paul Eggert  <eggert@cs.ucla.edu>
+
+	Fix more problems found by GCC 4.6.0's static checks.
+
+	* xmenu.c (Fx_popup_dialog): Don't assume string is free of formats.
+
+	* menu.c (Fx_popup_menu): Don't assume error_name lacks printf formats.
+
+	* lisp.h (message, message_nolog, fatal): Mark as printf-like.
+
+	* xdisp.c (vmessage): Mark as a printf-like function.
+
+	* term.c (vfatal, maybe_fatal): Mark as printf-like functions.
+
+	* sound.c (sound_warning): Don't crash if arg contains a printf format.
+
+	* image.c (tiff_error_handler, tiff_warning_handler): Mark as
+	printf-like functions.
+	(tiff_load): Add casts to remove these marks before passing them
+	to system-supplied API.
+
+	* eval.c (Fsignal): Remove excess argument to 'fatal'.
+
+	* coding.c (EMIT_ONE_BYTE, EMIT_TWO_BYTES): Use unsigned, not int.
+	This avoids several warnings with gcc -Wstrict-overflow.
+	(DECODE_COMPOSITION_RULE): If the rule is invalid, goto invalid_code
+	directly, rather than having caller test rule sign.  This avoids
+	some unnecessary tests.
+	* composite.h (COMPOSITION_ENCODE_RULE_VALID): New macro.
+	(COMPOSITION_ENCODE_RULE): Arguments now must be valid.  This
+	affects only one use, in DECODE_COMPOSITION_RULE, which is changed.
+
+	* xfont.c (xfont_text_extents): Remove var that was set but not used.
+	(xfont_open): Avoid unnecessary tests.
+
+	* composite.c (composition_gstring_put_cache): Use unsigned integer.
+
+	* composite.h, composite.c (composition_gstring_put_cache):
+	Use EMACS_INT, not int, for length.
+
+	* composite.h (COMPOSITION_DECODE_REFS): New macro,
+	breaking out part of COMPOSITION_DECODE_RULE.
+	(COMPOSITION_DECODE_RULE): Use it.
+	* composite.c (get_composition_id): Remove unused local vars,
+	by using the new macro.
+
+	* textprop.c (set_text_properties_1): Change while to do-while,
+	since the condition is always true at first.
+
+	* intervals.c (graft_intervals_into_buffer): Mark var as used.
+	(interval_deletion_adjustment): Return unsigned value.
+	All uses changed.
+
+	* process.c (list_processes_1, create_pty, read_process_output):
+	(exec_sentinel): Remove vars that were set but not used.
+	(create_pty): Remove unnecessary "volatile"s.
+	(Fnetwork_interface_info): Avoid possibility of int overflow.
+	(read_process_output): Do adaptive read buffering even if carryover.
+	(read_process_output): Simplify nbytes computation if buffered.
+
+	* bytecode.c (exec_byte_code): Rename local to avoid shadowing.
+
+	* syntax.c (scan_words): Remove var that was set but not used.
+	(update_syntax_table): Use unsigned instead of int.
+
+	* lread.c (lisp_file_lexically_bound_p): Use ints rather than endptrs.
+	(lisp_file_lexically_bound_p, read1): Use unsigned instead of int.
+	(safe_to_load_p): Make the end-of-loop test the inverse of the in-loop.
+
+	* print.c (print_error_message): Avoid int overflow.
+
+	* font.c (font_list_entities): Redo for clarity,
+	so that reader need not know FONT_DPI_INDEX + 1 == FONT_SPACING_INDEX.
+
+	* font.c (font_find_for_lface, Ffont_get_glyphs): Remove unused vars.
+	(font_score): Avoid potential overflow in diff calculation.
+
+	* fns.c (substring_both): Remove var that is set but not used.
+	(sxhash): Redo loop for clarity and to avoid wraparound warning.
+
+	* eval.c (funcall_lambda): Rename local to avoid shadowing.
+
+	* alloc.c (mark_object_loop_halt, mark_object): Use size_t, not int.
+	Otherwise, GCC 4.6.0 optimizes the loop check away since the check
+	can always succeed if overflow has undefined behavior.
+
+	* search.c (boyer_moore, wordify): Remove vars set but not used.
+	(wordify): Omit three unnecessary tests.
+
+	* indent.c (MULTIBYTE_BYTES_WIDTH): Don't compute wide_column.
+	All callers changed.  This avoids the need for an unused var.
+
+	* casefiddle.c (casify_region): Remove var that is set but not used.
+
+	* dired.c (file_name_completion): Remove var that is set but not used.
+
+	* fileio.c (Finsert_file_contents): Make EOF condition clearer.
+
+	* fileio.c (Finsert_file_contents): Avoid signed integer overflow.
+	(Finsert_file_contents): Remove unnecessary code checking fd.
+
+	* minibuf.c (read_minibuf_noninteractive): Use size_t for sizes.
+	Check for integer overflow on size calculations.
+
+	* buffer.c (Fprevious_overlay_change): Remove var that is set
+	but not used.
+
+	* keyboard.c (menu_bar_items, read_char_minibuf_menu_prompt):
+	Remove vars that are set but not used.
+	(timer_check_2): Don't assume timer-list and idle-timer-list are lists.
+	(timer_check_2): Mark vars as initialized.
+
+	* gtkutil.c (xg_get_file_with_chooser): Mark var as initialized.
+
+	* image.c (lookup_image): Remove var that is set but not used.
+	(xbm_load): Use parse_p, for gcc -Werror=unused-but-set-variable.
+
+	* fontset.c (Finternal_char_font, Ffontset_info): Remove vars
+	that are set but not used.
+
+	* xfns.c (make_invisible_cursor): Don't return garbage
+	if XCreateBitmapFromData fails (Bug#8410).
+
+	* xselect.c (x_get_local_selection, x_handle_property_notify):
+	Remove vars that are set but not used.
+
+	* xfns.c (x_create_tip_frame): Remove var that is set but not used.
+	(make_invisible_cursor): Initialize a possibly-uninitialized variable.
+
+	* xterm.c (x_scroll_bar_to_input_event) [!USE_GTK]:
+	Remove var that is set but not used.
+	(scroll_bar_windows_size): Now size_t, not int.
+	(x_send_scroll_bar_event): Use size_t, not int, for sizes.
+	Check for overflow.
+
+	* xfaces.c (realize_named_face): Remove vars that are set but not used.
+	(map_tty_color) [!defined MSDOS]: Likewise.
+
+	* term.c (tty_write_glyphs): Use size_t; this avoids overflow warning.
+
+	* coding.c: Remove vars that are set but not used.
+	(DECODE_COMPOSITION_RULE): Remove 2nd arg, which is unused.
+	All callers changed.
+	(decode_coding_utf_8, decode_coding_utf_16 decode_coding_emacs_mule):
+	(decode_coding_iso_2022, encode_coding_sjis, encode_coding_big5):
+	(decode_coding_charset): Remove vars that are set but not used.
+
+	* bytecode.c (Fbyte_code) [!defined BYTE_CODE_SAFE]: Remove var
+	that is set but not used.
+
+	* print.c (print_object): Remove var that is set but not used.
+
+	Replace 2 copies of readlink code with 1 gnulib version (Bug#8401).
+	The gnulib version avoids calling malloc in the usual case,
+	and on 64-bit hosts doesn't have some arbitrary 32-bit limits.
+	* fileio.c (Ffile_symlink_p): Use emacs_readlink.
+	* filelock.c (current_lock_owner): Likewise.
+	* lisp.h (READLINK_BUFSIZE, emacs_readlink): New function.
+	* sysdep.c: Include allocator.h, careadlinkat.h.
+	(emacs_no_realloc_allocator): New static constant.
+	(emacs_readlink): New function.
+	* deps.mk (sysdep.o): Depend on ../lib/allocator.h and on
+	../lib/careadlinkat.h.
+
 2011-04-04  Stefan Monnier  <monnier@iro.umontreal.ca>
 
 	* keyboard.c (safe_run_hook_funcall): Fix last change (don't stop at the
diff --git a/src/alloc.c b/src/alloc.c
index 07f1caae46b..54c4760abab 100644
--- a/src/alloc.c
+++ b/src/alloc.c
@@ -5221,7 +5221,7 @@ int last_marked_index;
    links of a list, in mark_object.  In debugging,
    the call to abort will hit a breakpoint.
    Normally this is zero and the check never goes off.  */
-static int mark_object_loop_halt;
+static size_t mark_object_loop_halt;
 
 static void
 mark_vectorlike (struct Lisp_Vector *ptr)
@@ -5278,7 +5278,7 @@ mark_object (Lisp_Object arg)
   void *po;
   struct mem_node *m;
 #endif
-  int cdr_count = 0;
+  size_t cdr_count = 0;
 
  loop:
 
diff --git a/src/buffer.c b/src/buffer.c
index cdcd2ccecff..a0054e32d0a 100644
--- a/src/buffer.c
+++ b/src/buffer.c
@@ -4047,7 +4047,6 @@ If there are no overlay boundaries from (point-min) to POS,
 the value is (point-min).  */)
   (Lisp_Object pos)
 {
-  int noverlays;
   EMACS_INT prevpos;
   Lisp_Object *overlay_vec;
   int len;
@@ -4065,8 +4064,8 @@ the value is (point-min).  */)
   /* Put all the overlays we want in a vector in overlay_vec.
      Store the length in len.
      prevpos gets the position of the previous change.  */
-  noverlays = overlays_at (XINT (pos), 1, &overlay_vec, &len,
-			   (EMACS_INT *) 0, &prevpos, 1);
+  overlays_at (XINT (pos), 1, &overlay_vec, &len,
+	       (EMACS_INT *) 0, &prevpos, 1);
 
   xfree (overlay_vec);
   return make_number (prevpos);
diff --git a/src/bytecode.c b/src/bytecode.c
index 5d94cb0fb39..b4a5354a0a4 100644
--- a/src/bytecode.c
+++ b/src/bytecode.c
@@ -447,8 +447,8 @@ exec_byte_code (Lisp_Object bytestr, Lisp_Object vector, Lisp_Object maxdepth,
 #ifdef BYTE_CODE_SAFE
   int const_length = XVECTOR (vector)->size;
   Lisp_Object *stacke;
-#endif
   int bytestr_length;
+#endif
   struct byte_stack stack;
   Lisp_Object *top;
   Lisp_Object result;
@@ -475,7 +475,9 @@ exec_byte_code (Lisp_Object bytestr, Lisp_Object vector, Lisp_Object maxdepth,
        convert them back to the originally intended unibyte form.  */
     bytestr = Fstring_as_unibyte (bytestr);
 
+#ifdef BYTE_CODE_SAFE
   bytestr_length = SBYTES (bytestr);
+#endif
   vectorp = XVECTOR (vector)->contents;
 
   stack.byte_string = bytestr;
@@ -936,12 +938,12 @@ exec_byte_code (Lisp_Object bytestr, Lisp_Object vector, Lisp_Object maxdepth,
 
 	case Bsave_window_excursion: /* Obsolete since 24.1.  */
 	  {
-	    register int count = SPECPDL_INDEX ();
+	    register int count1 = SPECPDL_INDEX ();
 	    record_unwind_protect (Fset_window_configuration,
 				   Fcurrent_window_configuration (Qnil));
 	    BEFORE_POTENTIAL_GC ();
 	    TOP = Fprogn (TOP);
-	    unbind_to (count, TOP);
+	    unbind_to (count1, TOP);
 	    AFTER_POTENTIAL_GC ();
 	    break;
 	  }
diff --git a/src/casefiddle.c b/src/casefiddle.c
index 43ecd38dc7d..9f286d73a5e 100644
--- a/src/casefiddle.c
+++ b/src/casefiddle.c
@@ -200,7 +200,7 @@ casify_region (enum case_action flag, Lisp_Object b, Lisp_Object e)
   register int inword = flag == CASE_DOWN;
   register int multibyte = !NILP (BVAR (current_buffer, enable_multibyte_characters));
   EMACS_INT start, end;
-  EMACS_INT start_byte, end_byte;
+  EMACS_INT start_byte;
 
