diff --git a/lib/krb5/krbhst.c b/lib/krb5/krbhst.c
index f1019e2a9..0b77b4a9c 100644
--- a/lib/krb5/krbhst.c
+++ b/lib/krb5/krbhst.c
@@ -568,6 +568,7 @@ fallback_get_hosts(krb5_context context, struct krb5_krbhst_data *kd,
 			   "Realm %s needs immediate attention "
 			   "see https://icann.org/namecollision",
 			   kd->realm);
+                free(host);
 		freeaddrinfo(ai);
 		return KRB5_KDC_UNREACH;
 	    }
diff --git a/lib/krb5/principal.c b/lib/krb5/principal.c
index be827578d..9cd2dd9f2 100644
--- a/lib/krb5/principal.c
+++ b/lib/krb5/principal.c
@@ -1855,7 +1855,7 @@ apply_name_canon_rule(krb5_context context, krb5_name_canon_rule rules,
                       krb5_name_canon_rule_options *rule_opts)
 {
     krb5_name_canon_rule rule = &rules[rule_idx];
-    krb5_error_code ret;
+    krb5_error_code ret = 0;
     unsigned int ndots = 0;
     krb5_principal nss = NULL;
     const char *sname = NULL;
@@ -1900,17 +1900,17 @@ apply_name_canon_rule(krb5_context context, krb5_name_canon_rule rules,
             ndots++;
     }
     if (rule->mindots > 0 && ndots < rule->mindots)
-            return 0;
+        goto out;
     if (ndots > rule->maxdots)
-            return 0;
+        goto out;
 
     if (rule->match_domain != NULL &&
         !is_domain_suffix(orig_hostname, rule->match_domain))
-        return 0;
+        goto out;
 
     if (rule->match_realm != NULL &&
         strcmp(rule->match_realm, in_princ->realm) != 0)
-          return 0;
+        goto out;
 
     new_realm = rule->realm;
     switch (rule->type) {