diff --git a/lib/gssapi/krb5/accept_sec_context.c b/lib/gssapi/krb5/accept_sec_context.c
index 5a9de96cd..e96361ffb 100644
--- a/lib/gssapi/krb5/accept_sec_context.c
+++ b/lib/gssapi/krb5/accept_sec_context.c
@@ -55,10 +55,10 @@ _gsskrb5_register_acceptor_identity (const char *identity)
     if (identity == NULL) {
 	ret = krb5_kt_default(context, &_gsskrb5_keytab);
     } else {
-	char *p;
+	char *p = NULL;
 
-	asprintf(&p, "FILE:%s", identity);
-	if(p == NULL) {
+	ret = asprintf(&p, "FILE:%s", identity);
+	if(ret < 0 || p == NULL) {
 	    HEIMDAL_MUTEX_unlock(&gssapi_keytab_mutex);
 	    return GSS_S_FAILURE;
 	}
diff --git a/lib/gssapi/krb5/add_cred.c b/lib/gssapi/krb5/add_cred.c
index adc8a09fa..0bd2e557c 100644
--- a/lib/gssapi/krb5/add_cred.c
+++ b/lib/gssapi/krb5/add_cred.c
@@ -155,7 +155,7 @@ OM_uint32 _gsskrb5_add_cred (
 
 	if (cred->ccache) {
 	    const char *type, *name;
-	    char *type_name;
+	    char *type_name = NULL;
 
 	    ret = GSS_S_FAILURE;
 
@@ -187,8 +187,8 @@ OM_uint32 _gsskrb5_add_cred (
 		    goto failure;
 		}
 		
-		asprintf(&type_name, "%s:%s", type, name);
-		if (type_name == NULL) {
+		kret = asprintf(&type_name, "%s:%s", type, name);
+		if (kret < 0 || type_name == NULL) {
 		    *minor_status = ENOMEM;
 		    goto failure;
 		}
diff --git a/lib/gssapi/krb5/display_status.c b/lib/gssapi/krb5/display_status.c
index f9d84fc76..c3d4021bd 100644
--- a/lib/gssapi/krb5/display_status.c
+++ b/lib/gssapi/krb5/display_status.c
@@ -125,14 +125,15 @@ _gsskrb5_set_status (int ret, const char *fmt, ...)
     krb5_context context;
     va_list args;
     char *str;
+    int e;
 
     if (_gsskrb5_init (&context) != 0)
 	return;
 
     va_start(args, fmt);
-    vasprintf(&str, fmt, args);
+    e = vasprintf(&str, fmt, args);
     va_end(args);
-    if (str) {
+    if (e >= 0 && str) {
 	krb5_set_error_message(context, ret, "%s", str);
 	free(str);
     }
@@ -147,7 +148,8 @@ OM_uint32 _gsskrb5_display_status
  gss_buffer_t	 status_string)
 {
     krb5_context context;
-    char *buf;
+    char *buf = NULL;
+    int e = 0;
 
     GSSAPI_KRB5_INIT (&context);
 
@@ -162,27 +164,27 @@ OM_uint32 _gsskrb5_display_status
 
     if (status_type == GSS_C_GSS_CODE) {
 	if (GSS_SUPPLEMENTARY_INFO(status_value))
-	    asprintf(&buf, "%s",
-		     supplementary_error(GSS_SUPPLEMENTARY_INFO(status_value)));
+	    e = asprintf(&buf, "%s",
+			 supplementary_error(GSS_SUPPLEMENTARY_INFO(status_value)));
 	else
-	    asprintf (&buf, "%s %s",
-		      calling_error(GSS_CALLING_ERROR(status_value)),
-		      routine_error(GSS_ROUTINE_ERROR(status_value)));
+	    e = asprintf (&buf, "%s %s",
+			  calling_error(GSS_CALLING_ERROR(status_value)),
+			  routine_error(GSS_ROUTINE_ERROR(status_value)));
     } else if (status_type == GSS_C_MECH_CODE) {
 	const char *buf2 = krb5_get_error_message(context, status_value);
 	if (buf2) {
 	    buf = strdup(buf2);
 	    krb5_free_error_message(context, buf2);
 	} else {
-	    asprintf(&buf, "unknown mech error-code %u",
-		     (unsigned)status_value);
+	    e = asprintf(&buf, "unknown mech error-code %u",
+			 (unsigned)status_value);
 	}
     } else {
 	*minor_status = EINVAL;
 	return GSS_S_BAD_STATUS;
     }
 
