diff --git a/src/access.c b/src/access.c
index 443fad1a..12fa4db3 100644
--- a/src/access.c
+++ b/src/access.c
@@ -155,8 +155,7 @@ access_ticket_verify2(const char *id, const char *resource)
     return NULL;
 
   if (tvheadend_webroot) {
-    strcpy(buf, tvheadend_webroot);
-    strcat(buf, at->at_resource);
+    snprintf(buf, sizeof(buf), "%s%s", tvheadend_webroot, at->at_resource);
     r = buf;
   } else {
     r = at->at_resource;
diff --git a/src/config.c b/src/config.c
index 94ada7d4..cf7574dd 100644
--- a/src/config.c
+++ b/src/config.c
@@ -1367,10 +1367,14 @@ config_boot ( const char *path, gid_t gid, uid_t uid )
 {
   struct stat st;
   char buf[1024];
-  const char *homedir = getenv("HOME");
 
   /* Generate default */
   if (!path) {
+    const char *homedir = getenv("HOME");
+    if (homedir == NULL) {
+      tvherror("START", "environment variable HOME is not set");
+      exit(EXIT_FAILURE);
+    }
     snprintf(buf, sizeof(buf), "%s/.hts/tvheadend", homedir);
     path = buf;
   }
diff --git a/src/epggrab/module/opentv.c b/src/epggrab/module/opentv.c
index 24ded208..f48e9d48 100644
--- a/src/epggrab/module/opentv.c
+++ b/src/epggrab/module/opentv.c
@@ -701,12 +701,15 @@ static void _opentv_compile_pattern_list ( opentv_pattern_list_t *list, htsmsg_t
 { 
   opentv_pattern_t *pattern;
   htsmsg_field_t *f;
+  const char *s;
 
   TAILQ_INIT(list);
   if (!l) return;
   HTSMSG_FOREACH(f, l) {
     pattern = calloc(1, sizeof(opentv_pattern_t));
-    pattern->text = strdup(htsmsg_field_get_str(f));
+    s = htsmsg_field_get_str(f);
+    if (s == NULL) continue;
+    pattern->text = strdup(s);
     if (regcomp(&pattern->compiled, pattern->text, REG_EXTENDED)) {
       tvhlog(LOG_WARNING, "opentv", "error compiling pattern \"%s\"", pattern->text);
       free(pattern->text);
diff --git a/src/idnode.c b/src/idnode.c
index fc91ff67..75aedee3 100644
--- a/src/idnode.c
+++ b/src/idnode.c
@@ -1442,11 +1442,13 @@ idnode_thread ( void *p )
     HTSMSG_FOREACH(f, q) {
       node  = idnode_find(f->hmf_name, NULL, NULL);
       event = htsmsg_field_get_str(f);
-      m     = htsmsg_create_map();
-      htsmsg_add_str(m, "uuid", f->hmf_name);
-      if (!node)
-        htsmsg_add_u32(m, "removed", 1);
-      notify_by_msg(event, m);
+      if (event) {
+        m     = htsmsg_create_map();
+        htsmsg_add_str(m, "uuid", f->hmf_name);
+        if (!node)
+          htsmsg_add_u32(m, "removed", 1);
+        notify_by_msg(event, m);
+      }
     }
     