   /* Position of first and last changes.  */
   EMACS_INT first = -1, last IF_LINT (= 0);
@@ -222,7 +222,6 @@ casify_region (enum case_action flag, Lisp_Object b, Lisp_Object e)
   modify_region (current_buffer, start, end, 0);
   record_change (start, end - start);
   start_byte = CHAR_TO_BYTE (start);
-  end_byte = CHAR_TO_BYTE (end);
 
   SETUP_BUFFER_SYNTAX_TABLE();	/* For syntax_prefix_flag_p.  */
 
diff --git a/src/coding.c b/src/coding.c
index 9e28a1c9f9b..555c29cbdf3 100644
--- a/src/coding.c
+++ b/src/coding.c
@@ -753,7 +753,7 @@ static struct coding_system coding_categories[coding_category_max];
     produced_chars++;			\
     if (multibytep)			\
       {					\
-	int ch = (c);			\
+	unsigned ch = (c);		\
 	if (ch >= 0x80)			\
 	  ch = BYTE8_TO_CHAR (ch);	\
 	CHAR_STRING_ADVANCE (ch, dst);	\
@@ -770,7 +770,7 @@ static struct coding_system coding_categories[coding_category_max];
     produced_chars += 2;		\
     if (multibytep)			\
       {					\
-	int ch;				\
+	unsigned ch;			\
 					\
 	ch = (c1);			\
 	if (ch >= 0x80)			\
@@ -1296,13 +1296,10 @@ decode_coding_utf_8 (struct coding_system *coding)
   int consumed_chars = 0, consumed_chars_base = 0;
   int multibytep = coding->src_multibyte;
   enum utf_bom_type bom = CODING_UTF_8_BOM (coding);
-  Lisp_Object attr, charset_list;
   int eol_dos =
     !inhibit_eol_conversion && EQ (CODING_ID_EOL_TYPE (coding->id), Qdos);
   int byte_after_cr = -1;
 
-  CODING_GET_INFO (coding, attr, charset_list);
-
   if (bom != utf_without_bom)
     {
       int c1, c2, c3;
@@ -1610,13 +1607,10 @@ decode_coding_utf_16 (struct coding_system *coding)
   enum utf_bom_type bom = CODING_UTF_16_BOM (coding);
   enum utf_16_endian_type endian = CODING_UTF_16_ENDIAN (coding);
   int surrogate = CODING_UTF_16_SURROGATE (coding);
-  Lisp_Object attr, charset_list;
   int eol_dos =
     !inhibit_eol_conversion && EQ (CODING_ID_EOL_TYPE (coding->id), Qdos);
   int byte_after_cr1 = -1, byte_after_cr2 = -1;
 
-  CODING_GET_INFO (coding, attr, charset_list);
-
   if (bom == utf_with_bom)
     {
       int c, c1, c2;
@@ -1736,11 +1730,8 @@ encode_coding_utf_16 (struct coding_system *coding)
   enum utf_bom_type bom = CODING_UTF_16_BOM (coding);
   int big_endian = CODING_UTF_16_ENDIAN (coding) == utf_16_big_endian;
   int produced_chars = 0;
-  Lisp_Object attrs, charset_list;
   int c;
 
-  CODING_GET_INFO (coding, attrs, charset_list);
-
   if (bom != utf_without_bom)
     {
       ASSURE_DESTINATION (safe_room);
@@ -2342,7 +2333,6 @@ decode_coding_emacs_mule (struct coding_system *coding)
     = coding->charbuf + coding->charbuf_size - (MAX_ANNOTATION_LENGTH * 3);
   int consumed_chars = 0, consumed_chars_base;
   int multibytep = coding->src_multibyte;
-  Lisp_Object attrs, charset_list;
   int char_offset = coding->produced_char;
   int last_offset = char_offset;
   int last_id = charset_ascii;
@@ -2351,8 +2341,6 @@ decode_coding_emacs_mule (struct coding_system *coding)
   int byte_after_cr = -1;
   struct composition_status *cmp_status = &coding->spec.emacs_mule.cmp_status;
 
-  CODING_GET_INFO (coding, attrs, charset_list);
-
   if (cmp_status->state != COMPOSING_NO)
     {
       int i;
@@ -3265,15 +3253,14 @@ detect_coding_iso_2022 (struct coding_system *coding,
 */
 
 /* Decode a composition rule C1 and maybe one more byte from the
-   source, and set RULE to the encoded composition rule, NBYTES to the
-   length of the composition rule.  If the rule is invalid, set RULE
-   to some negative value.  */
+   source, and set RULE to the encoded composition rule.  If the rule
+   is invalid, goto invalid_code.  */
 
-#define DECODE_COMPOSITION_RULE(rule, nbytes)				\
+#define DECODE_COMPOSITION_RULE(rule)					\
   do {									\
     rule = c1 - 32;							\
     if (rule < 0)							\
-      break;								\
+      goto invalid_code;						\
     if (rule < 81)		/* old format (before ver.21) */	\
       {									\
 	int gref = (rule) / 9;						\
@@ -3281,17 +3268,16 @@ detect_coding_iso_2022 (struct coding_system *coding,
 	if (gref == 4) gref = 10;					\
 	if (nref == 4) nref = 10;					\
 	rule = COMPOSITION_ENCODE_RULE (gref, nref);			\
-	nbytes = 1;							\
       }									\
     else			/* new format (after ver.21) */		\
       {									\
 	int b;								\
 									\
 	ONE_MORE_BYTE (b);						\
+	if (! COMPOSITION_ENCODE_RULE_VALID (rule - 81, b - 32))	\
+	  goto invalid_code;						\
 	rule = COMPOSITION_ENCODE_RULE (rule - 81, b - 32);		\
-	if (rule >= 0)							\
-	  rule += 0x100;   /* to destinguish it from the old format */	\
-	nbytes = 2;							\
+	rule += 0x100;   /* Distinguish it from the old format.  */	\
       }									\
   } while (0)
 
@@ -3476,7 +3462,7 @@ decode_coding_iso_2022 (struct coding_system *coding)
   struct charset *charset;
   int c;
   struct composition_status *cmp_status = CODING_ISO_CMP_STATUS (coding);
-  Lisp_Object attrs, charset_list;
+  Lisp_Object attrs = CODING_ID_ATTRS (coding->id);
   int char_offset = coding->produced_char;
   int last_offset = char_offset;
   int last_id = charset_ascii;
@@ -3485,10 +3471,7 @@ decode_coding_iso_2022 (struct coding_system *coding)
   int byte_after_cr = -1;
   int i;
 
-  CODING_GET_INFO (coding, attrs, charset_list);
   setup_iso_safe_charsets (attrs);
-  /* Charset list may have been changed.  */
-  charset_list = CODING_ATTR_CHARSET_LIST (attrs);
   coding->safe_charsets = SDATA (CODING_ATTR_SAFE_CHARSETS (attrs));
 
   if (cmp_status->state != COMPOSING_NO)
@@ -3558,11 +3541,9 @@ decode_coding_iso_2022 (struct coding_system *coding)
 	   || cmp_status->state == COMPOSING_COMPONENT_RULE)
 	  && c1 != ISO_CODE_ESC)
 	{
-	  int rule, nbytes;
+	  int rule;
 
-	  DECODE_COMPOSITION_RULE (rule, nbytes);
-	  if (rule < 0)
-	    goto invalid_code;
+	  DECODE_COMPOSITION_RULE (rule);
 	  STORE_COMPOSITION_RULE (rule);
 	  continue;
 	}
@@ -4878,13 +4859,12 @@ encode_coding_sjis (struct coding_system *coding)
   int produced_chars = 0;
   Lisp_Object attrs, charset_list, val;
   int ascii_compatible;
-  struct charset *charset_roman, *charset_kanji, *charset_kana;
+  struct charset *charset_kanji, *charset_kana;
   struct charset *charset_kanji2;
   int c;
 
   CODING_GET_INFO (coding, attrs, charset_list);
-  val = charset_list;
-  charset_roman = CHARSET_FROM_ID (XINT (XCAR (val))), val = XCDR (val);
+  val = XCDR (charset_list);
   charset_kana = CHARSET_FROM_ID (XINT (XCAR (val))), val = XCDR (val);
   charset_kanji = CHARSET_FROM_ID (XINT (XCAR (val))), val = XCDR (val);
   charset_kanji2 = NILP (val) ? NULL : CHARSET_FROM_ID (XINT (XCAR (val)));
@@ -4970,12 +4950,11 @@ encode_coding_big5 (struct coding_system *coding)
   int produced_chars = 0;
   Lisp_Object attrs, charset_list, val;
   int ascii_compatible;
-  struct charset *charset_roman, *charset_big5;
+  struct charset *charset_big5;
   int c;
 
   CODING_GET_INFO (coding, attrs, charset_list);
-  val = charset_list;
-  charset_roman = CHARSET_FROM_ID (XINT (XCAR (val))), val = XCDR (val);
+  val = XCDR (charset_list);
   charset_big5 = CHARSET_FROM_ID (XINT (XCAR (val)));
   ascii_compatible = ! NILP (CODING_ATTR_ASCII_COMPAT (attrs));
 
@@ -5433,7 +5412,8 @@ decode_coding_charset (struct coding_system *coding)
     = coding->charbuf + coding->charbuf_size - (MAX_ANNOTATION_LENGTH * 2);
   int consumed_chars = 0, consumed_chars_base;
   int multibytep = coding->src_multibyte;
-  Lisp_Object attrs, charset_list, valids;
+  Lisp_Object attrs = CODING_ID_ATTRS (coding->id);
+  Lisp_Object valids;
   int char_offset = coding->produced_char;
   int last_offset = char_offset;
   int last_id = charset_ascii;
@@ -5441,7 +5421,6 @@ decode_coding_charset (struct coding_system *coding)
     !inhibit_eol_conversion && EQ (CODING_ID_EOL_TYPE (coding->id), Qdos);
   int byte_after_cr = -1;
 
-  CODING_GET_INFO (coding, attrs, charset_list);
   valids = AREF (attrs, coding_attr_charset_valids);
 
   while (1)
diff --git a/src/composite.c b/src/composite.c
index bc5644a4612..c18f9e8b56e 100644
--- a/src/composite.c
+++ b/src/composite.c
@@ -354,7 +354,7 @@ get_composition_id (EMACS_INT charpos, EMACS_INT bytepos, EMACS_INT nchars,
 
       for (i = 1; i < glyph_len; i += 2)
 	{
-	  int rule, gref, nref, xoff, yoff;
+	  int rule, gref, nref;
 	  int this_width;
 	  float this_left;
 
@@ -376,7 +376,7 @@ get_composition_id (EMACS_INT charpos, EMACS_INT bytepos, EMACS_INT nchars,
 		|       |
 		6---7---8 -- descent
 	  */
-	  COMPOSITION_DECODE_RULE (rule, gref, nref, xoff, yoff);
+	  COMPOSITION_DECODE_REFS (rule, gref, nref);
 	  this_left = (leftmost
 		       + (gref % 3) * (rightmost - leftmost) / 2.0
 		       - (nref % 3) * this_width / 2.0);
@@ -661,22 +661,22 @@ gstring_lookup_cache (Lisp_Object header)
 }
 
 Lisp_Object
-composition_gstring_put_cache (Lisp_Object gstring, int len)
+composition_gstring_put_cache (Lisp_Object gstring, EMACS_INT len)
 {
   struct Lisp_Hash_Table *h = XHASH_TABLE (gstring_hash_table);
   unsigned hash;
   Lisp_Object header, copy;
-  int i;
+  EMACS_INT i;
 
   header = LGSTRING_HEADER (gstring);
   hash = h->hashfn (h, header);
   if (len < 0)
     {
-      len = LGSTRING_GLYPH_LEN (gstring);
-      for (i = 0; i < len; i++)
-	if (NILP (LGSTRING_GLYPH (gstring, i)))
+      EMACS_UINT j, glyph_len = LGSTRING_GLYPH_LEN (gstring);
+      for (j = 0; j < glyph_len; j++)
+	if (NILP (LGSTRING_GLYPH (gstring, j)))
 	  break;
-      len = i;
+      len = j;
     }
 
   copy = Fmake_vector (make_number (len + 2), Qnil);
diff --git a/src/composite.h b/src/composite.h
index b8943fbfdc3..cfb5db0dc6a 100644
--- a/src/composite.h
+++ b/src/composite.h
@@ -126,27 +126,37 @@ extern Lisp_Object composition_temp;
 	->contents[(n) * 2 - 1])
 
