92 files changed, 421 insertions, 201 deletions

diff --git a/.mailmap b/.mailmap
index e15a72268..2ca867b4e 100644
--- a/.mailmap
+++ b/.mailmap
@@ -14,14 +14,15 @@ Jeffrey Burdges <burdges@gnunet.org>
 Martin Schanzenbach <martin.schanzenbach@aisec.fraunhofer.de> Schanzenbach, Martin <martin.schanzenbach@aisec.fraunhofer.de>
 Martin Schanzenbach <martin.schanzenbach@aisec.fraunhofer.de> Schanzenbach, Martin <mschanzenbach@posteo.de>
 Martin Schanzenbach <martin.schanzenbach@aisec.fraunhofer.de> Martin Schanzenbach <mschanzenbach@posteo.de>
-nikita <tek.no.katze@gmail.com> ng0@n0.is <ng0@n0.is>
-nikita <tek.no.katze@gmail.com> ng0 <ng0@n0.is>
-nikita <tek.no.katze@gmail.com>
-nikita <tek.no.katze@gmail.com> ng0 <contact.ng0@cryptolab.net>
-nikita <tek.no.katze@gmail.com> ng0 <ng0@infotropique.org>
-nikita <tek.no.katze@gmail.com>  N. 'ng0' Gillmann <ngillmann@runbox.com>
-nikita <tek.no.katze@gmail.com> ng0 <ng0@we.make.ritual.n0.is>
-nikita <tek.no.katze@gmail.com>  Nils Gillmann <ng0@n0.is>
+nikita <nikita@n0.is>
+nikita <nikita@n0.is> nikita <tek.no.katze@gmail.com>
+nikita <nikita@n0.is> ng0@n0.is <ng0@n0.is>
+nikita <nikita@n0.is> ng0 <ng0@n0.is>
+nikita <nikita@n0.is> ng0 <contact.ng0@cryptolab.net>
+nikita <nikita@n0.is> ng0 <ng0@infotropique.org>
+nikita <nikita@n0.is>  N. 'ng0' Gillmann <ngillmann@runbox.com>
+nikita <nikita@n0.is> ng0 <ng0@we.make.ritual.n0.is>
+nikita <nikita@n0.is>  Nils Gillmann <ng0@n0.is>
 t3sserakt <t3ss@posteo.de>
 t3sserakt <t3ss@posteo.de> <t3sserakt@posteo.de>
 tg(x) <*@tg-x.net>
diff --git a/AUTHORS b/AUTHORS
index d44dc3920..061d51379 100644
--- a/AUTHORS
+++ b/AUTHORS
@@ -70,7 +70,7 @@ Marko Räihä
 Michael John Wensley <michael@wensley.org.uk>
 Milan Bouchet-Valat <nalimilan@club.fr>
 Nathan Evans <evans@net.in.tum.de>
-Nils Gillmann <ng0@n0.is> [ Documentation export to Texinfo ]
+nikita <nikita@n0.is> [ Documentation export to Texinfo ]
 Paul Ruth <ruth@cs.purdue.edu>
 Philipp Tölke <toelke@in.tum.de>, <pt@philipptoelke.de>
 Renaldo Ferreira <rf@cs.purdue.edu>
@@ -124,8 +124,8 @@ Nix:              viric, rahul
 OpenWrt/LEDE:     Daniel Golle <daniel@makrotopia.org>
 macOS:            Jussi Eloranta <eloranta@cc.jyu.fi>
 Gentoo:           Carlo von lynX <psyc://loupsycedyglgamf.onion/~lynX>
-                  N. Gillmann <ng0@n0.is>
-NetBSD pkgsrc:    N. Gillmann <ng0@n0.is>
+                  nikita <nikita@n0.is>
+NetBSD pkgsrc:    nikita <nikita@NetBSD.org>
 
