Quiet sign comparision warnings.

27 files changed, 59 insertions, 53 deletions

diff --git a/common/fileops.c b/common/fileops.c
index 577bf10a4..89f7ffcf6 100644
--- a/common/fileops.c
+++ b/common/fileops.c
@@ -168,7 +168,8 @@ lock_file(int fd, int lockit)
 ssize_t
 sudo_parseln(char **bufp, size_t *bufsizep, unsigned int *lineno, FILE *fp)
 {
-    size_t len, linesize = 0, total = 0;
+    size_t linesize = 0, total = 0;
+    ssize_t len;
     char *cp, *line = NULL;
     bool continued;
     debug_decl(sudo_parseln, SUDO_DEBUG_UTIL)
diff --git a/common/lbuf.c b/common/lbuf.c
index fe87a7534..58ac88f15 100644
--- a/common/lbuf.c
+++ b/common/lbuf.c
@@ -77,7 +77,7 @@ lbuf_destroy(struct lbuf *lbuf)
 }
 
 static void
-lbuf_expand(struct lbuf *lbuf, size_t extra)
+lbuf_expand(struct lbuf *lbuf, int extra)
 {
     if (lbuf->len + extra + 1 >= lbuf->size) {
 	do {
diff --git a/common/secure_path.c b/common/secure_path.c
index 6eaf2fc85..fd2f75c07 100644
--- a/common/secure_path.c
+++ b/common/secure_path.c
@@ -38,7 +38,7 @@
  * Verify that path is the right type and not writable by other users.
  */
 int
-sudo_secure_path(const char *path, int type, uid_t uid, gid_t gid, struct stat *sbp)
+sudo_secure_path(const char *path, unsigned int type, uid_t uid, gid_t gid, struct stat *sbp)
 {
     struct stat sb;
     int rval = SUDO_PATH_MISSING;
diff --git a/common/sudo_debug.c b/common/sudo_debug.c
index 4a737f835..7e51ff279 100644
--- a/common/sudo_debug.c
+++ b/common/sudo_debug.c
@@ -119,6 +119,7 @@ static int sudo_debug_fd = -1;
 static int sudo_debug_mode;
 static char sudo_debug_pidstr[(((sizeof(int) * 8) + 2) / 3) + 3];
 static size_t sudo_debug_pidlen;
+static const int num_subsystems = NUM_SUBSYSTEMS;
 
 /*
  * Parse settings string from sudo.conf and open debugfile.
@@ -135,7 +136,7 @@ int sudo_debug_init(const char *debugfile, const char *settings)
 	return 1;
 
     /* Init per-subsystems settings to -1 since 0 is a valid priority. */
-    for (i = 0; i < NUM_SUBSYSTEMS; i++)
+    for (i = 0; i < num_subsystems; i++)
 	sudo_debug_settings[i] = -1;
 
     /* Open debug file if specified. */
@@ -442,7 +443,7 @@ sudo_debug_vprintf2(const char *func, const char *file, int lineno, int level,
     subsys = SUDO_DEBUG_SUBSYS(level);
 
     /* Make sure we want debug info at this level. */
-    if (subsys < NUM_SUBSYSTEMS && sudo_debug_settings[subsys] >= pri) {
+    if (subsys < num_subsystems && sudo_debug_settings[subsys] >= pri) {
 	buflen = fmt ? vasprintf(&buf, fmt, ap) : 0;
 	if (buflen != -1) {
 	    int errcode = ISSET(level, SUDO_DEBUG_ERRNO) ? saved_errno : 0;
@@ -484,7 +485,7 @@ sudo_debug_execve2(int level, const char *path, char *const argv[], char *const
     subsys = SUDO_DEBUG_SUBSYS(level);
 
     /* Make sure we want debug info at this level. */
-    if (subsys >= NUM_SUBSYSTEMS || sudo_debug_settings[subsys] < pri)
+    if (subsys >= num_subsystems || sudo_debug_settings[subsys] < pri)
 	return;
 