 /* Decode encoded composition rule RULE_CODE into GREF (global
-   reference point code), NREF (new reference point code), XOFF
-   (horizontal offset) YOFF (vertical offset).  Don't check RULE_CODE,
+   reference point code), NREF (new ref. point code).  Don't check RULE_CODE;
    always set GREF and NREF to valid values.  By side effect,
    RULE_CODE is modified.  */
 
-#define COMPOSITION_DECODE_RULE(rule_code, gref, nref, xoff, yoff)	\
+#define COMPOSITION_DECODE_REFS(rule_code, gref, nref)			\
   do {									\
-    xoff = (rule_code) >> 16;						\
-    yoff = ((rule_code) >> 8) & 0xFF;					\
     rule_code &= 0xFF;							\
     gref = (rule_code) / 12;						\
     if (gref > 12) gref = 11;						\
     nref = (rule_code) % 12;						\
   } while (0)
 
+/* Like COMPOSITION_DECODE_REFS (RULE_CODE, GREF, NREF), but also
+   decode RULE_CODE into XOFF and YOFF (vertical offset).  */
+
+#define COMPOSITION_DECODE_RULE(rule_code, gref, nref, xoff, yoff)	\
+  do {									\
+    xoff = (rule_code) >> 16;						\
+    yoff = ((rule_code) >> 8) & 0xFF;					\
+    COMPOSITION_DECODE_REFS (rule_code, gref, nref);			\
+  } while (0)
+
+/* Nonzero if the global reference point GREF and new reference point NREF are
+   valid.  */
+#define COMPOSITION_ENCODE_RULE_VALID(gref, nref)	\
+  ((unsigned) (gref) < 12 && (unsigned) (nref) < 12)
+
 /* Return encoded composition rule for the pair of global reference
-   point GREF and new reference point NREF.  If arguments are invalid,
-   return -1. */
+   point GREF and new reference point NREF.  Arguments must be valid.  */
 #define COMPOSITION_ENCODE_RULE(gref, nref)		\
-  ((unsigned) (gref) < 12 && (unsigned) (nref) < 12	\
-   ? (gref) * 12 + (nref) : -1)
+  ((gref) * 12 + (nref))
 
 /* Data structure that records information about a composition
    currently used in some buffers or strings.
@@ -281,7 +291,7 @@ enum lglyph_indices
     else								\
       ASET ((g), LGLYPH_IX_CODE, make_number (val));			\
   } while (0)
-      
+
 #define LGLYPH_SET_WIDTH(g, val) ASET ((g), LGLYPH_IX_WIDTH, make_number (val))
 #define LGLYPH_SET_LBEARING(g, val) ASET ((g), LGLYPH_IX_LBEARING, make_number (val))
 #define LGLYPH_SET_RBEARING(g, val) ASET ((g), LGLYPH_IX_RBEARING, make_number (val))
@@ -300,7 +310,7 @@ struct composition_it;
 struct face;
 struct font_metrics;
 
-extern Lisp_Object composition_gstring_put_cache (Lisp_Object, int);
+extern Lisp_Object composition_gstring_put_cache (Lisp_Object, EMACS_INT);
 extern Lisp_Object composition_gstring_from_id (int);
 extern int composition_gstring_p (Lisp_Object);
 extern int composition_gstring_width (Lisp_Object, EMACS_INT, EMACS_INT,
@@ -321,4 +331,3 @@ extern EMACS_INT composition_adjust_point (EMACS_INT, EMACS_INT);
 EXFUN (Fcomposition_get_gstring, 4);
 
 #endif /* not EMACS_COMPOSITE_H */
-
diff --git a/src/deps.mk b/src/deps.mk
index d84e80dca44..be5d3694fca 100644
--- a/src/deps.mk
+++ b/src/deps.mk
@@ -187,6 +187,7 @@ sysdep.o: sysdep.c syssignal.h systty.h systime.h syswait.h blockinput.h \
    process.h dispextern.h termhooks.h termchar.h termopts.h coding.h \
    frame.h atimer.h window.h msdos.h dosfns.h keyboard.h cm.h lisp.h \
    globals.h $(config_h) composite.h sysselect.h gnutls.h \
+   ../lib/allocator.h ../lib/careadlinkat.h \
    ../lib/unistd.h ../lib/ignore-value.h
 term.o: term.c termchar.h termhooks.h termopts.h lisp.h globals.h $(config_h) \
    cm.h frame.h disptab.h keyboard.h character.h charset.h coding.h ccl.h \
diff --git a/src/dired.c b/src/dired.c
index 176f14925b4..186cfd1420b 100644
--- a/src/dired.c
+++ b/src/dired.c
@@ -639,8 +639,6 @@ file_name_completion (Lisp_Object file, Lisp_Object dirname, int all_flag, int v
 
       {
 	Lisp_Object regexps;
-	Lisp_Object zero;
-	XSETFASTINT (zero, 0);
 
 	/* Ignore this element if it fails to match all the regexps.  */
 	if (completion_ignore_case)
diff --git a/src/eval.c b/src/eval.c
index 9b6605eed2e..93da7799bec 100644
--- a/src/eval.c
+++ b/src/eval.c
@@ -1757,7 +1757,7 @@ See also the function `condition-case'.  */)
     data = Fcons (error_symbol, data);
 
   string = Ferror_message_string (data);
-  fatal ("%s", SDATA (string), 0);
+  fatal ("%s", SDATA (string));
 }
 
 /* Internal version of Fsignal that never returns.
@@ -3206,26 +3206,26 @@ funcall_lambda (Lisp_Object fun, size_t nargs,
 	optional = 1;
       else
 	{
-	  Lisp_Object val;
+	  Lisp_Object arg;
 	  if (rest)
 	    {
-	      val = Flist (nargs - i, &arg_vector[i]);
+	      arg = Flist (nargs - i, &arg_vector[i]);
 	      i = nargs;
 	    }
 	  else if (i < nargs)
-	    val = arg_vector[i++];
+	    arg = arg_vector[i++];
 	  else if (!optional)
 	    xsignal2 (Qwrong_number_of_arguments, fun, make_number (nargs));
 	  else
-	    val = Qnil;
+	    arg = Qnil;
 
 	  /* Bind the argument.  */
 	  if (!NILP (lexenv) && SYMBOLP (next))
 	    /* Lexically bind NEXT by adding it to the lexenv alist.  */
-	    lexenv = Fcons (Fcons (next, val), lexenv);
+	    lexenv = Fcons (Fcons (next, arg), lexenv);
 	  else
 	    /* Dynamically bind NEXT.  */
-	    specbind (next, val);
+	    specbind (next, arg);
 	}
     }
 
diff --git a/src/fileio.c b/src/fileio.c
index 85431dfd5b1..dec53968947 100644
--- a/src/fileio.c
+++ b/src/fileio.c
@@ -2579,9 +2579,8 @@ points to a nonexistent file.  */)
 {
   Lisp_Object handler;
   char *buf;
-  int bufsize;
-  int valsize;
   Lisp_Object val;
+  char readlink_buf[READLINK_BUFSIZE];
 
   CHECK_STRING (filename);
   filename = Fexpand_file_name (filename, Qnil);
@@ -2594,36 +2593,15 @@ points to a nonexistent file.  */)
 
   filename = ENCODE_FILE (filename);
 
-  bufsize = 50;
-  buf = NULL;
-  do
-    {
-      bufsize *= 2;
-      buf = (char *) xrealloc (buf, bufsize);
-      memset (buf, 0, bufsize);
-
-      errno = 0;
-      valsize = readlink (SSDATA (filename), buf, bufsize);
-      if (valsize == -1)
-	{
-#ifdef ERANGE
-	  /* HP-UX reports ERANGE if buffer is too small.  */
-	  if (errno == ERANGE)
-	    valsize = bufsize;
-	  else
-#endif
-	    {
-	      xfree (buf);
-	      return Qnil;
-	    }
-	}
-    }
-  while (valsize >= bufsize);
+  buf = emacs_readlink (SSDATA (filename), readlink_buf);
+  if (! buf)
+    return Qnil;
 
-  val = make_string (buf, valsize);
+  val = build_string (buf);
   if (buf[0] == '/' && strchr (buf, ':'))
     val = concat2 (build_string ("/:"), val);
-  xfree (buf);
+  if (buf != readlink_buf)
+    xfree (buf);
   val = DECODE_FILE (val);
   return val;
 }
@@ -3225,7 +3203,6 @@ variable `last-coding-system-used' to the coding system actually used.  */)
   if (stat (SSDATA (filename), &st) < 0)
 #endif /* WINDOWSNT */
     {
-      if (fd >= 0) emacs_close (fd);
     badopen:
       if (NILP (visit))
 	report_file_error ("Opening input file", Fcons (orig_filename, Qnil));
@@ -3261,9 +3238,16 @@ variable `last-coding-system-used' to the coding system actually used.  */)
 
   record_unwind_protect (close_file_unwind, make_number (fd));
 
-  /* Can happen on any platform that uses long as type of off_t, but allows
-     file sizes to exceed 2Gb, so give a suitable message.  */
-  if (! not_regular && st.st_size < 0)
+
+  /* Arithmetic overflow can occur if an Emacs integer cannot represent the
+     file size, or if the calculations below overflow.  The calculations below
+     double the file size twice, so check that it can be multiplied by 4
+     safely.
+
+     Also check whether the size is negative, which can happen on a platform
+     that allows file sizes greater than the maximum off_t value.  */
+  if (! not_regular
+      && ! (0 <= st.st_size && st.st_size <= MOST_POSITIVE_FIXNUM / 4))
     error ("Maximum buffer size exceeded");
 
   /* Prevent redisplay optimizations.  */
@@ -3290,18 +3274,6 @@ variable `last-coding-system-used' to the coding system actually used.  */)
 	{
 	  XSETINT (end, st.st_size);
 
-	  /* Arithmetic overflow can occur if an Emacs integer cannot
-	     represent the file size, or if the calculations below
-	     overflow.  The calculations below double the file size
-	     twice, so check that it can be multiplied by 4 safely.  */
-	  if (XINT (end) != st.st_size
-	      /* Actually, it should test either INT_MAX or LONG_MAX
-		 depending on which one is used for EMACS_INT.  But in
-		 any case, in practice, this test is redundant with the
-		 one above.
-		 || st.st_size > INT_MAX / 4 */)
-	    error ("Maximum buffer size exceeded");
-
 	  /* The file size returned from stat may be zero, but data
 	     may be readable nonetheless, for example when this is a
 	     file in the /proc filesystem.  */
@@ -3635,6 +3607,7 @@ variable `last-coding-system-used' to the coding system actually used.  */)
       EMACS_INT bufpos;
       unsigned char *decoded;
       EMACS_INT temp;
+      EMACS_INT this = 0;
       int this_count = SPECPDL_INDEX ();
       int multibyte = ! NILP (BVAR (current_buffer, enable_multibyte_characters));
       Lisp_Object conversion_buffer;
@@ -3661,7 +3634,6 @@ variable `last-coding-system-used' to the coding system actually used.  */)
 	  /* try is reserved in some compilers (Microsoft C) */
 	  EMACS_INT trytry = min (total - how_much,
 				  READ_BUF_SIZE - unprocessed);
-	  EMACS_INT this;
 
 	  /* Allow quitting out of the actual I/O.  */
 	  immediate_quit = 1;
@@ -3670,11 +3642,7 @@ variable `last-coding-system-used' to the coding system actually used.  */)
 	  immediate_quit = 0;
 
 	  if (this <= 0)
-	    {
-	      if (this < 0)
-		how_much = this;
-	      break;
-	    }
+	    break;
 
 	  how_much += this;
 
@@ -3697,7 +3665,7 @@ variable `last-coding-system-used' to the coding system actually used.  */)
       /* At this point, HOW_MUCH should equal TOTAL, or should be <= 0
 	 if we couldn't read the file.  */
 