 If you have contributed and are not listed here, please
 notify one of the maintainers in order to be added.
diff --git a/src/abd/gnunet-abd.c b/src/abd/gnunet-abd.c
index a5d32c3dd..eb3e29e23 100644
--- a/src/abd/gnunet-abd.c
+++ b/src/abd/gnunet-abd.c
@@ -1074,7 +1074,7 @@ main (int argc, char *const *argv)
                                        &run,
                                        NULL))
     ret = 1;
-  GNUNET_free ((void *) argv);
+  GNUNET_free_nz ((void *) argv);
   return ret;
 }
 
diff --git a/src/arm/gnunet-arm.c b/src/arm/gnunet-arm.c
index 3b4e770b0..ea3a012ab 100644
--- a/src/arm/gnunet-arm.c
+++ b/src/arm/gnunet-arm.c
@@ -1054,10 +1054,10 @@ main (int argc, char *const *argv)
          &run,
          NULL)))
   {
-    GNUNET_free ((void *) argv);
+    GNUNET_free_nz ((void *) argv);
     return ret;
   }
-  GNUNET_free ((void *) argv);
+  GNUNET_free_nz ((void *) argv);
   return lret;
 }
 
diff --git a/src/ats-tool/gnunet-ats.c b/src/ats-tool/gnunet-ats.c
index 16636e505..947ed7798 100644
--- a/src/ats-tool/gnunet-ats.c
+++ b/src/ats-tool/gnunet-ats.c
@@ -980,7 +980,7 @@ main (int argc, char *const *argv)
                             NULL);
   GNUNET_free_non_null (opt_pid_str);
   GNUNET_free_non_null (opt_type_str);
-  GNUNET_free ((void *) argv);
+  GNUNET_free_nz ((void *) argv);
 
   if (GNUNET_OK == res)
     return ret;
diff --git a/src/auction/gnunet-auction-create.c b/src/auction/gnunet-auction-create.c
index 79106d8e8..93947b89c 100644
--- a/src/auction/gnunet-auction-create.c
+++ b/src/auction/gnunet-auction-create.c
@@ -214,6 +214,6 @@ main (int argc, char *const *argv)
                              options,
                              &run,
                              NULL)) ? ret : 1;
-  GNUNET_free ((void *) argv);
+  GNUNET_free_nz ((void *) argv);
   return ret;
 }
diff --git a/src/auction/gnunet-auction-info.c b/src/auction/gnunet-auction-info.c
index f20565835..dded45ce6 100644
--- a/src/auction/gnunet-auction-info.c
+++ b/src/auction/gnunet-auction-info.c
@@ -78,7 +78,7 @@ main (int argc, char *const *argv)
                              options,
                              &run,
                              NULL)) ? ret : 1;
-  GNUNET_free ((void *) argv);
+  GNUNET_free_nz ((void *) argv);
   return ret;
 }
 
diff --git a/src/auction/gnunet-auction-join.c b/src/auction/gnunet-auction-join.c
index f20565835..dded45ce6 100644
--- a/src/auction/gnunet-auction-join.c
+++ b/src/auction/gnunet-auction-join.c
@@ -78,7 +78,7 @@ main (int argc, char *const *argv)
                              options,
                              &run,
                              NULL)) ? ret : 1;
-  GNUNET_free ((void *) argv);
+  GNUNET_free_nz ((void *) argv);
   return ret;
 }
 
diff --git a/src/cadet/gnunet-cadet.c b/src/cadet/gnunet-cadet.c
index f3ccd9883..9b7538ae7 100644
--- a/src/cadet/gnunet-cadet.c
+++ b/src/cadet/gnunet-cadet.c
@@ -840,7 +840,7 @@ main (int argc, char *const *argv)
                             &run,
                             NULL);
 