     /* Log envp for debug level "debug". */
diff --git a/include/secure_path.h b/include/secure_path.h
index b96b89b54..aa4f8de65 100644
--- a/include/secure_path.h
+++ b/include/secure_path.h
@@ -26,6 +26,6 @@
 
 int sudo_secure_dir(const char *path, uid_t uid, gid_t gid, struct stat *sbp);
 int sudo_secure_file(const char *path, uid_t uid, gid_t gid, struct stat *sbp);
-int sudo_secure_path(const char *path, int type, uid_t uid, gid_t gid, struct stat *sbp);
+int sudo_secure_path(const char *path, unsigned int type, uid_t uid, gid_t gid, struct stat *sbp);
 
 #endif /* _SUDO_SECURE_PATH_H */
diff --git a/plugins/sudoers/find_path.c b/plugins/sudoers/find_path.c
index 2d5261372..7dea1edac 100644
--- a/plugins/sudoers/find_path.c
+++ b/plugins/sudoers/find_path.c
@@ -105,7 +105,7 @@ find_path(char *infile, char **outfile, struct stat *sbp, char *path,
 	 * Resolve the path and exit the loop if found.
 	 */
 	len = snprintf(command, sizeof(command), "%s/%s", path, infile);
-	if (len <= 0 || len >= sizeof(command)) {
+	if (len <= 0 || (size_t)len >= sizeof(command)) {
 	    errno = ENAMETOOLONG;
 	    fatal("%s", infile);
 	}
@@ -122,7 +122,7 @@ find_path(char *infile, char **outfile, struct stat *sbp, char *path,
      */
     if (!found && checkdot) {
 	len = snprintf(command, sizeof(command), "./%s", infile);
-	if (len <= 0 || len >= sizeof(command)) {
+	if (len <= 0 || (size_t)len >= sizeof(command)) {
 	    errno = ENAMETOOLONG;
 	    fatal("%s", infile);
 	}
diff --git a/plugins/sudoers/getdate.c b/plugins/sudoers/getdate.c
index c64dcf811..9cc2d5a72 100644
--- a/plugins/sudoers/getdate.c
+++ b/plugins/sudoers/getdate.c
@@ -1049,7 +1049,7 @@ static int yygrowstack()
 #else
 #define YY_SIZE_MAX 0x7fffffff
 #endif
-    if (YY_SIZE_MAX / newsize < sizeof *newss)
+    if (YY_SIZE_MAX / (unsigned int)newsize < sizeof *newss)
         goto bail;
     i = yyssp - yyss;
     newss = yyss ? (short *)realloc(yyss, newsize * sizeof *newss) :
diff --git a/plugins/sudoers/group_plugin.c b/plugins/sudoers/group_plugin.c
index fcb1eecc2..9dd2ebaf1 100644
--- a/plugins/sudoers/group_plugin.c
+++ b/plugins/sudoers/group_plugin.c
@@ -86,7 +86,7 @@ group_plugin_load(char *plugin_info)
 	len = snprintf(path, sizeof(path), "%s%s",
 	    (*plugin_info != '/') ? _PATH_SUDO_PLUGIN_DIR : "", plugin_info);
     }
-    if (len <= 0 || len >= sizeof(path)) {
+    if (len <= 0 || (size_t)len >= sizeof(path)) {
 	errno = ENAMETOOLONG;
 	warning("%s%s",
 	    (*plugin_info != '/') ? _PATH_SUDO_PLUGIN_DIR : "", plugin_info);
diff --git a/plugins/sudoers/interfaces.h b/plugins/sudoers/interfaces.h
index 26e669824..f60ba1d7a 100644
--- a/plugins/sudoers/interfaces.h
+++ b/plugins/sudoers/interfaces.h
@@ -37,7 +37,7 @@ union sudo_in_addr_un {
  */
 struct interface {
     SLIST_ENTRY(interface) entries;
-    int family;	/* AF_INET or AF_INET6 */
+    unsigned int family;	/* AF_INET or AF_INET6 */
     union sudo_in_addr_un addr;
     union sudo_in_addr_un netmask;
 };
diff --git a/plugins/sudoers/iolog.c b/plugins/sudoers/iolog.c
index 6dc8a2634..e6ef6c5e6 100644
--- a/plugins/sudoers/iolog.c
+++ b/plugins/sudoers/iolog.c
@@ -176,7 +176,7 @@ io_nextid(char *iolog_dir, char *iolog_dir_fallback, char sessid[7])
      * Open sequence file
      */
     len = snprintf(pathbuf, sizeof(pathbuf), "%s/seq", iolog_dir);
-    if (len <= 0 || len >= sizeof(pathbuf)) {
+    if (len <= 0 || (size_t)len >= sizeof(pathbuf)) {
 	errno = ENAMETOOLONG;
 	log_fatal(USE_ERRNO, "%s/seq", pathbuf);
     }
@@ -196,7 +196,7 @@ io_nextid(char *iolog_dir, char *iolog_dir_fallback, char sessid[7])
 