-      if (how_much < 0)
+      if (this < 0)
 	error ("IO error reading %s: %s",
 	       SDATA (orig_filename), emacs_strerror (errno));
 
diff --git a/src/filelock.c b/src/filelock.c
index 2138eaa502b..13b27c72f19 100644
--- a/src/filelock.c
+++ b/src/filelock.c
@@ -396,36 +396,16 @@ within_one_second (time_t a, time_t b)
 static int
 current_lock_owner (lock_info_type *owner, char *lfname)
 {
-  int len, ret;
+  int ret;
+  size_t len;
   int local_owner = 0;
   char *at, *dot, *colon;
-  char *lfinfo = 0;
-  int bufsize = 50;
-  /* Read arbitrarily-long contents of symlink.  Similar code in
-     file-symlink-p in fileio.c.  */
-  do
-    {
-      bufsize *= 2;
-      lfinfo = (char *) xrealloc (lfinfo, bufsize);
-      errno = 0;
-      len = readlink (lfname, lfinfo, bufsize);
-#ifdef ERANGE
-      /* HP-UX reports ERANGE if the buffer is too small.  */
-      if (len == -1 && errno == ERANGE)
-	len = bufsize;
-#endif
-    }
-  while (len >= bufsize);
+  char readlink_buf[READLINK_BUFSIZE];
+  char *lfinfo = emacs_readlink (lfname, readlink_buf);
 
   /* If nonexistent lock file, all is well; otherwise, got strange error. */
-  if (len == -1)
-    {
-      xfree (lfinfo);
-      return errno == ENOENT ? 0 : -1;
-    }
-
-  /* Link info exists, so `len' is its length.  Null terminate.  */
-  lfinfo[len] = 0;
+  if (!lfinfo)
+    return errno == ENOENT ? 0 : -1;
 
   /* Even if the caller doesn't want the owner info, we still have to
      read it to determine return value, so allocate it.  */
@@ -441,7 +421,8 @@ current_lock_owner (lock_info_type *owner, char *lfname)
   dot = strrchr (lfinfo, '.');
   if (!at || !dot)
     {
-      xfree (lfinfo);
+      if (lfinfo != readlink_buf)
+	xfree (lfinfo);
       return -1;
     }
   len = at - lfinfo;
@@ -467,7 +448,8 @@ current_lock_owner (lock_info_type *owner, char *lfname)
   owner->host[len] = 0;
 
   /* We're done looking at the link info.  */
-  xfree (lfinfo);
+  if (lfinfo != readlink_buf)
+    xfree (lfinfo);
 
   /* On current host?  */
   if (STRINGP (Fsystem_name ())
diff --git a/src/fns.c b/src/fns.c
index bce922859d1..c45d9e31ef2 100644
--- a/src/fns.c
+++ b/src/fns.c
@@ -1247,17 +1247,10 @@ substring_both (Lisp_Object string, EMACS_INT from, EMACS_INT from_byte,
 {
   Lisp_Object res;
   EMACS_INT size;
-  EMACS_INT size_byte;
 
   CHECK_VECTOR_OR_STRING (string);
 
-  if (STRINGP (string))
-    {
-      size = SCHARS (string);
-      size_byte = SBYTES (string);
-    }
-  else
-    size = ASIZE (string);
+  size = STRINGP (string) ? SCHARS (string) : ASIZE (string);
 
   if (!(0 <= from && from <= to && to <= size))
     args_out_of_range_3 (string, make_number (from), make_number (to));
@@ -4226,9 +4219,9 @@ sxhash (Lisp_Object obj, int depth)
       {
 	double val = XFLOAT_DATA (obj);
 	unsigned char *p = (unsigned char *) &val;
-	unsigned char *e = p + sizeof val;
-	for (hash = 0; p < e; ++p)
-	  hash = SXHASH_COMBINE (hash, *p);
+	size_t i;
+	for (hash = 0, i = 0; i < sizeof val; i++)
+	  hash = SXHASH_COMBINE (hash, p[i]);
 	break;
       }
 
diff --git a/src/font.c b/src/font.c
index 6b2e2f2712d..e01f67a95f6 100644
--- a/src/font.c
+++ b/src/font.c
@@ -2076,12 +2076,11 @@ font_score (Lisp_Object entity, Lisp_Object *spec_prop)
   for (i = FONT_WEIGHT_INDEX; i <= FONT_WIDTH_INDEX; i++)
     if (! NILP (spec_prop[i]) && ! EQ (AREF (entity, i), spec_prop[i]))
       {
-	int diff = (XINT (AREF (entity, i)) >> 8) - (XINT (spec_prop[i]) >> 8);
-
+	EMACS_INT diff = ((XINT (AREF (entity, i)) >> 8)
+			  - (XINT (spec_prop[i]) >> 8));
 	if (diff < 0)
 	  diff = - diff;
-	if (diff > 0)
-	  score |= min (diff, 127) << sort_shift_bits[i];
+	score |= min (diff, 127) << sort_shift_bits[i];
       }
 
   /* Score the size.  Maximum difference is 127.  */
@@ -2698,14 +2697,12 @@ font_list_entities (Lisp_Object frame, Lisp_Object spec)
   for (i = FONT_FOUNDRY_INDEX; i <= FONT_REGISTRY_INDEX; i++)
     ASET (scratch_font_spec, i, AREF (spec, i));
   for (i = FONT_WEIGHT_INDEX; i < FONT_EXTRA_INDEX; i++)
-    {
-      ASET (scratch_font_spec, i, Qnil);
-      if (! NILP (AREF (spec, i)))
-	need_filtering = 1;
-      if (i == FONT_DPI_INDEX)
-	/* Skip FONT_SPACING_INDEX  */
-	i++;
-    }
+    if (i != FONT_SPACING_INDEX)
+      {
+	ASET (scratch_font_spec, i, Qnil);
+	if (! NILP (AREF (spec, i)))
+	  need_filtering = 1;
+      }
   ASET (scratch_font_spec, FONT_SPACING_INDEX, AREF (spec, FONT_SPACING_INDEX));
   ASET (scratch_font_spec, FONT_EXTRA_INDEX, AREF (spec, FONT_EXTRA_INDEX));
 
@@ -3071,7 +3068,7 @@ font_find_for_lface (FRAME_PTR f, Lisp_Object *attrs, Lisp_Object spec, int c)
 {
   Lisp_Object work;
   Lisp_Object frame, entities, val;
-  Lisp_Object size, foundry[3], *family, registry[3], adstyle[3];
+  Lisp_Object foundry[3], *family, registry[3], adstyle[3];
   int pixel_size;
   int i, j, k, l;
 
@@ -3102,7 +3099,6 @@ font_find_for_lface (FRAME_PTR f, Lisp_Object *attrs, Lisp_Object spec, int c)
   work = Fcopy_font_spec (spec);
   ASET (work, FONT_TYPE_INDEX, AREF (spec, FONT_TYPE_INDEX));
   XSETFRAME (frame, f);
-  size = AREF (spec, FONT_SIZE_INDEX);
   pixel_size = font_pixel_size (f, spec);
   if (pixel_size == 0 && INTEGERP (attrs[LFACE_HEIGHT_INDEX]))
     {
@@ -4723,10 +4719,9 @@ the corresponding element is nil.  */)
       Lisp_Object g;
       int c = XFASTINT (chars[i]);
       unsigned code;
-      EMACS_INT cod;
       struct font_metrics metrics;
 
-      cod = code = font->driver->encode_char (font, c);
+      code = font->driver->encode_char (font, c);
       if (code == FONT_INVALID_CODE)
 	continue;
       g = Fmake_vector (make_number (LGLYPH_SIZE), Qnil);
diff --git a/src/fontset.c b/src/fontset.c
index b5d8a0db434..eea65535c78 100644
--- a/src/fontset.c
+++ b/src/fontset.c
@@ -1815,7 +1815,6 @@ DEFUN ("internal-char-font", Finternal_char_font, Sinternal_char_font, 1, 2, 0,
   int c;
   struct frame *f;
   struct face *face;
-  int cs_id;
 
   if (NILP (position))
     {
@@ -1824,11 +1823,10 @@ DEFUN ("internal-char-font", Finternal_char_font, Sinternal_char_font, 1, 2, 0,
       f = XFRAME (selected_frame);
       face_id = lookup_basic_face (f, DEFAULT_FACE_ID);
       pos = -1;
-      cs_id = -1;
     }
   else
     {
-      Lisp_Object window, charset;
+      Lisp_Object window;
       struct window *w;
 
       CHECK_NUMBER_COERCE_MARKER (position);
@@ -1850,11 +1848,6 @@ DEFUN ("internal-char-font", Finternal_char_font, Sinternal_char_font, 1, 2, 0,
       f = XFRAME (w->frame);
       face_id = face_at_buffer_position (w, pos, -1, -1, &dummy,
 					 pos + 100, 0, -1);
-      charset = Fget_char_property (position, Qcharset, Qnil);
-      if (CHARSETP (charset))
-	cs_id = XINT (CHARSET_SYMBOL_ID (charset));
-      else
-	cs_id = -1;
     }
   if (! CHAR_VALID_P (c, 0))
     return Qnil;
@@ -1900,7 +1893,6 @@ information about the derived fonts from the default fontset.  The
 format is the same as above.  */)
   (Lisp_Object fontset, Lisp_Object frame)
 {
-  FRAME_PTR f;
   Lisp_Object *realized[2], fontsets[2], tables[2];
   Lisp_Object val, elt;
   int c, i, j, k;
@@ -1908,7 +1900,6 @@ format is the same as above.  */)
   (*check_window_system_func) ();
 
   fontset = check_fontset_name (fontset, &frame);
-  f = XFRAME (frame);
 
   /* Recode fontsets realized on FRAME from the base fontset FONTSET
      in the table `realized'.  */
diff --git a/src/gtkutil.c b/src/gtkutil.c
index 4e5ecce76c7..4b53915c416 100644
--- a/src/gtkutil.c
+++ b/src/gtkutil.c
@@ -1704,7 +1704,7 @@ xg_get_file_with_chooser (FRAME_PTR f,
 {
   char msgbuf[1024];
 
-  GtkWidget *filewin, *wtoggle, *wbox, *wmessage;
+  GtkWidget *filewin, *wtoggle, *wbox, *wmessage IF_LINT (= NULL);
   GtkWindow *gwin = GTK_WINDOW (FRAME_GTK_OUTER_WIDGET (f));
   GtkFileChooserAction action = (mustmatch_p ?
                                  GTK_FILE_CHOOSER_ACTION_OPEN :
diff --git a/src/image.c b/src/image.c
index b37ba398d83..260bc6eb260 100644
--- a/src/image.c
+++ b/src/image.c
@@ -1708,7 +1708,6 @@ postprocess_image (struct frame *f, struct image *img)
 int
 lookup_image (struct frame *f, Lisp_Object spec)
 {
-  struct image_cache *c;
   struct image *img;
   unsigned hash;
   EMACS_TIME now;
@@ -1718,8 +1717,6 @@ lookup_image (struct frame *f, Lisp_Object spec)
   xassert (FRAME_WINDOW_P (f));
   xassert (valid_image_p (spec));
 
-  c = FRAME_IMAGE_CACHE (f);
-
   /* Look up SPEC in the hash table of the image cache.  */
   hash = sxhash (spec, 0);
   img = search_image_cache (f, spec, hash);
@@ -2878,6 +2875,7 @@ xbm_load (struct frame *f, struct image *img)
       /* Parse the image specification.  */
       memcpy (fmt, xbm_format, sizeof fmt);
       parsed_p = parse_image_spec (img->spec, fmt, XBM_LAST, Qxbm);
+      (void) parsed_p;
       xassert (parsed_p);
 
       /* Get specified width, and height.  */
@@ -6716,6 +6714,8 @@ tiff_size_of_memory (thandle_t data)
 }
 
 
+static void tiff_error_handler (const char *, const char *, va_list)
+  ATTRIBUTE_FORMAT_PRINTF (2, 0);
 static void
 tiff_error_handler (const char *title, const char *format, va_list ap)
 {
@@ -6728,6 +6728,8 @@ tiff_error_handler (const char *title, const char *format, va_list ap)
 }
 
 
+static void tiff_warning_handler (const char *, const char *, va_list)
+  ATTRIBUTE_FORMAT_PRINTF (2, 0);
 static void
 tiff_warning_handler (const char *title, const char *format, va_list ap)
 {
@@ -6759,8 +6761,8 @@ tiff_load (struct frame *f, struct image *img)
   specified_file = image_spec_value (img->spec, QCfile, NULL);
   specified_data = image_spec_value (img->spec, QCdata, NULL);
 
-  fn_TIFFSetErrorHandler (tiff_error_handler);
-  fn_TIFFSetWarningHandler (tiff_warning_handler);
+  fn_TIFFSetErrorHandler ((TIFFErrorHandler) tiff_error_handler);
+  fn_TIFFSetWarningHandler ((TIFFErrorHandler) tiff_warning_handler);
 
   if (NILP (specified_data))
     {
diff --git a/src/indent.c b/src/indent.c
index b3028a27b38..8732b2ca5cc 100644
--- a/src/indent.c
+++ b/src/indent.c
@@ -271,14 +271,13 @@ skip_invisible (EMACS_INT pos, EMACS_INT *next_boundary_p, EMACS_INT to, Lisp_Ob
 
    DP is a display table or NULL.
 
