4 files changed, 23 insertions, 9 deletions

diff --git a/daemon.c b/daemon.c
index ef250bd..9cb7884 100644
--- a/daemon.c
+++ b/daemon.c
@@ -57,7 +57,7 @@ int daemon(int nochdir, int noclose)
     if (nochdir == 0)
         (void)chdir("/");
 
-    if (noclose==0 && (fd = open("/dev/null", O_RDWR, 0)) != -1) {
+    if (noclose == 0 && (fd = open("/dev/null", O_RDWR, 0)) != -1) {
         (void)dup2(fd, STDIN_FILENO);
         (void)dup2(fd, STDOUT_FILENO);
         (void)dup2(fd, STDERR_FILENO);
diff --git a/items.c b/items.c
index 51b1214..6804f0a 100644
--- a/items.c
+++ b/items.c
@@ -283,7 +283,7 @@ char *item_cachedump(const unsigned int slabs_clsid, const unsigned int limit, u
     bufcurr = 0;
 
     while (it != NULL && (limit == 0 || shown < limit)) {
-        len = snprintf(temp, 512, "ITEM %s [%d b; %lu s]\r\n", ITEM_key(it), it->nbytes - 2, it->time + stats.started);
+        len = snprintf(temp, sizeof(temp), "ITEM %s [%d b; %lu s]\r\n", ITEM_key(it), it->nbytes - 2, it->time + stats.started);
         if (bufcurr + len + 6 > memlimit)  /* 6 is END\r\n\0 */
             break;
         strcpy(buffer + bufcurr, temp);
@@ -301,7 +301,9 @@ char *item_cachedump(const unsigned int slabs_clsid, const unsigned int limit, u
 
 void item_stats(char *buffer, const int buflen) {
     int i;
+    int linelen;
     char *bufcurr = buffer;
+    size_t bufleft = (size_t) buflen;
     rel_time_t now = current_time;
 
     if (buflen < 4096) {
@@ -310,9 +312,18 @@ void item_stats(char *buffer, const int buflen) {
     }
 
     for (i = 0; i < LARGEST_ID; i++) {
-        if (tails[i] != NULL)
-            bufcurr += snprintf(bufcurr, (size_t)buflen, "STAT items:%d:number %u\r\nSTAT items:%d:age %u\r\n",
+        if (tails[i] != NULL) {
+            linelen = snprintf(bufcurr, bufleft, "STAT items:%d:number %u\r\nSTAT items:%d:age %u\r\n",
                                i, sizes[i], i, now - tails[i]->time);
+            if (linelen + sizeof("END") < bufleft) {
+                bufcurr += linelen;
+                bufleft -= linelen;
+            }
+            else {
+                /* The caller didn't allocate enough buffer space. */
+                break;
+            }
+        }
     }
     memcpy(bufcurr, "END", 4);
     return;
diff --git a/memcached.c b/memcached.c
index 07b4bda..2918c27 100644
--- a/memcached.c
+++ b/memcached.c
@@ -246,7 +246,7 @@ static int freecurr;
 static void conn_init(void) {
     freetotal = 200;
     freecurr = 0;
-    if (!(freeconns = (conn **)malloc(sizeof(conn *) * freetotal))) {
+    if ((freeconns = (conn **)malloc(sizeof(conn *) * freetotal)) == NULL) {
         perror("malloc()");
     }
     return;
@@ -936,7 +936,7 @@ static void process_stat(conn *c, token_t *tokens, const size_t ntokens) {
         int fd;
         int res;
 
-        if (!(wbuf = (char *)malloc(wsize))) {
+        if ((wbuf = (char *)malloc(wsize)) == NULL) {
             out_string(c, "SERVER_ERROR out of memory");
             return;
         }
@@ -2430,7 +2430,7 @@ static void save_pid(const pid_t pid, const char *pid_file) {
     if (pid_file == NULL)
         return;
 
-    if (!(fp = fopen(pid_file, "w"))) {
+    if ((fp = fopen(pid_file, "w")) == NULL) {
         fprintf(stderr, "Could not open the pid file %s for writing\n", pid_file);
         return;
     }
@@ -2733,7 +2733,10 @@ int main (int argc, char **argv) {
     /* initialise deletion array and timer event */
     deltotal = 200;
     delcurr = 0;
-    todelete = malloc(sizeof(item *) * deltotal);
+    if ((todelete = malloc(sizeof(item *) * deltotal)) == NULL) {
+        perror("failed to allocate memory for deletion array");
+        exit(EXIT_FAILURE);
+    }
     delete_handler(0, 0, 0); /* sets up the event */
     /* create the initial listening udp connection, monitored on all threads */
     if (u_socket > -1) {
diff --git a/thread.c b/thread.c
index c052704..c1473f4 100644
--- a/thread.c
+++ b/thread.c
@@ -310,7 +310,7 @@ static void thread_libevent_process(int fd, short which, void *arg) {
     if (NULL != item) {
         conn *c = conn_new(item->sfd, item->init_state, item->event_flags,
                            item->read_buffer_size, item->is_udp, me->base);
-        if (!c) {
+        if (c == NULL) {
             if (item->is_udp) {
                 fprintf(stderr, "Can't listen for events on UDP socket\n");
                 exit(1);