     /* Finished */
diff --git a/src/input/mpegts.h b/src/input/mpegts.h
index 58b15bca..8d17964e 100644
--- a/src/input/mpegts.h
+++ b/src/input/mpegts.h
@@ -939,7 +939,7 @@ static inline void mpegts_table_grab
 }
 void mpegts_table_release_
   (mpegts_table_t *mt);
-static inline void mpegts_table_release
+static inline int mpegts_table_release
   (mpegts_table_t *mt)
 {
   int v = atomic_dec(&mt->mt_arefcount, 1);
@@ -947,7 +947,9 @@ static inline void mpegts_table_release
   if (v == 1) {
     assert(mt->mt_destroyed == 1);
     mpegts_table_release_(mt);
+    return 1;
   }
+  return 0;
 }
 int mpegts_table_type
   ( mpegts_table_t *mt );
diff --git a/src/input/mpegts/dvb_psi.c b/src/input/mpegts/dvb_psi.c
index 8e2ebcf8..7f4fa584 100644
--- a/src/input/mpegts/dvb_psi.c
+++ b/src/input/mpegts/dvb_psi.c
@@ -1432,13 +1432,17 @@ dvb_nit_mux
       break;
     case 0x81:
       if (priv == 0) goto lcn;
+      break;
     case 0x82:
       if (priv == 0) goto lcn;
+      break;
     case 0x83:
       if (priv == 0 || priv == 0x28 || priv == 0x29 || priv == 0xa5 ||
           priv == 0x233A) goto lcn;
+      break;
     case 0x86:
       if (priv == 0) goto lcn;
+      break;
     case 0x88:
       if (priv == 0x28) {
         /* HD simulcast */
diff --git a/src/input/mpegts/mpegts_mux.c b/src/input/mpegts/mpegts_mux.c
index f366d8f8..95e1bfd4 100644
--- a/src/input/mpegts/mpegts_mux.c
+++ b/src/input/mpegts/mpegts_mux.c
@@ -805,7 +805,8 @@ mpegts_mux_close_table ( mpegts_mux_t *mm, mpegts_table_t *mt )
     if (mt->mt_defer_cmd) {
       TAILQ_REMOVE(&mm->mm_defer_tables, mt, mt_defer_link);
       mt->mt_defer_cmd = 0;
-      mpegts_table_release(mt);
+      if (mpegts_table_release(mt))
+        return;
     }
     mt->mt_subscribed = 0;
     LIST_REMOVE(mt, mt_link);
diff --git a/src/input/mpegts/scanfile.c b/src/input/mpegts/scanfile.c
index 48494cd7..eb124272 100644
--- a/src/input/mpegts/scanfile.c
+++ b/src/input/mpegts/scanfile.c
@@ -401,6 +401,7 @@ scanfile_load_dvbv5 ( scanfile_network_t *net, char *line, fb_file *fp )
   }
 
   mux = malloc(sizeof(dvb_mux_conf_t));
+  mux->dmc_fe_delsys = -1;
 
   x = htsmsg_get_str(l, "DELIVERY_SYSTEM");
 
diff --git a/src/parsers/parsers.c b/src/parsers/parsers.c
index 082804d9..1a206478 100644
--- a/src/parsers/parsers.c
+++ b/src/parsers/parsers.c
@@ -227,10 +227,9 @@ static void
 parse_aac(service_t *t, elementary_stream_t *st, const uint8_t *data,
           int len, int start)
 {
-  int l, muxlen, p, hdr = 0;
+  int l, muxlen, p;
   th_pkt_t *pkt;
   int64_t olddts = PTS_UNSET, oldpts = PTS_UNSET;
-  int64_t newdts = PTS_UNSET, newpts = PTS_UNSET;
 
   if(st->es_parser_state == 0) {
     if (start) {
@@ -253,8 +252,6 @@ parse_aac(service_t *t, elementary_stream_t *st, const uint8_t *data,
     oldpts = st->es_curpts;
     hlen = parse_pes_header(t, st, data + 6, len - 6);
     if (hlen >= 0 && st->es_buf.sb_ptr) {
-      newdts = st->es_curdts;
-      newpts = st->es_curpts;
       st->es_curdts = olddts;
       st->es_curpts = oldpts;
     }
@@ -287,10 +284,6 @@ parse_aac(service_t *t, elementary_stream_t *st, const uint8_t *data,
         st->es_buf.sb_err = 0;
       }
 