-   This macro is used in current_column_1, Fmove_to_column, and
+   This macro is used in scan_for_column and in
    compute_motion.  */
 
 #define MULTIBYTE_BYTES_WIDTH(p, dp, bytes, width)			\
   do {									\
     int ch;								\
     									\
-    wide_column = 0;							\
     ch = STRING_CHAR_AND_LENGTH (p, bytes);				\
     if (BYTES_BY_CHAR_HEAD (*p) != bytes)				\
       width = bytes * 4;						\
@@ -288,8 +287,6 @@ skip_invisible (EMACS_INT pos, EMACS_INT *next_boundary_p, EMACS_INT to, Lisp_Ob
 	  width = XVECTOR (DISP_CHAR_VECTOR (dp, ch))->size;		\
 	else								\
 	  width = CHAR_WIDTH (ch);					\
-	if (width > 1)							\
-	  wide_column = width;						\
       }									\
   } while (0)
 
@@ -666,7 +663,7 @@ scan_for_column (EMACS_INT *endpos, EMACS_INT *goalcol, EMACS_INT *prevcol)
 	    {
 	      /* Start of multi-byte form.  */
 	      unsigned char *ptr;
-	      int bytes, width, wide_column;
+	      int bytes, width;
 
 	      ptr = BYTE_POS_ADDR (scan_byte);
 	      MULTIBYTE_BYTES_WIDTH (ptr, dp, bytes, width);
@@ -1657,14 +1654,14 @@ compute_motion (EMACS_INT from, EMACS_INT fromvpos, EMACS_INT fromhpos, int did_
 		{
 		  /* Start of multi-byte form.  */
 		  unsigned char *ptr;
-		  int mb_bytes, mb_width, wide_column;
+		  int mb_bytes, mb_width;
 
 		  pos_byte--;	/* rewind POS_BYTE */
 		  ptr = BYTE_POS_ADDR (pos_byte);
 		  MULTIBYTE_BYTES_WIDTH (ptr, dp, mb_bytes, mb_width);
 		  pos_byte += mb_bytes;
-		  if (wide_column)
-		    wide_column_end_hpos = hpos + wide_column;
+		  if (mb_width > 1 && BYTES_BY_CHAR_HEAD (*ptr) == mb_bytes)
+		    wide_column_end_hpos = hpos + mb_width;
 		  hpos += mb_width;
 		}
 	      else if (VECTORP (charvec))
diff --git a/src/intervals.c b/src/intervals.c
index 351677ad27e..729e6810f74 100644
--- a/src/intervals.c
+++ b/src/intervals.c
@@ -1312,7 +1312,7 @@ delete_interval (register INTERVAL i)
    Do this by recursing down TREE to the interval in question, and
    deleting the appropriate amount of text.  */
 
-static EMACS_INT
+static EMACS_UINT
 interval_deletion_adjustment (register INTERVAL tree, register EMACS_INT from,
 			      register EMACS_INT amount)
 {
@@ -1324,7 +1324,7 @@ interval_deletion_adjustment (register INTERVAL tree, register EMACS_INT from,
   /* Left branch */
   if (relative_position < LEFT_TOTAL_LENGTH (tree))
     {
-      EMACS_INT subtract = interval_deletion_adjustment (tree->left,
+      EMACS_UINT subtract = interval_deletion_adjustment (tree->left,
 							  relative_position,
 							  amount);
       tree->total_length -= subtract;
@@ -1335,7 +1335,7 @@ interval_deletion_adjustment (register INTERVAL tree, register EMACS_INT from,
   else if (relative_position >= (TOTAL_LENGTH (tree)
 				 - RIGHT_TOTAL_LENGTH (tree)))
     {
-      EMACS_INT subtract;
+      EMACS_UINT subtract;
 
       relative_position -= (tree->total_length
 			    - RIGHT_TOTAL_LENGTH (tree));
@@ -1377,7 +1377,7 @@ static void
 adjust_intervals_for_deletion (struct buffer *buffer,
 			       EMACS_INT start, EMACS_INT length)
 {
-  register EMACS_INT left_to_delete = length;
+  register EMACS_UINT left_to_delete = length;
   register INTERVAL tree = BUF_INTERVALS (buffer);
   Lisp_Object parent;
   EMACS_INT offset;
@@ -1677,7 +1677,7 @@ graft_intervals_into_buffer (INTERVAL source, EMACS_INT position,
 			     EMACS_INT length, struct buffer *buffer,
 			     int inherit)
 {
-  register INTERVAL under, over, this, prev;
+  register INTERVAL under, over, this;
   register INTERVAL tree;
   EMACS_INT over_used;
 
@@ -1767,7 +1767,8 @@ graft_intervals_into_buffer (INTERVAL source, EMACS_INT position,
       /* This call may have some effect because previous_interval may
          update `position' fields of intervals.  Thus, don't ignore it
          for the moment.  Someone please tell me the truth (K.Handa).  */
-      prev = previous_interval (under);
+      INTERVAL prev = previous_interval (under);
+      (void) prev;
 #if 0
       /* But, this code surely has no effect.  And, anyway,
          END_NONSTICKY_P is unreliable now.  */
diff --git a/src/keyboard.c b/src/keyboard.c
index f766dd7d697..ae4fddb2c89 100644
--- a/src/keyboard.c
+++ b/src/keyboard.c
@@ -4234,7 +4234,8 @@ static EMACS_TIME
 timer_check_2 (void)
 {
   EMACS_TIME nexttime;
-  EMACS_TIME now, idleness_now;
+  EMACS_TIME now;
+  EMACS_TIME idleness_now IF_LINT (= {0});
   Lisp_Object timers, idle_timers, chosen_timer;
   struct gcpro gcpro1, gcpro2, gcpro3;
 
@@ -4271,10 +4272,12 @@ timer_check_2 (void)
       Lisp_Object *vector;
       Lisp_Object timer = Qnil, idle_timer = Qnil;
       EMACS_TIME timer_time, idle_timer_time;
-      EMACS_TIME difference, timer_difference, idle_timer_difference;
+      EMACS_TIME difference;
+      EMACS_TIME timer_difference IF_LINT (= {0});
+      EMACS_TIME idle_timer_difference IF_LINT (= {0});
 
       /* Skip past invalid timers and timers already handled.  */
-      if (!NILP (timers))
+      if (CONSP (timers))
 	{
 	  timer = XCAR (timers);
 	  if (!VECTORP (timer) || XVECTOR (timer)->size != 8)
@@ -4292,7 +4295,7 @@ timer_check_2 (void)
 	      continue;
 	    }
 	}
-      if (!NILP (idle_timers))
+      if (CONSP (idle_timers))
 	{
 	  timer = XCAR (idle_timers);
 	  if (!VECTORP (timer) || XVECTOR (timer)->size != 8)
@@ -4315,7 +4318,7 @@ timer_check_2 (void)
 	 based on the next ordinary timer.
 	 TIMER_DIFFERENCE is the distance in time from NOW to when
 	 this timer becomes ripe (negative if it's already ripe).  */
-      if (!NILP (timers))
+      if (CONSP (timers))
 	{
 	  timer = XCAR (timers);
 	  vector = XVECTOR (timer)->contents;
@@ -4327,7 +4330,7 @@ timer_check_2 (void)
 
       /* Set IDLE_TIMER, IDLE_TIMER_TIME and IDLE_TIMER_DIFFERENCE
 	 based on the next idle timer.  */
-      if (!NILP (idle_timers))
+      if (CONSP (idle_timers))
 	{
 	  idle_timer = XCAR (idle_timers);
 	  vector = XVECTOR (idle_timer)->contents;
@@ -4341,7 +4344,7 @@ timer_check_2 (void)
 	 and set CHOSEN_TIMER, VECTOR and DIFFERENCE accordingly.
 	 Also step down the list where we found that timer.  */
 
-      if (! NILP (timers) && ! NILP (idle_timers))
+      if (CONSP (timers) && CONSP (idle_timers))
 	{
 	  EMACS_TIME temp;
 	  EMACS_SUB_TIME (temp, timer_difference, idle_timer_difference);
@@ -4358,7 +4361,7 @@ timer_check_2 (void)
 	      difference = idle_timer_difference;
 	    }
 	}
-      else if (! NILP (timers))
+      else if (CONSP (timers))
 	{
 	  chosen_timer = timer;
 	  timers = XCDR (timers);
@@ -7358,8 +7361,6 @@ menu_bar_items (Lisp_Object old)
 
   Lisp_Object def, tail;
 
-  Lisp_Object result;
-
   int mapno;
   Lisp_Object oquit;
 
@@ -7420,8 +7421,6 @@ menu_bar_items (Lisp_Object old)
 
   /* Look up in each map the dummy prefix key `menu-bar'.  */
 
-  result = Qnil;
-
   for (mapno = nmaps - 1; mapno >= 0; mapno--)
     if (!NILP (maps[mapno]))
       {
@@ -8495,7 +8494,6 @@ read_char_minibuf_menu_prompt (int commandflag, int nmaps, Lisp_Object *maps)
       int notfirst = 0;
       int i = nlength;
       Lisp_Object obj;
-      int ch;
       Lisp_Object orig_defn_macro;
 
       /* Loop over elements of map.  */
@@ -8665,8 +8663,6 @@ read_char_minibuf_menu_prompt (int commandflag, int nmaps, Lisp_Object *maps)
 	return obj;
       else if (XINT (obj) == -2)
         return obj;
-      else
-	ch = XINT (obj);
 
       if (! EQ (obj, menu_prompt_more_char)
 	  && (!INTEGERP (menu_prompt_more_char)
diff --git a/src/lisp.h b/src/lisp.h
index 580dbd11013..f3016d521d1 100644
--- a/src/lisp.h
+++ b/src/lisp.h
@@ -1016,7 +1016,7 @@ struct Lisp_Symbol
   /* Interned state of the symbol.  This is an enumerator from
      enum symbol_interned.  */
   unsigned interned : 2;
-  
+
   /* Non-zero means that this variable has been explicitly declared
      special (with `defvar' etc), and shouldn't be lexically bound.  */
   unsigned declared_special : 1;
@@ -2627,8 +2627,8 @@ extern void restore_message (void);
 extern Lisp_Object current_message (void);
 extern void set_message (const char *s, Lisp_Object, EMACS_INT, int);
 extern void clear_message (int, int);
-extern void message (const char *, ...);
-extern void message_nolog (const char *, ...);
+extern void message (const char *, ...) ATTRIBUTE_FORMAT_PRINTF (1, 2);
+extern void message_nolog (const char *, ...) ATTRIBUTE_FORMAT_PRINTF (1, 2);
 extern void message1 (const char *);
 extern void message1_nolog (const char *);
 extern void message2 (const char *, EMACS_INT, int);
@@ -3348,6 +3348,8 @@ extern int emacs_open (const char *, int, int);
 extern int emacs_close (int);
 extern int emacs_read (int, char *, unsigned int);
 extern int emacs_write (int, const char *, unsigned int);
+enum { READLINK_BUFSIZE = 1024 };
+extern char *emacs_readlink (const char *, char [READLINK_BUFSIZE]);
 #ifndef HAVE_MEMSET
 extern void *memset (void *, int, size_t);
 #endif
@@ -3392,7 +3394,8 @@ extern Lisp_Object directory_files_internal (Lisp_Object, Lisp_Object,
 extern int *char_ins_del_vector;
 extern void mark_ttys (void);
 extern void syms_of_term (void);
-extern void fatal (const char *msgid, ...) NO_RETURN;
+extern void fatal (const char *msgid, ...)
+  NO_RETURN ATTRIBUTE_FORMAT_PRINTF (1, 2);
 