-    if (buf == NULL) {
+    if (e < 0 || buf == NULL) {
 	*minor_status = ENOMEM;
 	return GSS_S_FAILURE;
     }
diff --git a/lib/gssapi/mech/gss_display_status.c b/lib/gssapi/mech/gss_display_status.c
index 60c5b8f52..89a05a870 100644
--- a/lib/gssapi/mech/gss_display_status.c
+++ b/lib/gssapi/mech/gss_display_status.c
@@ -160,17 +160,18 @@ gss_display_status(OM_uint32 *minor_status,
 	*minor_status = 0;
 	switch (status_type) {
 	case GSS_C_GSS_CODE: {
-		char *buf;
+	    	char *buf = NULL;
+		int e;
 
 		if (GSS_SUPPLEMENTARY_INFO(status_value))
-		    asprintf(&buf, "%s", supplementary_error(
+		    e = asprintf(&buf, "%s", supplementary_error(
 		        GSS_SUPPLEMENTARY_INFO(status_value)));
 		else
-		    asprintf (&buf, "%s %s",
+		    e = asprintf (&buf, "%s %s",
 		        calling_error(GSS_CALLING_ERROR(status_value)),
 			routine_error(GSS_ROUTINE_ERROR(status_value)));
 
-		if (buf == NULL)
+		if (e < 0 || buf == NULL)
 		    break;
 
 		status_string->length = strlen(buf);
@@ -181,21 +182,22 @@ gss_display_status(OM_uint32 *minor_status,
 	case GSS_C_MECH_CODE: {
 		OM_uint32 maj_junk, min_junk;
 		gss_buffer_desc oid;
-		char *buf;
+		char *buf = NULL;
+		int e;
 
 		maj_junk = gss_oid_to_str(&min_junk, mech_type, &oid);
 		if (maj_junk != GSS_S_COMPLETE) {
 		    oid.value = rk_UNCONST("unknown");
 		    oid.length = 7;
 		}
-
-		asprintf (&buf, "unknown mech-code %lu for mech %.*s",
+		
+		e = asprintf (&buf, "unknown mech-code %lu for mech %.*s",
 			  (unsigned long)status_value,
 			  (int)oid.length, (char *)oid.value);
 		if (maj_junk == GSS_S_COMPLETE)
 		    gss_release_buffer(&min_junk, &oid);
 
-		if (buf == NULL)
+		if (e < 0 || buf == NULL)
 		    break;
 
 		status_string->length = strlen(buf);
diff --git a/lib/gssapi/mech/gss_krb5.c b/lib/gssapi/mech/gss_krb5.c
index 1611d91d0..6042d1ea7 100644
--- a/lib/gssapi/mech/gss_krb5.c
+++ b/lib/gssapi/mech/gss_krb5.c
@@ -42,7 +42,7 @@ gss_krb5_copy_ccache(OM_uint32 *minor_status,
     krb5_error_code kret;
     krb5_ccache id;
     OM_uint32 ret;
-    char *str;
+    char *str = NULL;
 
     ret = gss_inquire_cred_by_oid(minor_status,
 				  cred,
@@ -67,7 +67,7 @@ gss_krb5_copy_ccache(OM_uint32 *minor_status,
     kret = asprintf(&str, "%.*s", (int)data_set->elements[0].length,
 		    (char *)data_set->elements[0].value);
     gss_release_buffer_set(minor_status, &data_set);
-    if (kret == -1) {
+    if (kret < 0 || str == NULL) {
 	*minor_status = ENOMEM;
 	return GSS_S_FAILURE;
     }
diff --git a/lib/gssapi/ntlm/display_name.c b/lib/gssapi/ntlm/display_name.c
index 22d988743..0b242f7f5 100644
--- a/lib/gssapi/ntlm/display_name.c
+++ b/lib/gssapi/ntlm/display_name.c
@@ -47,7 +47,7 @@ OM_uint32 _gss_ntlm_display_name
 