-  GNUNET_free ((void *) argv);
+  GNUNET_free_nz ((void *) argv);
 
   if (GNUNET_OK == res)
     return 0;
diff --git a/src/conversation/gnunet-conversation-test.c b/src/conversation/gnunet-conversation-test.c
index 2e6772d92..9f8e54033 100644
--- a/src/conversation/gnunet-conversation-test.c
+++ b/src/conversation/gnunet-conversation-test.c
@@ -257,7 +257,7 @@ main (int argc,
                              options,
                              &run,
                              NULL)) ? ret : 1;
-  GNUNET_free ((void *) argv);
+  GNUNET_free_nz ((void *) argv);
   return ret;
 }
 
diff --git a/src/conversation/gnunet-conversation.c b/src/conversation/gnunet-conversation.c
index 6c0a6e42f..b908cd82c 100644
--- a/src/conversation/gnunet-conversation.c
+++ b/src/conversation/gnunet-conversation.c
@@ -1219,7 +1219,7 @@ main (int argc, char *const *argv)
                         options,
                         &run,
                         NULL);
-  GNUNET_free ((void *) argv);
+  GNUNET_free_nz ((void *) argv);
   if (NULL != cfg)
   {
     GNUNET_CONFIGURATION_destroy (cfg);
diff --git a/src/core/gnunet-core.c b/src/core/gnunet-core.c
index 90777a7a8..d90c8e1f5 100644
--- a/src/core/gnunet-core.c
+++ b/src/core/gnunet-core.c
@@ -198,7 +198,7 @@ main (int argc, char *const *argv)
                             &run,
                             NULL);
 
-  GNUNET_free ((void *) argv);
+  GNUNET_free_nz ((void *) argv);
   if (GNUNET_OK == res)
     return 0;
   return 1;
diff --git a/src/curl/curl.c b/src/curl/curl.c
index da486ecc1..72bb17789 100644
--- a/src/curl/curl.c
+++ b/src/curl/curl.c
@@ -526,6 +526,40 @@ GNUNET_CURL_job_cancel (struct GNUNET_CURL_Job *job)
 
 
 /**
+ * Test if the given content type @a ct is JSON
+ *
+ * @param ct a content type, i.e. "application/json; charset=UTF-8"
+ * @return true if @a ct denotes JSON
+ */
+static bool
+is_json (const char *ct)
+{
+  const char *semi;
+
+  /* check for "application/json" exact match */
+  if (0 == strcasecmp (ct,
+                       "application/json"))
+    return true;
+  /* check for "application/json;[ANYTHING]" */
+  semi = strchr (ct,
+                 ';');
+  /* also allow "application/json [ANYTHING]" (note the space!) */
+  if (NULL == semi)
+    semi = strchr (ct,
+                   ' ');
+  if (NULL == semi)
+    return false; /* no delimiter we accept, forget it */
+  if (semi - ct != strlen ("application/json"))
+    return false; /* delimiter past desired length, forget it */
+  if (0 == strncasecmp (ct,
+                        "application/json",
+                        strlen ("application/json")))
+    return true; /* OK */
+  return false;
+}
+
+
+/**
  * Obtain information about the final result about the
  * HTTP download. If the download was successful, parses
  * the JSON in the @a db and returns it. Also returns
@@ -562,8 +596,7 @@ GNUNET_CURL_download_get_result_ (struct GNUNET_CURL_DownloadBuffer *db,
                           CURLINFO_CONTENT_TYPE,
                           &ct)) ||
       (NULL == ct) ||
-      (0 != strcasecmp (ct,
-                        "application/json")))
+      (! is_json (ct)))
   {
     /* No content type or explicitly not JSON, refuse to parse
        (but keep response code) */
diff --git a/src/datastore/gnunet-datastore.c b/src/datastore/gnunet-datastore.c
index 54d087bc4..5901cce54 100644
--- a/src/datastore/gnunet-datastore.c
+++ b/src/datastore/gnunet-datastore.c
@@ -500,7 +500,7 @@ main (int argc, char *const *argv)
                           &run,
                           NULL))
     ret = 1;
-  GNUNET_free ((void *) argv);
+  GNUNET_free_nz ((void *) argv);
   return ret;
 }
 