 /* Defined in terminal.c */
 EXFUN (Fframe_terminal, 1);
diff --git a/src/lread.c b/src/lread.c
index 6a24569f552..8777bc34545 100644
--- a/src/lread.c
+++ b/src/lread.c
@@ -818,7 +818,8 @@ lisp_file_lexically_bound_p (Lisp_Object readcharfun)
 
       while (in_file_vars)
 	{
-	  char var[100], *var_end, val[100], *val_end;
+	  char var[100], val[100];
+	  unsigned i;
 
 	  ch = READCHAR;
 
@@ -826,19 +827,18 @@ lisp_file_lexically_bound_p (Lisp_Object readcharfun)
 	  while (ch == ' ' || ch == '\t')
 	    ch = READCHAR;
 
-	  var_end = var;
+	  i = 0;
 	  while (ch != ':' && ch != '\n' && ch != EOF)
 	    {
-	      if (var_end < var + sizeof var - 1)
-		*var_end++ = ch;
+	      if (i < sizeof var - 1)
+		var[i++] = ch;
 	      UPDATE_BEG_END_STATE (ch);
 	      ch = READCHAR;
 	    }
 
-	  while (var_end > var
-		 && (var_end[-1] == ' ' || var_end[-1] == '\t'))
-	    var_end--;
-	  *var_end = '\0';
+	  while (i > 0 && (var[i - 1] == ' ' || var[i - 1] == '\t'))
+	    i--;
+	  var[i] = '\0';
 
 	  if (ch == ':')
 	    {
@@ -848,22 +848,21 @@ lisp_file_lexically_bound_p (Lisp_Object readcharfun)
 	      while (ch == ' ' || ch == '\t')
 		ch = READCHAR;
 
-	      val_end = val;
+	      i = 0;
 	      while (ch != ';' && ch != '\n' && ch != EOF && in_file_vars)
 		{
-		  if (val_end < val + sizeof val - 1)
-		    *val_end++ = ch;
+		  if (i < sizeof val - 1)
+		    val[i++] = ch;
 		  UPDATE_BEG_END_STATE (ch);
 		  ch = READCHAR;
 		}
 	      if (! in_file_vars)
 		/* The value was terminated by an end-marker, which
 		   remove.  */
-		val_end -= 3;
-	      while (val_end > val
-		     && (val_end[-1] == ' ' || val_end[-1] == '\t'))
-		val_end--;
-	      *val_end = '\0';
+		i -= 3;
+	      while (i > 0 && (val[i - 1] == ' ' || val[i - 1] == '\t'))
+		i--;
+	      val[i] = '\0';
 
 	      if (strcmp (var, "lexical-binding") == 0)
 		/* This is it...  */
@@ -908,7 +907,7 @@ safe_to_load_p (int fd)
 	if (i == 4)
 	  version = buf[i];
 
-      if (i == nbytes
+      if (i >= nbytes
 	  || fast_c_string_match_ignore_case (Vbytecomp_version_regexp,
 					      buf + i) < 0)
 	safe_p = 0;
@@ -2320,7 +2319,7 @@ static Lisp_Object
 read1 (register Lisp_Object readcharfun, int *pch, int first_in_list)
 {
   register int c;
-  int uninterned_symbol = 0;
+  unsigned uninterned_symbol = 0;
   int multibyte;
 
   *pch = 0;
diff --git a/src/menu.c b/src/menu.c
index a9098deed7e..3bfb74863ae 100644
--- a/src/menu.c
+++ b/src/menu.c
@@ -1340,7 +1340,7 @@ no quit occurs and `x-popup-menu' returns nil.  */)
 
   UNGCPRO;
 
-  if (error_name) error (error_name);
+  if (error_name) error ("%s", error_name);
   return selection;
 }
 
diff --git a/src/minibuf.c b/src/minibuf.c
index 4adf665f8f4..54cb9c1acd7 100644
--- a/src/minibuf.c
+++ b/src/minibuf.c
@@ -229,7 +229,7 @@ read_minibuf_noninteractive (Lisp_Object map, Lisp_Object initial,
 			     Lisp_Object defalt,
 			     int allow_props, int inherit_input_method)
 {
-  int size, len;
+  size_t size, len;
   char *line, *s;
   Lisp_Object val;
 
@@ -244,6 +244,8 @@ read_minibuf_noninteractive (Lisp_Object map, Lisp_Object initial,
 	 && (len = strlen (line),
 	     len == size - 1 && line[len - 1] != '\n'))
     {
+      if ((size_t) -1 / 2 < size)
+	memory_full ();
       size *= 2;
       line = (char *) xrealloc (line, size);
     }
diff --git a/src/print.c b/src/print.c
index 17a896bba8d..c076e1ec973 100644
--- a/src/print.c
+++ b/src/print.c
@@ -929,7 +929,7 @@ print_error_message (Lisp_Object data, Lisp_Object stream, const char *context,
   else
     write_string_1 ("peculiar error", -1, stream);
 
-  for (i = 0; CONSP (tail); tail = XCDR (tail), i++)
+  for (i = 0; CONSP (tail); tail = XCDR (tail), i = 1)
     {
       Lisp_Object obj;
 
@@ -1407,7 +1407,7 @@ print_object (Lisp_Object obj, register Lisp_Object printcharfun, int escapeflag
 	print_string (obj, printcharfun);
       else
 	{
-	  register EMACS_INT i, i_byte;
+	  register EMACS_INT i_byte;
 	  struct gcpro gcpro1;
 	  unsigned char *str;
 	  EMACS_INT size_byte;
@@ -1431,7 +1431,7 @@ print_object (Lisp_Object obj, register Lisp_Object printcharfun, int escapeflag
 	  str = SDATA (obj);
 	  size_byte = SBYTES (obj);
 
-	  for (i = 0, i_byte = 0; i_byte < size_byte;)
+	  for (i_byte = 0; i_byte < size_byte;)
 	    {
 	      /* Here, we must convert each multi-byte form to the
 		 corresponding character code before handing it to PRINTCHAR.  */
diff --git a/src/process.c b/src/process.c
index 1abfbd3f2a4..a9a8eb79ede 100644
--- a/src/process.c
+++ b/src/process.c
@@ -1344,11 +1344,7 @@ list_processes_1 (Lisp_Object query_only)
 	symbol = XCAR (p->status);
 
       if (EQ (symbol, Qsignal))
-	{
-	  Lisp_Object tem;
-	  tem = Fcar (Fcdr (p->status));
-	  Fprinc (symbol, Qnil);
-	}
+	Fprinc (symbol, Qnil);
       else if (NETCONN1_P (p) || SERIALCONN1_P (p))
 	{
 	  if (EQ (symbol, Qexit))
@@ -2150,10 +2146,7 @@ void
 create_pty (Lisp_Object process)
 {
   int inchannel, outchannel;
-
-  /* Use volatile to protect variables from being clobbered by longjmp.  */
-  volatile int forkin, forkout;
-  volatile int pty_flag = 0;
+  int pty_flag = 0;
 
   inchannel = outchannel = -1;
 
@@ -2169,11 +2162,11 @@ create_pty (Lisp_Object process)
 #ifdef O_NOCTTY
       /* Don't let this terminal become our controlling terminal
 	 (in case we don't have one).  */
-      forkout = forkin = emacs_open (pty_name, O_RDWR | O_NOCTTY, 0);
+      int forkout = emacs_open (pty_name, O_RDWR | O_NOCTTY, 0);
 #else
-      forkout = forkin = emacs_open (pty_name, O_RDWR, 0);
+      int forkout = emacs_open (pty_name, O_RDWR, 0);
 #endif
-      if (forkin < 0)
+      if (forkout < 0)
 	report_file_error ("Opening pty", Qnil);
 #if defined (DONT_REOPEN_PTY)
       /* In the case that vfork is defined as fork, the parent process
@@ -2181,8 +2174,6 @@ create_pty (Lisp_Object process)
 	 tty options setup.  So we setup tty before forking.  */
       child_setup_tty (forkout);
 #endif /* DONT_REOPEN_PTY */
-#else
-      forkin = forkout = -1;
 #endif /* not USG, or USG_SUBTTY_WORKS */
       pty_flag = 1;
     }
@@ -3958,7 +3949,7 @@ FLAGS is the current flags of the interface.  */)
       const struct ifflag_def *fp;
       int fnum;
 
-      any++;
+      any = 1;
       for (fp = ifflag_table; flags != 0 && fp->flag_sym; fp++)
 	{
 	  if (flags & fp->flag_bit)
@@ -3986,7 +3977,7 @@ FLAGS is the current flags of the interface.  */)
       register struct Lisp_Vector *p = XVECTOR (hwaddr);
       int n;
 
-      any++;
+      any = 1;
       for (n = 0; n < 6; n++)
 	p->contents[n] = make_number (((unsigned char *)&rq.ifr_hwaddr.sa_data[0])[n]);
       elt = Fcons (make_number (rq.ifr_hwaddr.sa_family), hwaddr);
@@ -3998,7 +3989,7 @@ FLAGS is the current flags of the interface.  */)
 #if defined(SIOCGIFNETMASK) && (defined(HAVE_STRUCT_IFREQ_IFR_NETMASK) || defined(HAVE_STRUCT_IFREQ_IFR_ADDR))
   if (ioctl (s, SIOCGIFNETMASK, &rq) == 0)
     {
-      any++;
+      any = 1;
 #ifdef HAVE_STRUCT_IFREQ_IFR_NETMASK
       elt = conv_sockaddr_to_lisp (&rq.ifr_netmask, sizeof (rq.ifr_netmask));
 #else
@@ -4012,7 +4003,7 @@ FLAGS is the current flags of the interface.  */)
 #if defined(SIOCGIFBRDADDR) && defined(HAVE_STRUCT_IFREQ_IFR_BROADADDR)
   if (ioctl (s, SIOCGIFBRDADDR, &rq) == 0)
     {
-      any++;
+      any = 1;
       elt = conv_sockaddr_to_lisp (&rq.ifr_broadaddr, sizeof (rq.ifr_broadaddr));
     }
 #endif
@@ -4022,7 +4013,7 @@ FLAGS is the current flags of the interface.  */)
 #if defined(SIOCGIFADDR) && defined(HAVE_STRUCT_IFREQ_IFR_ADDR)
   if (ioctl (s, SIOCGIFADDR, &rq) == 0)
     {
-      any++;
+      any = 1;
       elt = conv_sockaddr_to_lisp (&rq.ifr_addr, sizeof (rq.ifr_addr));
     }
 #endif
@@ -5171,15 +5162,22 @@ read_process_output (Lisp_Object proc, register int channel)
     }
   else
 #endif
-  if (proc_buffered_char[channel] < 0)
     {
+      int buffered = 0 <= proc_buffered_char[channel];
+      if (buffered)
+	{
+	  chars[carryover] = proc_buffered_char[channel];
+	  proc_buffered_char[channel] = -1;
+	}
 #ifdef HAVE_GNUTLS
       if (XPROCESS (proc)->gnutls_p)
 	nbytes = emacs_gnutls_read (channel, XPROCESS (proc),
-                                    chars + carryover, readmax);
+				    chars + carryover + buffered,
+				    readmax - buffered);
       else
 #endif
-	nbytes = emacs_read (channel, chars + carryover, readmax);
+	nbytes = emacs_read (channel, chars + carryover + buffered,
+			     readmax - buffered);
 #ifdef ADAPTIVE_READ_BUFFERING
       if (nbytes > 0 && p->adaptive_read_buffering)
 	{
@@ -5193,7 +5191,7 @@ read_process_output (Lisp_Object proc, register int channel)
 		  delay += READ_OUTPUT_DELAY_INCREMENT * 2;
 		}
 	    }
-	  else if (delay > 0 && (nbytes == readmax))
+	  else if (delay > 0 && nbytes == readmax - buffered)
 	    {
 	      delay -= READ_OUTPUT_DELAY_INCREMENT;
 	      if (delay == 0)
@@ -5207,22 +5205,8 @@ read_process_output (Lisp_Object proc, register int channel)
 	    }
 	}
 #endif
-    }
-  else
-    {
-      chars[carryover] = proc_buffered_char[channel];
-      proc_buffered_char[channel] = -1;
-#ifdef HAVE_GNUTLS
-      if (XPROCESS (proc)->gnutls_p)
-	nbytes = emacs_gnutls_read (channel, XPROCESS (proc),
-                                    chars + carryover + 1, readmax - 1);
-      else
-#endif
-	nbytes = emacs_read (channel, chars + carryover + 1,  readmax - 1);
-      if (nbytes < 0)
-	nbytes = 1;
-      else
-	nbytes = nbytes + 1;
+      nbytes += buffered;
+      nbytes += buffered && nbytes <= 0;
     }
 
   p->decoding_carryover = 0;
@@ -5249,15 +5233,17 @@ read_process_output (Lisp_Object proc, register int channel)
   outstream = p->filter;
   if (!NILP (outstream))
     {
-      Lisp_Object obuffer, okeymap;
       Lisp_Object text;
       int outer_running_asynch_code = running_asynch_code;
       int waiting = waiting_for_user_input_p;
 