-      if (hdr && newdts != PTS_UNSET) {
-        st->es_curdts = newdts;
-        st->es_curpts = newpts;
-      }
       p += muxlen + 3;
     /* ADTS */
     } else if(p == 0 && d[0] == 0xff && (d[1] & 0xf0) == 0xf0) {
@@ -306,10 +299,6 @@ parse_aac(service_t *t, elementary_stream_t *st, const uint8_t *data,
       sbuf_append(&st->es_buf_a, d, muxlen);
       parse_mp4a_data(t, st, 1);
 
-      if (hdr && newdts != PTS_UNSET) {
-        st->es_curdts = newdts;
-        st->es_curpts = newpts;
-      }
       p += muxlen;
 
     /* Wrong bytestream */
@@ -319,10 +308,6 @@ parse_aac(service_t *t, elementary_stream_t *st, const uint8_t *data,
     }
   }
 
-  if (hdr && newdts != PTS_UNSET) {
-    st->es_curdts = newdts;
-    st->es_curpts = newpts;
-  }
   if (p > 0)
     sbuf_cut(&st->es_buf, p);
 }
diff --git a/src/rtsp.c b/src/rtsp.c
index c453b7e9..58a38b7c 100644
--- a/src/rtsp.c
+++ b/src/rtsp.c
@@ -79,6 +79,8 @@ rtsp_options_decode( http_client_t *hc )
   int i, n, what = 0;
 
   p = http_arg_get(&hc->hc_args, "Public");
+  if (p == NULL)
+    return -EIO;
   n = http_tokenize(p, argv, 32, ',');
   for (i = 1; i < n; i++) {
     if (strcmp(argv[i], "DESCRIBE") == 0)
diff --git a/src/satip/rtp.c b/src/satip/rtp.c
index d1c39fd2..a942cc55 100644
--- a/src/satip/rtp.c
+++ b/src/satip/rtp.c
@@ -357,7 +357,7 @@ satip_rtcp_fec(int fec)
   strncpy(buf, s, sizeof(buf));
   buf[sizeof(buf)-1] = '\0';
   p = strchr(buf, '/');
-  while (*p) {
+  while (p && *p) {
     *p = *(p+1);
     p++;
   }
@@ -531,8 +531,7 @@ int satip_rtp_status(void *id, char *buf, int len)
   satip_rtp_session_t *rtp;
   int r = 0;
 
-  if (buf)
-    buf[0] = '\0';
+  buf[0] = '\0';
   pthread_mutex_lock(&satip_rtp_lock);
   rtp = satip_rtp_find(id);
   if (rtp) {
diff --git a/src/satip/rtsp.c b/src/satip/rtsp.c
index 2098d21d..95f5b6de 100644
--- a/src/satip/rtsp.c
+++ b/src/satip/rtsp.c
@@ -1179,7 +1179,7 @@ rtsp_process_describe(http_connection_t *hc)
   htsbuf_queue_init(&q, 0);
 
   arg = http_arg_get(&hc->hc_args, "Accept");
-  if (strcmp(arg, "application/sdp"))
+  if (arg == NULL || strcmp(arg, "application/sdp"))
     goto error;
 
   if ((u = rtsp_check_urlbase(u)) == NULL)
@@ -1190,8 +1190,10 @@ rtsp_process_describe(http_connection_t *hc)
   pthread_mutex_lock(&rtsp_lock);
 
   if (TAILQ_FIRST(&hc->hc_req_args)) {
-    if (stream < 0)
+    if (stream < 0) {
+      pthread_mutex_unlock(&rtsp_lock);
       goto error;
+    }
     r = rtsp_parse_cmd(hc, stream, -1, &rs, &valid, &oldstate);
     if (r) {
       pthread_mutex_unlock(&rtsp_lock);
@@ -1328,7 +1330,7 @@ rtsp_process_teardown(http_connection_t *hc)
   char *u = tvh_strdupa(hc->hc_url);
   struct session *rs = NULL;
   http_arg_list_t args;
-  char addrbuf[50];
+  char addrbuf[50], session[16];
   int stream;
 
