diff --git a/lib/client-handshake.c b/lib/client-handshake.c
index 32681fe8..c7e220ee 100644
--- a/lib/client-handshake.c
+++ b/lib/client-handshake.c
@@ -502,7 +502,8 @@ lws_client_connect_via_info(struct lws_client_connect_info *i)
 		 * otherwise do it after the protocol negotiated
 		 */
 		if (i->method)
-			lws_ensure_user_space(wsi);
+			if (lws_ensure_user_space(wsi))
+				goto bail;
 
 #ifdef LWS_OPENSSL_SUPPORT
 	wsi->use_ssl = i->ssl_connection;
diff --git a/lib/libwebsockets.c b/lib/libwebsockets.c
index 6fd11cee..01878350 100644
--- a/lib/libwebsockets.c
+++ b/lib/libwebsockets.c
@@ -2076,9 +2076,10 @@ lws_cgi_write_split_stdout_headers(struct lws *wsi)
 					lwsl_debug("Content-Length: %ld\n", wsi->cgi->content_length);
 					wsi->hdr_state = LHCS_PAYLOAD;
 					/* drop the \0xa ... finalize will add it if needed */
-					lws_finalize_http_header(wsi,
+					if (lws_finalize_http_header(wsi,
 							(unsigned char **)&p,
-							(unsigned char *)end);
+							(unsigned char *)end))
+						return -1;
 					break;
 				}
 				if (m == LCHS_LF2)
diff --git a/lib/libwebsockets.h b/lib/libwebsockets.h
index 78832d74..e4dcaaef 100644
--- a/lib/libwebsockets.h
+++ b/lib/libwebsockets.h
@@ -1644,27 +1644,29 @@ lws_interface_to_sa(int ipv6, const char *ifname, struct sockaddr_in *addr,
 LWS_VISIBLE LWS_EXTERN const unsigned char *
 lws_token_to_string(enum lws_token_indexes token);
 
-LWS_VISIBLE LWS_EXTERN int
+/* all the below must be LWS_WARN_UNUSED_RESULT as they can run short */
+
+LWS_VISIBLE LWS_EXTERN int LWS_WARN_UNUSED_RESULT
 lws_add_http_header_by_name(struct lws *wsi, const unsigned char *name,
 			    const unsigned char *value, int length,
 			    unsigned char **p, unsigned char *end);
-LWS_VISIBLE LWS_EXTERN int
+LWS_VISIBLE LWS_EXTERN int LWS_WARN_UNUSED_RESULT
 lws_finalize_http_header(struct lws *wsi, unsigned char **p,
 			 unsigned char *end);
-LWS_VISIBLE LWS_EXTERN int
+LWS_VISIBLE LWS_EXTERN int LWS_WARN_UNUSED_RESULT
 lws_add_http_header_by_token(struct lws *wsi, enum lws_token_indexes token,
 			     const unsigned char *value, int length,
 			     unsigned char **p, unsigned char *end);
-LWS_VISIBLE LWS_EXTERN int
+LWS_VISIBLE LWS_EXTERN int LWS_WARN_UNUSED_RESULT
 lws_add_http_header_content_length(struct lws *wsi,
 				   unsigned long content_length,
 				   unsigned char **p, unsigned char *end);
-LWS_VISIBLE LWS_EXTERN int
+LWS_VISIBLE LWS_EXTERN int LWS_WARN_UNUSED_RESULT
 lws_add_http_header_status(struct lws *wsi,
 			   unsigned int code, unsigned char **p,
 			   unsigned char *end);
 
-LWS_VISIBLE LWS_EXTERN int
+LWS_VISIBLE LWS_EXTERN int LWS_WARN_UNUSED_RESULT
 lws_http_redirect(struct lws *wsi, const unsigned char *loc, int len,
 		  unsigned char **p, unsigned char *end);
 
diff --git a/lib/private-libwebsockets.h b/lib/private-libwebsockets.h
index 5c3e4cc9..522ca8ec 100644
--- a/lib/private-libwebsockets.h
+++ b/lib/private-libwebsockets.h
@@ -1498,7 +1498,7 @@ lws_hdr_simple_ptr(struct lws *wsi, enum lws_token_indexes h);
 LWS_EXTERN int LWS_WARN_UNUSED_RESULT
 lws_hdr_simple_create(struct lws *wsi, enum lws_token_indexes h, const char *s);
 
-LWS_EXTERN int
+LWS_EXTERN int LWS_WARN_UNUSED_RESULT
 lws_ensure_user_space(struct lws *wsi);
 
 LWS_EXTERN int