       /* No need to gcpro these, because all we do with them later
 	 is test them for EQness, and none of them should be a string.  */
+#if 0
+      Lisp_Object obuffer, okeymap;
       XSETBUFFER (obuffer, current_buffer);
       okeymap = BVAR (current_buffer, keymap);
+#endif
 
       /* We inhibit quit here instead of just catching it so that
 	 hitting ^G when a filter happens to be running won't screw
@@ -6540,7 +6526,7 @@ exec_sentinel_error_handler (Lisp_Object error_val)
 static void
 exec_sentinel (Lisp_Object proc, Lisp_Object reason)
 {
-  Lisp_Object sentinel, obuffer, odeactivate, okeymap;
+  Lisp_Object sentinel, odeactivate;
   register struct Lisp_Process *p = XPROCESS (proc);
   int count = SPECPDL_INDEX ();
   int outer_running_asynch_code = running_asynch_code;
@@ -6552,8 +6538,11 @@ exec_sentinel (Lisp_Object proc, Lisp_Object reason)
   /* No need to gcpro these, because all we do with them later
      is test them for EQness, and none of them should be a string.  */
   odeactivate = Vdeactivate_mark;
+#if 0
+  Lisp_Object obuffer, okeymap;
   XSETBUFFER (obuffer, current_buffer);
   okeymap = BVAR (current_buffer, keymap);
+#endif
 
   /* There's no good reason to let sentinels change the current
      buffer, and many callers of accept-process-output, sit-for, and
diff --git a/src/search.c b/src/search.c
index 682fa185bbb..fa44e1300d7 100644
--- a/src/search.c
+++ b/src/search.c
@@ -1674,7 +1674,6 @@ boyer_moore (EMACS_INT n, unsigned char *base_pat,
   int translate_prev_byte1 = 0;
   int translate_prev_byte2 = 0;
   int translate_prev_byte3 = 0;
-  int translate_prev_byte4 = 0;
 
   /* The general approach is that we are going to maintain that we know
      the first (closest to the present position, in whatever direction
@@ -1730,11 +1729,7 @@ boyer_moore (EMACS_INT n, unsigned char *base_pat,
 	{
 	  translate_prev_byte2 = str[cblen - 3];
 	  if (cblen > 3)
-	    {
-	      translate_prev_byte3 = str[cblen - 4];
-	      if (cblen > 4)
-		translate_prev_byte4 = str[cblen - 5];
-	    }
+	    translate_prev_byte3 = str[cblen - 4];
 	}
     }
 
@@ -2091,7 +2086,7 @@ set_search_regs (EMACS_INT beg_byte, EMACS_INT nbytes)
 static Lisp_Object
 wordify (Lisp_Object string, int lax)
 {
-  register unsigned char *p, *o;
+  register unsigned char *o;
   register EMACS_INT i, i_byte, len, punct_count = 0, word_count = 0;
   Lisp_Object val;
   int prev_c = 0;
@@ -2099,7 +2094,6 @@ wordify (Lisp_Object string, int lax)
   int whitespace_at_end;
 
   CHECK_STRING (string);
-  p = SDATA (string);
   len = SCHARS (string);
 
   for (i = 0, i_byte = 0; i < len; )
@@ -2111,7 +2105,7 @@ wordify (Lisp_Object string, int lax)
       if (SYNTAX (c) != Sword)
 	{
 	  punct_count++;
-	  if (i > 0 && SYNTAX (prev_c) == Sword)
+	  if (SYNTAX (prev_c) == Sword)
 	    word_count++;
 	}
 
@@ -2124,10 +2118,11 @@ wordify (Lisp_Object string, int lax)
       whitespace_at_end = 0;
     }
   else
-    whitespace_at_end = 1;
-
-  if (!word_count)
-    return empty_unibyte_string;
+    {
+      whitespace_at_end = 1;
+      if (!word_count)
+	return empty_unibyte_string;
+    }
 
   adjust = - punct_count + 5 * (word_count - 1)
     + ((lax && !whitespace_at_end) ? 2 : 4);
@@ -2155,7 +2150,7 @@ wordify (Lisp_Object string, int lax)
 	  memcpy (o, SDATA (string) + i_byte_orig, i_byte - i_byte_orig);
 	  o += i_byte - i_byte_orig;
 	}
-      else if (i > 0 && SYNTAX (prev_c) == Sword && --word_count)
+      else if (SYNTAX (prev_c) == Sword && --word_count)
 	{
 	  *o++ = '\\';
 	  *o++ = 'W';
diff --git a/src/sound.c b/src/sound.c
index a2fe7ccc8ce..a972809e2c7 100644
--- a/src/sound.c
+++ b/src/sound.c
@@ -344,7 +344,7 @@ sound_perror (const char *msg)
 static void
 sound_warning (const char *msg)
 {
-  message (msg);
+  message ("%s", msg);
 }
 
 
diff --git a/src/syntax.c b/src/syntax.c
index 0a1525b54ea..56176f32418 100644
--- a/src/syntax.c
+++ b/src/syntax.c
@@ -175,7 +175,8 @@ update_syntax_table (EMACS_INT charpos, int count, int init,
 		     Lisp_Object object)
 {
   Lisp_Object tmp_table;
-  int cnt = 0, invalidate = 1;
+  unsigned cnt = 0;
+  int invalidate = 1;
   INTERVAL i;
 
   if (init)
@@ -1219,7 +1220,7 @@ scan_words (register EMACS_INT from, register EMACS_INT count)
   register EMACS_INT from_byte = CHAR_TO_BYTE (from);
   register enum syntaxcode code;
   int ch0, ch1;
-  Lisp_Object func, script, pos;
+  Lisp_Object func, pos;
 
   immediate_quit = 1;
   QUIT;
@@ -1259,7 +1260,6 @@ scan_words (register EMACS_INT from, register EMACS_INT count)
 	}
       else
 	{
-	  script = CHAR_TABLE_REF (Vchar_script_table, ch0);
 	  while (1)
 	    {
 	      if (from == end) break;
@@ -1310,7 +1310,6 @@ scan_words (register EMACS_INT from, register EMACS_INT count)
 	}
       else
 	{
-	  script = CHAR_TABLE_REF (Vchar_script_table, ch1);
 	  while (1)
 	    {
 	      if (from == beg)
diff --git a/src/sysdep.c b/src/sysdep.c
index 1bb400421f0..a165a9ca52f 100644
--- a/src/sysdep.c
+++ b/src/sysdep.c
@@ -31,6 +31,8 @@ along with GNU Emacs.  If not, see <http://www.gnu.org/licenses/>.  */
 #endif /* HAVE_LIMITS_H */
 #include <unistd.h>
 
+#include <allocator.h>
+#include <careadlinkat.h>
 #include <ignore-value.h>
 
 #include "lisp.h"
@@ -1866,6 +1868,22 @@ emacs_write (int fildes, const char *buf, unsigned int nbyte)
     }
   return (bytes_written);
 }
+
+static struct allocator const emacs_norealloc_allocator =
+  { xmalloc, NULL, xfree, memory_full };
+
+/* Get the symbolic link value of FILENAME.  Return a pointer to a
+   NUL-terminated string.  If readlink fails, return NULL and set
+   errno.  If the value fits in INITIAL_BUF, return INITIAL_BUF.
+   Otherwise, allocate memory and return a pointer to that memory.  If
+   memory allocation fails, diagnose and fail without returning.  If
+   successful, store the length of the symbolic link into *LINKLEN.  */
+char *
+emacs_readlink (char const *filename, char initial_buf[READLINK_BUFSIZE])
+{
+  return careadlinkat (AT_FDCWD, filename, initial_buf, READLINK_BUFSIZE,
+		       &emacs_norealloc_allocator, careadlinkatcwd);
+}
 
 #ifdef USG
 /*
diff --git a/src/term.c b/src/term.c
index fc7726298c5..39c9592e28f 100644
--- a/src/term.c
+++ b/src/term.c
@@ -85,8 +85,10 @@ static void set_tty_hooks (struct terminal *terminal);
 static void dissociate_if_controlling_tty (int fd);
 static void delete_tty (struct terminal *);
 static void maybe_fatal (int must_succeed, struct terminal *terminal,
-			 const char *str1, const char *str2, ...) NO_RETURN;
-static void vfatal (const char *str, va_list ap) NO_RETURN;
+			 const char *str1, const char *str2, ...)
+  NO_RETURN ATTRIBUTE_FORMAT_PRINTF (4, 5);
+static void vfatal (const char *str, va_list ap)
+  NO_RETURN ATTRIBUTE_FORMAT_PRINTF (1, 0);
 
 
 #define OUTPUT(tty, a)                                          \
@@ -707,6 +709,7 @@ tty_write_glyphs (struct frame *f, struct glyph *string, int len)
 {
   unsigned char *conversion_buffer;
   struct coding_system *coding;
+  size_t n, stringlen;
 
   struct tty_display_info *tty = FRAME_TTY (f);
 
@@ -734,13 +737,12 @@ tty_write_glyphs (struct frame *f, struct glyph *string, int len)
      the tail.  */
   coding->mode &= ~CODING_MODE_LAST_BLOCK;
 
-  while (len > 0)
+  for (stringlen = len; stringlen != 0; stringlen -= n)
     {
       /* Identify a run of glyphs with the same face.  */
       int face_id = string->face_id;
-      int n;
 
-      for (n = 1; n < len; ++n)
+      for (n = 1; n < stringlen; ++n)
 	if (string[n].face_id != face_id)
 	  break;
 
@@ -748,7 +750,7 @@ tty_write_glyphs (struct frame *f, struct glyph *string, int len)
       tty_highlight_if_desired (tty);
       turn_on_face (f, face_id);
 
-      if (n == len)
+      if (n == stringlen)
 	/* This is the last run.  */
 	coding->mode |= CODING_MODE_LAST_BLOCK;
       conversion_buffer = encode_terminal_code (string, n, coding);
@@ -762,7 +764,6 @@ tty_write_glyphs (struct frame *f, struct glyph *string, int len)
 	    fwrite (conversion_buffer, 1, coding->produced, tty->termscript);
 	  UNBLOCK_INPUT;
 	}
-      len -= n;
       string += n;
 
       /* Turn appearance modes off.  */
diff --git a/src/textprop.c b/src/textprop.c
index cd89efeb38d..53f92ec936b 100644
--- a/src/textprop.c
+++ b/src/textprop.c
@@ -1379,8 +1379,8 @@ set_text_properties_1 (Lisp_Object start, Lisp_Object end, Lisp_Object propertie
       i = next_interval (i);
     }
 