   tcp_get_ip_str((struct sockaddr*)hc->hc_peer, addrbuf, sizeof(addrbuf));
@@ -1348,11 +1350,13 @@ rtsp_process_teardown(http_connection_t *hc)
     pthread_mutex_unlock(&rtsp_lock);
     http_error(hc, !rs ? HTTP_STATUS_BAD_SESSION : HTTP_STATUS_NOT_FOUND);
   } else {
+    strncpy(session, rs->session, sizeof(session));
+    session[sizeof(session)-1] = '\0';
     rtsp_close_session(rs);
     rtsp_free_session(rs);
     pthread_mutex_unlock(&rtsp_lock);
     http_arg_init(&args);
-    http_arg_set(&args, "Session", rs->session);
+    http_arg_set(&args, "Session", session);
     http_send_header(hc, HTTP_STATUS_OK, NULL, 0, NULL, NULL, 0, NULL, NULL, NULL);
     http_arg_flush(&args);
   }
diff --git a/src/satip/server.c b/src/satip/server.c
index ee3c5a23..ff610844 100644
--- a/src/satip/server.c
+++ b/src/satip/server.c
@@ -238,7 +238,7 @@ CONFIGID.UPNP.ORG: 0\r\n\
 
   tvhtrace("satips", "sending byebye");
 
-  for (attempt = 1; attempt < 3; attempt++) {
+  for (attempt = 1; attempt <= 3; attempt++) {
     switch (attempt) {
     case 1:
       nt = "upnp:rootdevice";
diff --git a/src/spawn.c b/src/spawn.c
index fc8fd640..ee442340 100644
--- a/src/spawn.c
+++ b/src/spawn.c
@@ -409,7 +409,16 @@ spawn_and_give_stdout(const char *prog, char *argv[], char *envp[],
   }
 
   if (!argv) argv = (void *)local_argv;
-  if (!argv[0]) argv[0] = (char*)prog;
+  if (!argv[0]) {
+    if (argv != (void *)local_argv) {
+      for (i = 1, e = argv; *e; i++, e++);
+      i = (i + 1) * sizeof(char *);
+      e = alloca(i);
+      memcpy(e, argv, i);
+      argv = e;
+    }
+    argv[0] = (char *)prog;
+  }
 
   if (!envp || !envp[0]) {
     e = environ;
diff --git a/src/subscriptions.c b/src/subscriptions.c
index 40aaa6be..256054c4 100644
--- a/src/subscriptions.c
+++ b/src/subscriptions.c
@@ -466,8 +466,11 @@ subscription_input(void *opauqe, streaming_message_t *sm)
       if(s->ths_start_message != NULL) {
         streaming_target_deliver(s->ths_output, s->ths_start_message);
         s->ths_start_message = NULL;
-        if (s->ths_service)
+        if (s->ths_service) {
+          pthread_mutex_lock(&s->ths_service->s_stream_mutex);
           s->ths_service->s_running = 1;
+          pthread_mutex_unlock(&s->ths_service->s_stream_mutex);
+        }
       }
       s->ths_state = SUBSCRIPTION_GOT_SERVICE;
     }
diff --git a/src/udp.c b/src/udp.c
index 7951b394..3bf241cb 100644
--- a/src/udp.c
+++ b/src/udp.c
@@ -360,6 +360,8 @@ udp_sendinit ( const char *subsystem, const char *name,
     return UDP_FATAL_ERROR;
   }
 
+  uc->fd = fd;
+
   /* Bind to interface */
   ifindex = udp_ifindex_required(uc) ? udp_get_ifindex(ifname) : 0;
   if (ifindex < 0) {
@@ -406,7 +408,6 @@ udp_sendinit ( const char *subsystem, const char *name,
     tvhwarn(subsystem, "%s - cannot increase UDP tx buffer size [%s]",
             name, strerror(errno));
 
-  uc->fd = fd;
   return uc;
 
 error: