diff --git a/channels/serial/client/serial_tty.c b/channels/serial/client/serial_tty.c
index 8e051e930..a7d365471 100644
--- a/channels/serial/client/serial_tty.c
+++ b/channels/serial/client/serial_tty.c
@@ -426,8 +426,10 @@ BOOL serial_tty_read(SERIAL_TTY* tty, BYTE* buffer, UINT32* Length)
 
 		ptermios = (struct termios*) calloc(1, sizeof(struct termios));
 
-		if (tcgetattr(tty->fd, ptermios) < 0)
+		if (tcgetattr(tty->fd, ptermios) < 0) {
+			free(ptermios);
 			return FALSE;
+		}
 
 		/**
 		 * If a timeout is set, do a blocking read, which times out after some time.
@@ -448,6 +450,7 @@ BOOL serial_tty_read(SERIAL_TTY* tty, BYTE* buffer, UINT32* Length)
 
 		tcsetattr(tty->fd, TCSANOW, ptermios);
 		tty->timeout = timeout;
+		free(ptermios);
 	}
 
 	ZeroMemory(buffer, *Length);
diff --git a/client/common/file.c b/client/common/file.c
index c73be9198..62114f485 100644
--- a/client/common/file.c
+++ b/client/common/file.c
@@ -674,6 +674,7 @@ BOOL freerdp_client_write_rdp_file(const rdpFile* file, const char* name, BOOL u
 	if (freerdp_client_write_rdp_file_buffer(file, buffer, length + 1) != length)
 	{
 		fprintf(stderr, "freerdp_client_write_rdp_file: error writing to output buffer\n");
+		free(buffer);
 		return FALSE;
 	}
 
diff --git a/libfreerdp/codec/region.c b/libfreerdp/codec/region.c
index c7fe1f112..4ad0213f4 100644
--- a/libfreerdp/codec/region.c
+++ b/libfreerdp/codec/region.c
@@ -737,8 +737,10 @@ BOOL region16_intersect_rect(REGION16 *dst, const REGION16 *src, const RECTANGLE
 		free(dst->data);
 
 	dst->data = realloc(newItems, newItems->size);
-	if (!dst->data)
+	if (!dst->data) {
+		free(newItems);
 		return FALSE;
+	}
 
 	dst->extents = newExtents;
 	return region16_simplify_bands(dst);
diff --git a/libfreerdp/core/gateway/ncacn_http.c b/libfreerdp/core/gateway/ncacn_http.c
index 2820d8e0d..76e76d603 100644
--- a/libfreerdp/core/gateway/ncacn_http.c
+++ b/libfreerdp/core/gateway/ncacn_http.c
@@ -329,6 +329,7 @@ rdpNtlmHttp* ntlm_http_new()
 out_free_ntlm:
 	ntlm_free(ntlm_http->ntlm);
 out_free:
+	free(ntlm_http);
 	return NULL;
 }
 
diff --git a/libfreerdp/core/gateway/tsg.c b/libfreerdp/core/gateway/tsg.c
index a4cbd9a2a..f130f73ab 100644
--- a/libfreerdp/core/gateway/tsg.c
+++ b/libfreerdp/core/gateway/tsg.c
@@ -360,6 +360,10 @@ BOOL TsProxyCreateTunnelReadResponse(rdpTsg* tsg, RPC_PDU* pdu)
 				if (MsgBytes > TSG_MESSAGING_MAX_MESSAGE_LENGTH)
 				{
 					fprintf(stderr, "Out of Spec Message Length %d", MsgBytes);
+					free(tsgCaps);
+					free(versionCaps);
+					free(packetCapsResponse);
+					free(packet);
 					return FALSE;
 				}
 				offset += MsgBytes;
@@ -373,6 +377,10 @@ BOOL TsProxyCreateTunnelReadResponse(rdpTsg* tsg, RPC_PDU* pdu)
 
 			default:
 				fprintf(stderr, "Unexpected Message Type: 0x%X\n", (int) MessageSwitchValue);
+				free(tsgCaps);
+				free(versionCaps);
+				free(packetCapsResponse);
+				free(packet);
 				return FALSE;
 