-  /* We are starting at the beginning of an interval, I */
-  while (len > 0)
+  /* We are starting at the beginning of an interval I.  LEN is positive.  */
+  do
     {
       if (i == 0)
 	abort ();
@@ -1412,6 +1412,7 @@ set_text_properties_1 (Lisp_Object start, Lisp_Object end, Lisp_Object propertie
 
       i = next_interval (i);
     }
+  while (len > 0);
 }
 
 DEFUN ("remove-text-properties", Fremove_text_properties,
diff --git a/src/xdisp.c b/src/xdisp.c
index e6a7f4254ef..fbdd553aa51 100644
--- a/src/xdisp.c
+++ b/src/xdisp.c
@@ -774,6 +774,7 @@ static int store_mode_line_noprop (const char *, int, int);
 static void handle_stop (struct it *);
 static void handle_stop_backwards (struct it *, EMACS_INT);
 static int single_display_spec_intangible_p (Lisp_Object);
+static void vmessage (const char *, va_list) ATTRIBUTE_FORMAT_PRINTF (1, 0);
 static void ensure_echo_area_buffers (void);
 static Lisp_Object unwind_with_echo_area_buffer (Lisp_Object);
 static Lisp_Object with_echo_area_buffer_unwind_data (struct window *);
diff --git a/src/xfaces.c b/src/xfaces.c
index 0fc5dd6f8a3..8a64855bd8f 100644
--- a/src/xfaces.c
+++ b/src/xfaces.c
@@ -5444,7 +5444,6 @@ realize_named_face (struct frame *f, Lisp_Object symbol, int id)
   Lisp_Object lface = lface_from_face_name (f, symbol, 0);
   Lisp_Object attrs[LFACE_VECTOR_SIZE];
   Lisp_Object symbol_attrs[LFACE_VECTOR_SIZE];
-  struct face *new_face;
 
   /* The default face must exist and be fully specified.  */
   get_lface_attributes_no_remap (f, Qdefault, attrs, 1);
@@ -5464,7 +5463,7 @@ realize_named_face (struct frame *f, Lisp_Object symbol, int id)
   merge_face_vectors (f, symbol_attrs, attrs, 0);
 
   /* Realize the face.  */
-  new_face = realize_face (c, attrs, id);
+  realize_face (c, attrs, id);
 }
 
 
@@ -5761,21 +5760,16 @@ map_tty_color (struct frame *f, struct face *face, enum lface_attribute_index id
 {
   Lisp_Object frame, color, def;
   int foreground_p = idx == LFACE_FOREGROUND_INDEX;
-  unsigned long default_pixel, default_other_pixel, pixel;
+  unsigned long default_pixel =
+    foreground_p ? FACE_TTY_DEFAULT_FG_COLOR : FACE_TTY_DEFAULT_BG_COLOR;
+  unsigned long pixel = default_pixel;
+#ifdef MSDOS
+  unsigned long default_other_pixel =
+    foreground_p ? FACE_TTY_DEFAULT_BG_COLOR : FACE_TTY_DEFAULT_FG_COLOR;
+#endif
 
   xassert (idx == LFACE_FOREGROUND_INDEX || idx == LFACE_BACKGROUND_INDEX);
 
-  if (foreground_p)
-    {
-      pixel = default_pixel = FACE_TTY_DEFAULT_FG_COLOR;
-      default_other_pixel = FACE_TTY_DEFAULT_BG_COLOR;
-    }
-  else
-    {
-      pixel = default_pixel = FACE_TTY_DEFAULT_BG_COLOR;
-      default_other_pixel = FACE_TTY_DEFAULT_FG_COLOR;
-    }
-
   XSETFRAME (frame, f);
   color = face->lface[idx];
 
diff --git a/src/xfns.c b/src/xfns.c
index e50d6887179..8e5639681df 100644
--- a/src/xfns.c
+++ b/src/xfns.c
@@ -855,19 +855,20 @@ make_invisible_cursor (struct frame *f)
   static char const no_data[] = { 0 };
   Pixmap pix;
   XColor col;
-  Cursor c;
+  Cursor c = 0;
 
   x_catch_errors (dpy);
   pix = XCreateBitmapFromData (dpy, FRAME_X_DISPLAY_INFO (f)->root_window,
                                no_data, 1, 1);
   if (! x_had_errors_p (dpy) && pix != None)
     {
+      Cursor pixc;
       col.pixel = 0;
       col.red = col.green = col.blue = 0;
       col.flags = DoRed | DoGreen | DoBlue;
-      c = XCreatePixmapCursor (dpy, pix, pix, &col, &col, 0, 0);
-      if (x_had_errors_p (dpy) || c == None)
-        c = 0;
+      pixc = XCreatePixmapCursor (dpy, pix, pix, &col, &col, 0, 0);
+      if (! x_had_errors_p (dpy) && pixc != None)
+        c = pixc;
       XFreePixmap (dpy, pix);
     }
 
@@ -4579,7 +4580,6 @@ x_create_tip_frame (struct x_display_info *dpyinfo,
   struct frame *f;
   Lisp_Object frame;
   Lisp_Object name;
-  long window_prompting = 0;
   int width, height;
   int count = SPECPDL_INDEX ();
   struct gcpro gcpro1, gcpro2, gcpro3;
@@ -4757,7 +4757,7 @@ x_create_tip_frame (struct x_display_info *dpyinfo,
 
   f->output_data.x->parent_desc = FRAME_X_DISPLAY_INFO (f)->root_window;
 
-  window_prompting = x_figure_window_size (f, parms, 0);
+  x_figure_window_size (f, parms, 0);
 
   {
     XSetWindowAttributes attrs;
diff --git a/src/xfont.c b/src/xfont.c
index 3e0fcd2cd75..eaa1a3ea59b 100644
--- a/src/xfont.c
+++ b/src/xfont.c
@@ -844,22 +844,25 @@ xfont_open (FRAME_PTR f, Lisp_Object entity, int pixel_size)
 	font->average_width = XINT (val) / 10;
       if (font->average_width < 0)
 	font->average_width = - font->average_width;
-      if (font->average_width == 0
-	  && encoding->ascii_compatible_p)
+      else
 	{
-	  int width = font->space_width, n = pcm != NULL;
+	  if (font->average_width == 0
+	      && encoding->ascii_compatible_p)
+	    {
+	      int width = font->space_width, n = pcm != NULL;
 
-	  for (char2b.byte2 = 33; char2b.byte2 <= 126; char2b.byte2++)
-	    if ((pcm = xfont_get_pcm (xfont, &char2b)) != NULL)
-	      width += pcm->width, n++;
-	  if (n > 0)
-	    font->average_width = width / n;
+	      for (char2b.byte2 = 33; char2b.byte2 <= 126; char2b.byte2++)
+		if ((pcm = xfont_get_pcm (xfont, &char2b)) != NULL)
+		  width += pcm->width, n++;
+	      if (n > 0)
+		font->average_width = width / n;
+	    }
+	  if (font->average_width == 0)
+	    /* No easy way other than this to get a reasonable
+	       average_width.  */
+	    font->average_width
+	      = (xfont->min_bounds.width + xfont->max_bounds.width) / 2;
 	}
-      if (font->average_width == 0)
-	/* No easy way other than this to get a reasonable
-	   average_width.  */
-	font->average_width
-	  = (xfont->min_bounds.width + xfont->max_bounds.width) / 2;
     }
 
   BLOCK_INPUT;
@@ -966,11 +969,11 @@ xfont_text_extents (struct font *font, unsigned int *code, int nglyphs, struct f
 {
   XFontStruct *xfont = ((struct xfont_info *) font)->xfont;
   int width = 0;
-  int i, first, x;
+  int i, first;
 
   if (metrics)
     memset (metrics, 0, sizeof (struct font_metrics));
-  for (i = 0, x = 0, first = 1; i < nglyphs; i++)
+  for (i = 0, first = 1; i < nglyphs; i++)
     {
       XChar2b char2b;
       static XCharStruct *pcm;
diff --git a/src/xmenu.c b/src/xmenu.c
index 8ecef00c88e..6e175e69039 100644
--- a/src/xmenu.c
+++ b/src/xmenu.c
@@ -341,7 +341,7 @@ for instance using the window manager, then this produces a quit and
     unbind_to (specpdl_count, Qnil);
     discard_menu_items ();
 
-    if (error_name) error (error_name);
+    if (error_name) error ("%s", error_name);
     return selection;
   }
 #endif
diff --git a/src/xselect.c b/src/xselect.c
index 451b2a0b13f..430b7232659 100644
--- a/src/xselect.c
+++ b/src/xselect.c
@@ -391,7 +391,7 @@ static Lisp_Object
 x_get_local_selection (Lisp_Object selection_symbol, Lisp_Object target_type, int local_request)
 {
   Lisp_Object local_value;
-  Lisp_Object handler_fn, value, type, check;
+  Lisp_Object handler_fn, value, check;
   int count;
 
   local_value = assq_no_quit (selection_symbol, Vselection_alist);
@@ -469,7 +469,6 @@ x_get_local_selection (Lisp_Object selection_symbol, Lisp_Object target_type, in
   check = value;
   if (CONSP (value)
       && SYMBOLP (XCAR (value)))
-    type = XCAR (value),
     check = XCDR (value);
 
   if (STRINGP (check)
@@ -1203,9 +1202,9 @@ wait_for_property_change (struct prop_location *location)
 void
 x_handle_property_notify (XPropertyEvent *event)
 {
-  struct prop_location *prev = 0, *rest = property_change_wait_list;
+  struct prop_location *rest;
 
-  while (rest)
+  for (rest = property_change_wait_list; rest; rest = rest->next)
     {
       if (!rest->arrived
 	  && rest->property == event->atom
@@ -1226,9 +1225,6 @@ x_handle_property_notify (XPropertyEvent *event)
 
 	  return;
 	}
-
-      prev = rest;
-      rest = rest->next;
     }
 }
 
diff --git a/src/xterm.c b/src/xterm.c
index dc1fd3cbbd1..92df7ae8746 100644
--- a/src/xterm.c
+++ b/src/xterm.c
@@ -4165,7 +4165,7 @@ xt_action_hook (Widget widget, XtPointer client_data, String action_name,
    x_send_scroll_bar_event and x_scroll_bar_to_input_event.  */
 
 static struct window **scroll_bar_windows;
-static int scroll_bar_windows_size;
+static size_t scroll_bar_windows_size;
 
 
 /* Send a client message with message type Xatom_Scrollbar for a
@@ -4180,7 +4180,7 @@ x_send_scroll_bar_event (Lisp_Object window, int part, int portion, int whole)
   XClientMessageEvent *ev = (XClientMessageEvent *) &event;
   struct window *w = XWINDOW (window);
   struct frame *f = XFRAME (w->frame);
-  int i;
+  size_t i;
 
   BLOCK_INPUT;
 
@@ -4201,10 +4201,12 @@ x_send_scroll_bar_event (Lisp_Object window, int part, int portion, int whole)
 
   if (i == scroll_bar_windows_size)
     {
-      int new_size = max (10, 2 * scroll_bar_windows_size);
+      size_t new_size = max (10, 2 * scroll_bar_windows_size);
       size_t nbytes = new_size * sizeof *scroll_bar_windows;
       size_t old_nbytes = scroll_bar_windows_size * sizeof *scroll_bar_windows;
 
+      if ((size_t) -1 / sizeof *scroll_bar_windows < new_size)
+	memory_full ();
       scroll_bar_windows = (struct window **) xrealloc (scroll_bar_windows,
 							nbytes);
       memset (&scroll_bar_windows[i], 0, nbytes - old_nbytes);
@@ -4240,14 +4242,12 @@ x_scroll_bar_to_input_event (XEvent *event, struct input_event *ievent)
 {
   XClientMessageEvent *ev = (XClientMessageEvent *) event;
   Lisp_Object window;
-  struct frame *f;
   struct window *w;
 
   w = scroll_bar_windows[ev->data.l[0]];
   scroll_bar_windows[ev->data.l[0]] = NULL;
 
   XSETWINDOW (window, w);
-  f = XFRAME (w->frame);
 
   ievent->kind = SCROLL_BAR_CLICK_EVENT;
   ievent->frame_or_window = window;
@@ -4255,7 +4255,8 @@ x_scroll_bar_to_input_event (XEvent *event, struct input_event *ievent)
 #ifdef USE_GTK
   ievent->timestamp = CurrentTime;
 #else
-  ievent->timestamp = XtLastTimestampProcessed (FRAME_X_DISPLAY (f));
+  ievent->timestamp =
+    XtLastTimestampProcessed (FRAME_X_DISPLAY (XFRAME (w->frame)));
 #endif
   ievent->part = ev->data.l[1];
   ievent->code = ev->data.l[2];