 	len = snprintf(fallback, sizeof(fallback), "%s/seq",
 	    iolog_dir_fallback);
-	if (len > 0 && len < sizeof(fallback)) {
+	if (len > 0 && (size_t)len < sizeof(fallback)) {
 	    int fd2 = open(fallback, O_RDWR|O_CREAT, S_IRUSR|S_IWUSR);
 	    if (fd2 != -1) {
 		nread = read(fd2, buf, sizeof(buf));
diff --git a/plugins/sudoers/iolog_path.c b/plugins/sudoers/iolog_path.c
index 2d3ac90b5..b533e21bc 100644
--- a/plugins/sudoers/iolog_path.c
+++ b/plugins/sudoers/iolog_path.c
@@ -194,7 +194,7 @@ expand_iolog_path(const char *prefix, const char *dir, const char *file,
 	    break;
 	case 1:
 	    /* Trim trailing slashes from dir component. */
-	    while (dst - path - 1 > prelen && dst[-1] == '/')
+	    while (dst > path + prelen + 1 && dst[-1] == '/')
 		dst--;
 	    /* The NUL will be replaced with a '/' at the end. */
 	    if (dst + 1 >= pathend)
diff --git a/plugins/sudoers/ldap.c b/plugins/sudoers/ldap.c
index 3e93ccd69..4fffe04db 100644
--- a/plugins/sudoers/ldap.c
+++ b/plugins/sudoers/ldap.c
@@ -398,10 +398,12 @@ sudo_ldap_conf_add_ports(void)
 
     char *host, *port, defport[13];
     char hostbuf[LINE_MAX * 2];
+    int len;
     debug_decl(sudo_ldap_conf_add_ports, SUDO_DEBUG_LDAP)
 
     hostbuf[0] = '\0';
-    if (snprintf(defport, sizeof(defport), ":%d", ldap_conf.port) >= sizeof(defport))
+    len = snprintf(defport, sizeof(defport), ":%d", ldap_conf.port);
+    if (len <= 0 || (size_t)len >= sizeof(defport))
 	fatalx(_("sudo_ldap_conf_add_ports: port too large"));
 
     for ((host = strtok(ldap_conf.host, " \t")); host; (host = strtok(NULL, " \t"))) {
@@ -1099,7 +1101,7 @@ sudo_ldap_timefilter(char *buffer, size_t buffersize)
     /* Build filter. */
     bytes = snprintf(buffer, buffersize, "(&(|(!(sudoNotAfter=*))(sudoNotAfter>=%s))(|(!(sudoNotBefore=*))(sudoNotBefore<=%s)))",
 	timebuffer, timebuffer);
-    if (bytes < 0 || bytes >= buffersize) {
+    if (bytes <= 0 || (size_t)bytes >= buffersize) {
 	warning(_("unable to build time filter"));
 	bytes = 0;
     }
diff --git a/plugins/sudoers/logging.c b/plugins/sudoers/logging.c
index b454b21bd..449eaee37 100644
--- a/plugins/sudoers/logging.c
+++ b/plugins/sudoers/logging.c
@@ -198,7 +198,7 @@ do_logfile(char *msg)
 	    def_logfile, strerror(errno));
     } else {
 	time(&now);
-	if (def_loglinelen < sizeof(LOG_INDENT)) {
+	if ((size_t)def_loglinelen < sizeof(LOG_INDENT)) {
 	    /* Don't pretty-print long log file lines (hard to grep) */
 	    if (def_log_host) {
 		(void) fprintf(fp, "%s : %s : HOST=%s : %s\n",
diff --git a/plugins/sudoers/match_addr.c b/plugins/sudoers/match_addr.c
index 29bfd52dc..1d757c814 100644
--- a/plugins/sudoers/match_addr.c
+++ b/plugins/sudoers/match_addr.c
@@ -55,9 +55,9 @@ addr_matches_if(char *n)
     union sudo_in_addr_un addr;
     struct interface *ifp;
 #ifdef HAVE_STRUCT_IN6_ADDR
-    int j;
+    unsigned int j;
 #endif
-    int family;
+    unsigned int family;
     debug_decl(addr_matches_if, SUDO_DEBUG_MATCH)
 
 #ifdef HAVE_STRUCT_IN6_ADDR
@@ -102,13 +102,13 @@ addr_matches_if(char *n)
 static bool
 addr_matches_if_netmask(char *n, char *m)
 {
-    int i;
+    unsigned int i;
     union sudo_in_addr_un addr, mask;
     struct interface *ifp;
 #ifdef HAVE_STRUCT_IN6_ADDR
-    int j;
+    unsigned int j;
 #endif
-    int family;
+    unsigned int family;
     debug_decl(addr_matches_if, SUDO_DEBUG_MATCH)
 
 #ifdef HAVE_STRUCT_IN6_ADDR
diff --git a/plugins/sudoers/parse.h b/plugins/sudoers/parse.h
index 62bb8acbc..a29951649 100644
--- a/plugins/sudoers/parse.h
+++ b/plugins/sudoers/parse.h
@@ -34,7 +34,7 @@
 #define SUDO_DIGEST_INVALID	4
 
 struct sudo_digest {
-    int digest_type;
+    unsigned int digest_type;
     char *digest_str;
 };
 
diff --git a/plugins/sudoers/policy.c b/plugins/sudoers/policy.c
index a87d5a2d3..2d04c33e0 100644
--- a/plugins/sudoers/policy.c
+++ b/plugins/sudoers/policy.c
@@ -463,14 +463,14 @@ sudoers_policy_exec_setup(char *argv[], char *envp[], mode_t cmnd_umask,
 	egid = runas_gr ? (unsigned int)runas_gr->gr_gid :
 	    (unsigned int)runas_pw->pw_gid;
 	len = snprintf(cp, glsize - (cp - gid_list), "%u", egid);
-	if (len < 0 || len >= glsize - (cp - gid_list))
+	if (len < 0 || (size_t)len >= glsize - (cp - gid_list))
 	    fatalx(_("internal error, %s overflow"), "runas_groups");
 	cp += len;
 	for (i = 0; i < grlist->ngids; i++) {
 	    if (grlist->gids[i] != egid) {
 		len = snprintf(cp, glsize - (cp - gid_list), ",%u",
 		     (unsigned int) grlist->gids[i]);
-		if (len < 0 || len >= glsize - (cp - gid_list))
+		if (len < 0 || (size_t)len >= glsize - (cp - gid_list))
 		    fatalx(_("internal error, %s overflow"), "runas_groups");
 		cp += len;
 	    }
diff --git a/plugins/sudoers/prompt.c b/plugins/sudoers/prompt.c
index e98c8eeec..af1dc125d 100644
--- a/plugins/sudoers/prompt.c
+++ b/plugins/sudoers/prompt.c
@@ -110,14 +110,14 @@ expand_prompt(const char *old_prompt, const char *user, const char *host)
 		    case 'h':
 			p++;
 			n = strlcpy(np, user_shost, np - endp);
-			if (n >= np - endp)
+			if (n >= (size_t)(np - endp))
 			    goto oflow;
 			np += n;
 			continue;
 		    case 'H':
 			p++;
 			n = strlcpy(np, user_host, np - endp);
-			if (n >= np - endp)
+			if (n >= (size_t)(np - endp))
 			    goto oflow;
 			np += n;
 			continue;
@@ -129,21 +129,21 @@ expand_prompt(const char *old_prompt, const char *user, const char *host)
 				n = strlcpy(np, runas_pw->pw_name, np - endp);
 			else
 				n = strlcpy(np, user_name, np - endp);
-			if (n >= np - endp)
+			if (n >= (size_t)(np - endp))
 				goto oflow;
 			np += n;
 			continue;
 		    case 'u':
 			p++;
 			n = strlcpy(np, user_name, np - endp);
-			if (n >= np - endp)
+			if (n >= (size_t)(np - endp))
 			    goto oflow;
 			np += n;
 			continue;
 		    case 'U':
 			p++;
 			n = strlcpy(np,  runas_pw->pw_name, np - endp);
-			if (n >= np - endp)
+			if (n >= (size_t)(np - endp))
 			    goto oflow;
 			np += n;
 			continue;
diff --git a/plugins/sudoers/pwutil_impl.c b/plugins/sudoers/pwutil_impl.c
index 8702b886a..ac3354909 100644
--- a/plugins/sudoers/pwutil_impl.c
+++ b/plugins/sudoers/pwutil_impl.c
@@ -229,12 +229,12 @@ sudo_make_grlist_item(struct passwd *pw, char * const *unused1,
     char * const *unused2)
 {
     char *cp;
-    size_t i, nsize, ngroups, total, len;
+    size_t nsize, ngroups, total, len;
     struct cache_item_grlist *grlitem;
     struct group_list *grlist;
     GETGROUPS_T *gids;
     struct group *grp;
-    int ngids, groupname_len;
+    int i, ngids, groupname_len;
     debug_decl(sudo_make_grlist_item, SUDO_DEBUG_NSS)
 