     if (output_name_buffer) {
 	ntlm_name n = (ntlm_name)input_name;
-	char *str;
+	char *str = NULL;
 	int len;
 	
 	output_name_buffer->length = 0;
@@ -59,7 +59,7 @@ OM_uint32 _gss_ntlm_display_name
 	}
 
 	len = asprintf(&str, "%s@%s", n->user, n->domain);
-	if (str == NULL) {
+	if (len < 0 || str == NULL) {
 	    *minor_status = ENOMEM;
 	    return GSS_S_FAILURE;
 	}
diff --git a/lib/gssapi/spnego/accept_sec_context.c b/lib/gssapi/spnego/accept_sec_context.c
index ab8a4d1aa..7c9d4c517 100644
--- a/lib/gssapi/spnego/accept_sec_context.c
+++ b/lib/gssapi/spnego/accept_sec_context.c
@@ -372,7 +372,11 @@ select_mech(OM_uint32 *minor_status, MechType *mechType, int verify_p,
 		*minor_status = errno;
 		return GSS_S_FAILURE;
 	    }
-	    asprintf(&str, "host@%s", hostname);
+	    i = asprintf(&str, "host@%s", hostname);
+	    if (i < 0 || str == NULL) {
+		*minor_status = ENOMEM;
+		return GSS_S_FAILURE;
+	    }
 	    host = str;
 	}
 
diff --git a/lib/gssapi/test_common.c b/lib/gssapi/test_common.c
index dc47e03e8..b2f9ff805 100644
--- a/lib/gssapi/test_common.c
+++ b/lib/gssapi/test_common.c
@@ -56,13 +56,14 @@ gssapi_err(OM_uint32 maj_stat, OM_uint32 min_stat, gss_OID mech)
 	disp_maj_stat = gss_display_status(&disp_min_stat, min_stat,
 					   GSS_C_MECH_CODE,
 					   mech, &msg_ctx, &min_error_message);
-	asprintf(&ret, "gss-code: %lu %.*s -- mech-code: %lu %.*s",
-		 (unsigned long)maj_stat,
-		 (int)maj_error_message.length,
-		 (char *)maj_error_message.value,
-		 (unsigned long)min_stat,
-		 (int)min_error_message.length,
-		 (char *)min_error_message.value);
+	if (asprintf(&ret, "gss-code: %lu %.*s -- mech-code: %lu %.*s",
+		     (unsigned long)maj_stat,
+		     (int)maj_error_message.length,
+		     (char *)maj_error_message.value,
+		     (unsigned long)min_stat,
+		     (int)min_error_message.length,
+		     (char *)min_error_message.value) < 0 || ret == NULL)
+	    errx(1, "malloc");
 
 	gss_release_buffer(&disp_min_stat, &maj_error_message);
 	gss_release_buffer(&disp_min_stat, &min_error_message);
diff --git a/lib/gssapi/test_names.c b/lib/gssapi/test_names.c
index a8c4a6de8..8649b8822 100644
--- a/lib/gssapi/test_names.c
+++ b/lib/gssapi/test_names.c
@@ -129,8 +129,9 @@ main(int argc, char **argv)
      * test import/export
      */
 
+    str = NULL;
     len = asprintf(&str, "ftp@freeze-arrow.mit.edu");
-    if (len == -1)
+    if (len < 0 || str == NULL)
 	errx(1, "asprintf");
 
     name_buffer.value = str;
@@ -183,8 +184,9 @@ main(int argc, char **argv)
      * Dovecot SASL lib does this.
      */
 
+    str = NULL;
     len = asprintf(&str, "lha");
-    if (len == -1)
+    if (len < 0 || str == NULL)
 	errx(1, "asprintf");
 
     name_buffer.value = str;