 		}
@@ -619,6 +627,7 @@ BOOL TsProxyAuthorizeTunnelReadResponse(rdpTsg* tsg, RPC_PDU* pdu)
 	{
 		fprintf(stderr, "status: E_PROXY_NAP_ACCESSDENIED (0x%08X)\n", E_PROXY_NAP_ACCESSDENIED);
 		fprintf(stderr, "Ensure that the Gateway Connection Authorization Policy is correct\n");
+		free(packet);
 		return FALSE;
 	}
 
diff --git a/libfreerdp/core/license.c b/libfreerdp/core/license.c
index 42e7dc8ef..dc96014a9 100644
--- a/libfreerdp/core/license.c
+++ b/libfreerdp/core/license.c
@@ -1057,6 +1057,7 @@ void license_send_platform_challenge_response_packet(rdpLicense* license)
 	if (!rc4)
 	{
 		fprintf(stderr, "%s: unable to allocate a rc4\n", __FUNCTION__);
+		free(buffer);
 		return;
 	}
 	crypto_rc4(rc4, HWID_LENGTH, license->HardwareId, buffer);
diff --git a/winpr/libwinpr/pipe/pipe.c b/winpr/libwinpr/pipe/pipe.c
index d1c26e5fc..6e82a0b6a 100644
--- a/winpr/libwinpr/pipe/pipe.c
+++ b/winpr/libwinpr/pipe/pipe.c
@@ -145,7 +145,7 @@ HANDLE CreateNamedPipeA(LPCSTR lpName, DWORD dwOpenMode, DWORD dwPipeMode, DWORD
 	if (pNamedPipe->serverfd == -1)
 	{
 		fprintf(stderr, "CreateNamedPipeA: socket error, %s\n", strerror(errno));
-		return INVALID_HANDLE_VALUE;
+		goto err_out;
 	}
 
 	ZeroMemory(&s, sizeof(struct sockaddr_un));
@@ -157,7 +157,7 @@ HANDLE CreateNamedPipeA(LPCSTR lpName, DWORD dwOpenMode, DWORD dwPipeMode, DWORD
 	if (status != 0)
 	{
 		fprintf(stderr, "CreateNamedPipeA: bind error, %s\n", strerror(errno));
-		return INVALID_HANDLE_VALUE;
+		goto err_out;
 	}
 
 	status = listen(pNamedPipe->serverfd, 2);
@@ -165,7 +165,7 @@ HANDLE CreateNamedPipeA(LPCSTR lpName, DWORD dwOpenMode, DWORD dwPipeMode, DWORD
 	if (status != 0)
 	{
 		fprintf(stderr, "CreateNamedPipeA: listen error, %s\n", strerror(errno));
-		return INVALID_HANDLE_VALUE;
+		goto err_out;
 	}
 
 	UnixChangeFileMode(pNamedPipe->lpFilePath, 0xFFFF);
@@ -181,6 +181,13 @@ HANDLE CreateNamedPipeA(LPCSTR lpName, DWORD dwOpenMode, DWORD dwPipeMode, DWORD
 	}
 
 	return hNamedPipe;
+err_out:
+	if (pNamedPipe) {
+		if (pNamedPipe->serverfd != -1)
+			close(pNamedPipe->serverfd);
+		free(pNamedPipe);
+	}
+	return INVALID_HANDLE_VALUE;
 }
 
 HANDLE CreateNamedPipeW(LPCWSTR lpName, DWORD dwOpenMode, DWORD dwPipeMode, DWORD nMaxInstances,
diff --git a/winpr/libwinpr/rpc/ndr.c b/winpr/libwinpr/rpc/ndr.c
index 3434238c2..efc58d809 100644
--- a/winpr/libwinpr/rpc/ndr.c
+++ b/winpr/libwinpr/rpc/ndr.c
@@ -241,7 +241,6 @@ CLIENT_CALL_RETURN NdrClientCall(PMIDL_STUB_DESC pStubDescriptor, PFORMAT_STRING
 	MIDL_STUB_MESSAGE stubMsg;
 	INTERPRETER_FLAGS flags;
 	INTERPRETER_OPT_FLAGS optFlags;
-	INTERPRETER_OPT_FLAGS2 extFlags;
 	NDR_PROC_HEADER* procHeader;
 	NDR_OI2_PROC_HEADER* oi2ProcHeader;
 	CLIENT_CALL_RETURN client_call_return;
@@ -297,6 +296,7 @@ CLIENT_CALL_RETURN NdrClientCall(PMIDL_STUB_DESC pStubDescriptor, PFORMAT_STRING
 
 	if (optFlags.HasExtensions)
 	{
+		INTERPRETER_OPT_FLAGS2 extFlags;
 		NDR_PROC_HEADER_EXTS* extensions = (NDR_PROC_HEADER_EXTS*) pFormat;
 
 		pFormat += extensions->Size;
@@ -324,14 +324,13 @@ CLIENT_CALL_RETURN NdrClientCall(PMIDL_STUB_DESC pStubDescriptor, PFORMAT_STRING
 			}
 		}
 #endif
+		fprintf(stderr, "ExtFlags: ");
+		NdrPrintExtFlags(extFlags);
+		fprintf(stderr, "\n");
 	}
 
 	stubMsg.StackTop = (unsigned char*) stackTop;
 
-	fprintf(stderr, "ExtFlags: ");
-	NdrPrintExtFlags(extFlags);
-	fprintf(stderr, "\n");
-
 	NdrProcessParams(&stubMsg, pFormat, NDR_PHASE_SIZE, fpuStack, numberParams);
 
 	fprintf(stderr, "stubMsg BufferLength: %d\n", (int) stubMsg.BufferLength);
diff --git a/winpr/libwinpr/synch/timer.c b/winpr/libwinpr/synch/timer.c
index d6b06691b..0f0c41572 100644
--- a/winpr/libwinpr/synch/timer.c
+++ b/winpr/libwinpr/synch/timer.c
@@ -648,12 +648,15 @@ BOOL CreateTimerQueueTimer(PHANDLE phNewTimer, HANDLE TimerQueue,
 	WINPR_TIMER_QUEUE* timerQueue;
 	WINPR_TIMER_QUEUE_TIMER* timer;
 
+	if (!TimerQueue)
+		return FALSE;
+
 	timespec_gettimeofday(&CurrentTime);
 
 	timerQueue = (WINPR_TIMER_QUEUE*) TimerQueue;
 	timer = (WINPR_TIMER_QUEUE_TIMER*) malloc(sizeof(WINPR_TIMER_QUEUE_TIMER));
 
-	if (!timer || !TimerQueue)
+	if (!timer)
 		return FALSE;
 
 	WINPR_HANDLE_SET_TYPE(timer, HANDLE_TYPE_TIMER_QUEUE_TIMER);
diff --git a/winpr/libwinpr/utils/collections/BufferPool.c b/winpr/libwinpr/utils/collections/BufferPool.c
index 885064b78..3a0fda5b4 100644
--- a/winpr/libwinpr/utils/collections/BufferPool.c
+++ b/winpr/libwinpr/utils/collections/BufferPool.c
@@ -277,6 +277,9 @@ void* BufferPool_Take(wBufferPool* pool, int size)
 	return buffer;
 
 out_error:
+	if (buffer)
+		free(buffer);
+
 	if (pool->synchronized)
 		LeaveCriticalSection(&pool->lock);
 	return NULL;
diff --git a/winpr/libwinpr/utils/collections/ListDictionary.c b/winpr/libwinpr/utils/collections/ListDictionary.c
index b89620f6e..ca65d8a08 100644
--- a/winpr/libwinpr/utils/collections/ListDictionary.c
+++ b/winpr/libwinpr/utils/collections/ListDictionary.c
@@ -144,8 +144,8 @@ int ListDictionary_GetKeys(wListDictionary* listDictionary, ULONG_PTR** ppKeys)
 		}
 	}
 
-	pKeys = (ULONG_PTR*) malloc(sizeof(ULONG_PTR*) * count);
-	ZeroMemory(pKeys, sizeof(ULONG_PTR*) * count);
+	pKeys = (ULONG_PTR*) malloc(sizeof(ULONG_PTR) * count);
+	ZeroMemory(pKeys, sizeof(ULONG_PTR) * count);
 
 	index = 0;