     if (pw == sudo_user.pw && sudo_user.gids != NULL) {
diff --git a/plugins/sudoers/set_perms.c b/plugins/sudoers/set_perms.c
index a38cb3a36..095cf6231 100644
--- a/plugins/sudoers/set_perms.c
+++ b/plugins/sudoers/set_perms.c
@@ -79,9 +79,9 @@ static struct perm_state perm_stack[PERM_STACK_MAX];
 static int perm_stack_depth = 0;
 
 #undef ID
-#define ID(x) (state->x == ostate->x ? -1 : state->x)
+#define ID(x) (state->x == ostate->x ? (id_t)-1 : state->x)
 #undef OID
-#define OID(x) (ostate->x == state->x ? -1 : ostate->x)
+#define OID(x) (ostate->x == state->x ? (id_t)-1 : ostate->x)
 
 void
 rewind_perms(void)
diff --git a/plugins/sudoers/sudoreplay.c b/plugins/sudoers/sudoreplay.c
index fcf2eafbc..922ef9e80 100644
--- a/plugins/sudoers/sudoreplay.c
+++ b/plugins/sudoers/sudoreplay.c
@@ -194,7 +194,7 @@ static int open_io_fd(char *path, int len, struct io_log_file *iol);
 static int parse_timing(const char *buf, const char *decimal, int *idx, double *seconds, size_t *nbytes);
 static struct log_info *parse_logfile(char *logfile);
 static void free_log_info(struct log_info *li);
-static size_t atomic_writev(int fd, struct iovec *iov, int iovcnt);
+static ssize_t atomic_writev(int fd, struct iovec *iov, int iovcnt);
 static void sudoreplay_handler(int);
 static void sudoreplay_cleanup(void);
 
@@ -327,13 +327,13 @@ main(int argc, char *argv[])
     if (VALID_ID(id)) {
 	plen = snprintf(path, sizeof(path), "%s/%.2s/%.2s/%.2s/timing",
 	    session_dir, id, &id[2], &id[4]);
-	if (plen <= 0 || plen >= sizeof(path))
+	if (plen <= 0 || (size_t)plen >= sizeof(path))
 	    fatalx(_("%s/%.2s/%.2s/%.2s/timing: %s"), session_dir,
 		id, &id[2], &id[4], strerror(ENAMETOOLONG));
     } else {
 	plen = snprintf(path, sizeof(path), "%s/%s/timing",
 	    session_dir, id);
-	if (plen <= 0 || plen >= sizeof(path))
+	if (plen <= 0 || (size_t)plen >= sizeof(path))
 	    fatalx(_("%s/%s/timing: %s"), session_dir,
 		id, strerror(ENAMETOOLONG));
     }
@@ -469,7 +469,7 @@ main(int argc, char *argv[])
 		    cp = ep + 1;
 		    remainder -= linelen;
 		}
-		if (cp - buf != nread) {
+		if ((size_t)(cp - buf) != nread) {
 		    /*
 		     * Partial line without a linefeed or multiple lines
 		     * with \r\n pairs.
@@ -542,7 +542,7 @@ open_io_fd(char *path, int len, struct io_log_file *iol)
  * Call writev(), restarting as needed and handling EAGAIN since
  * fd may be in non-blocking mode.
  */
-static size_t
+static ssize_t
 atomic_writev(int fd, struct iovec *iov, int iovcnt)
 {
     ssize_t n, nwritten = 0;
@@ -945,7 +945,8 @@ find_sessions(const char *dir, REGEX_T *re, const char *user, const char *tty)
     struct dirent *dp;
     struct stat sb;
     size_t sdlen, sessions_len = 0, sessions_size = 36*36;
-    int i, len;
+    unsigned int i;
+    int len;
     char pathbuf[PATH_MAX], **sessions = NULL;
 #ifdef HAVE_STRUCT_DIRENT_D_TYPE
     bool checked_type = true;
@@ -999,7 +1000,7 @@ find_sessions(const char *dir, REGEX_T *re, const char *user, const char *tty)
     for (i = 0; i < sessions_len; i++) {
 	len = snprintf(&pathbuf[sdlen], sizeof(pathbuf) - sdlen,
 	    "%s/log", sessions[i]);
-	if (len <= 0 || len >= sizeof(pathbuf) - sdlen) {
+	if (len <= 0 || (size_t)len >= sizeof(pathbuf) - sdlen) {
 	    errno = ENAMETOOLONG;
 	    fatal("%s/%s/log", dir, sessions[i]);
 	}
diff --git a/plugins/sudoers/timestamp.c b/plugins/sudoers/timestamp.c
index 7f3954883..eb50e5ff0 100644
--- a/plugins/sudoers/timestamp.c
+++ b/plugins/sudoers/timestamp.c
@@ -88,7 +88,7 @@ build_timestamp(struct passwd *pw)
     timestampfile[0] = '\0';
     len = snprintf(timestampdir, sizeof(timestampdir), "%s/%s", dirparent,
 	user_name);
-    if (len <= 0 || len >= sizeof(timestampdir))
+    if (len <= 0 || (size_t)len >= sizeof(timestampdir))
 	goto bad;
 
     /*
@@ -103,7 +103,7 @@ build_timestamp(struct passwd *pw)
 	    /* No tty, use parent pid. */
 	    len = snprintf(pidbuf, sizeof(pidbuf), "pid%u",
 		(unsigned int)getppid());
-	    if (len <= 0 || len >= sizeof(pidbuf))
+	    if (len <= 0 || (size_t)len >= sizeof(pidbuf))
 		goto bad;
 	    p = pidbuf;
 	} else if ((p = strrchr(user_tty, '/'))) {
@@ -118,12 +118,12 @@ build_timestamp(struct passwd *pw)
 	    len = snprintf(timestampfile, sizeof(timestampfile), "%s/%s/%s",
 		dirparent, user_name, p);
 	}
-	if (len <= 0 || len >= sizeof(timestampfile))
+	if (len <= 0 || (size_t)len >= sizeof(timestampfile))
 	    goto bad;
     } else if (def_targetpw) {
 	len = snprintf(timestampfile, sizeof(timestampfile), "%s/%s/%s",
 	    dirparent, user_name, runas_pw->pw_name);
-	if (len <= 0 || len >= sizeof(timestampfile))
+	if (len <= 0 || (size_t)len >= sizeof(timestampfile))
 	    goto bad;
     }
     sudo_debug_printf(SUDO_DEBUG_INFO, "using timestamp file %s", timestampfile);
diff --git a/plugins/sudoers/toke.c b/plugins/sudoers/toke.c
index 936c93b88..8dfedb4fe 100644
--- a/plugins/sudoers/toke.c
+++ b/plugins/sudoers/toke.c
@@ -2500,7 +2500,7 @@ YY_RULE_SETUP
 #line 289 "toke.l"
 {
 			    /* Only return DIGEST if the length is correct. */
-			    size_t len;
+			    int len;
 			    if (sudoerstext[sudoersleng - 1] == '=') {
 				/* use padding */
 				len = 4 * ((digest_len + 2) / 3);
diff --git a/plugins/sudoers/toke.l b/plugins/sudoers/toke.l
index e90405d4a..413adc9e3 100644
--- a/plugins/sudoers/toke.l
+++ b/plugins/sudoers/toke.l
@@ -288,7 +288,7 @@ DEFVAR			[a-z_]+
 
 <WANTDIGEST>[A-Za-z0-9\+/=]+ {
 			    /* Only return DIGEST if the length is correct. */
-			    size_t len;
+			    int len;
 			    if (sudoerstext[sudoersleng - 1] == '=') {
 				/* use padding */
 				len = 4 * ((digest_len + 2) / 3);
diff --git a/plugins/sudoers/toke_util.c b/plugins/sudoers/toke_util.c
index 505dc8ee7..cb334f615 100644
--- a/plugins/sudoers/toke_util.c
+++ b/plugins/sudoers/toke_util.c
@@ -172,7 +172,7 @@ fill_args(const char *s, int len, int addspace)
     p = sudoerslval.command.args + arg_len;
     if (addspace)
 	*p++ = ' ';
-    if (strlcpy(p, s, arg_size - (p - sudoerslval.command.args)) != len) {
+    if (strlcpy(p, s, arg_size - (p - sudoerslval.command.args)) != (size_t)len) {
 	warningx(_("fill_args: buffer overflow"));	/* paranoia */
 	sudoerserror(NULL);
 	debug_return_bool(false);
diff --git a/src/load_plugins.c b/src/load_plugins.c
index c84dacbf1..ac5611ffd 100644
--- a/src/load_plugins.c
+++ b/src/load_plugins.c
@@ -74,8 +74,9 @@ sudo_stat_plugin(struct plugin_info *info, char *fullpath,
 	}
 	status = stat(fullpath, sb);
     } else {
-	if (snprintf(fullpath, pathsize, "%s%s", _PATH_SUDO_PLUGIN_DIR,
-	    info->path) >= pathsize) {
+	int len = snprintf(fullpath, pathsize, "%s%s", _PATH_SUDO_PLUGIN_DIR,
+	    info->path);
+	if (len <= 0 || (size_t)len >= pathsize) {
 	    warningx(_("error in %s, line %d while loading plugin `%s'"),
 		_PATH_SUDO_CONF, info->lineno, info->symbol_name);
 	    warningx(_("%s%s: %s"), _PATH_SUDO_PLUGIN_DIR, info->path,
diff --git a/src/sudo.c b/src/sudo.c
index a3a36ba20..a87cae596 100644
--- a/src/sudo.c
+++ b/src/sudo.c
@@ -767,7 +767,7 @@ sudo_check_suid(const char *sudo)
 		    if ((colon = strchr(cp, ':')))
 			*colon = '\0';
 		    len = snprintf(pathbuf, sizeof(pathbuf), "%s/%s", cp, sudo);
-		    if (len <= 0 || len >= sizeof(pathbuf))
+		    if (len <= 0 || (size_t)len >= sizeof(pathbuf))
 			continue;
 		    if (access(pathbuf, X_OK) == 0) {
 			sudo = pathbuf;
diff --git a/src/ttyname.c b/src/ttyname.c
index 02480ef0a..0e77c644e 100644
--- a/src/ttyname.c
+++ b/src/ttyname.c
@@ -371,7 +371,7 @@ get_process_ttyname(void)
 	rc = sysctl(mib, sudo_kp_namelen, ki_proc, &size, NULL, 0);
     } while (rc == -1 && errno == ENOMEM);
     if (rc != -1) {
-	if (ki_proc->sudo_kp_tdev != (dev_t)-1) {
+	if ((dev_t)ki_proc->sudo_kp_tdev != (dev_t)-1) {
 	    tty = sudo_ttyname_dev(ki_proc->sudo_kp_tdev);
 	    if (tty == NULL) {
 		sudo_debug_printf(SUDO_DEBUG_WARN,