diff --git a/src/dns/gnunet-dns-monitor.c b/src/dns/gnunet-dns-monitor.c
index 7be792fc5..f6c0d0660 100644
--- a/src/dns/gnunet-dns-monitor.c
+++ b/src/dns/gnunet-dns-monitor.c
@@ -387,7 +387,7 @@ main (int argc, char *const *argv)
                              gettext_noop
                                ("Monitor DNS queries."), options,
                              &run, NULL)) ? ret : 1;
-  GNUNET_free ((void *) argv);
+  GNUNET_free_nz ((void *) argv);
   return ret;
 }
 
diff --git a/src/dns/gnunet-dns-redirector.c b/src/dns/gnunet-dns-redirector.c
index f7051f70b..606864c8a 100644
--- a/src/dns/gnunet-dns-redirector.c
+++ b/src/dns/gnunet-dns-redirector.c
@@ -260,7 +260,7 @@ main (int argc, char *const *argv)
                                ("Change DNS replies to point elsewhere."),
                              options,
                              &run, NULL)) ? ret : 1;
-  GNUNET_free ((void *) argv);
+  GNUNET_free_nz ((void *) argv);
   return ret;
 }
 
diff --git a/src/fs/gnunet-auto-share.c b/src/fs/gnunet-auto-share.c
index 53c64ab04..13bc908e8 100644
--- a/src/fs/gnunet-auto-share.c
+++ b/src/fs/gnunet-auto-share.c
@@ -775,7 +775,7 @@ main (int argc, char *const *argv)
   sigpipe = NULL;
   GNUNET_free_non_null (cfg_filename);
   cfg_filename = NULL;
-  GNUNET_free ((void *) argv);
+  GNUNET_free_nz ((void *) argv);
   return ok;
 }
 
diff --git a/src/fs/gnunet-directory.c b/src/fs/gnunet-directory.c
index 58950bceb..10a09f73b 100644
--- a/src/fs/gnunet-directory.c
+++ b/src/fs/gnunet-directory.c
@@ -203,7 +203,7 @@ main (int argc, char *const *argv)
                              NULL))
         ? ret
         : 1;
-  GNUNET_free ((void *) argv);
+  GNUNET_free_nz ((void *) argv);
   return ret;
 }
 
diff --git a/src/fs/gnunet-download.c b/src/fs/gnunet-download.c
index 63bb02958..eebf8e993 100644
--- a/src/fs/gnunet-download.c
+++ b/src/fs/gnunet-download.c
@@ -376,7 +376,7 @@ main (int argc, char *const *argv)
        NULL))
     ? ret
     : 1;
-  GNUNET_free ((void *) argv);
+  GNUNET_free_nz ((void *) argv);
   return ret;
 }
 
diff --git a/src/fs/gnunet-fs-profiler.c b/src/fs/gnunet-fs-profiler.c
index fe86cf21f..62da46834 100644
--- a/src/fs/gnunet-fs-profiler.c
+++ b/src/fs/gnunet-fs-profiler.c
@@ -237,7 +237,7 @@ main (int argc, char *const *argv)
                                "run a testbed to measure file-sharing performance"),
                              options, &run,
                              NULL)) ? ret : 1;
-  GNUNET_free ((void *) argv);
+  GNUNET_free_nz ((void *) argv);
   return ret;
 }
 
diff --git a/src/fs/gnunet-fs.c b/src/fs/gnunet-fs.c
index 35d410d37..70a0034a0 100644
--- a/src/fs/gnunet-fs.c
+++ b/src/fs/gnunet-fs.c
@@ -144,7 +144,7 @@ main (int argc, char *const *argv)
                              NULL))
         ? ret
         : 1;
-  GNUNET_free ((void *) argv);
+  GNUNET_free_nz ((void *) argv);
   return ret;
 }
 
diff --git a/src/fs/gnunet-publish.c b/src/fs/gnunet-publish.c
index ac310b785..b10e6163c 100644
--- a/src/fs/gnunet-publish.c
+++ b/src/fs/gnunet-publish.c
@@ -992,7 +992,7 @@ main (int argc, char *const *argv)
                          NULL))
     ? ret
     : 1;
-  GNUNET_free ((void *) argv);
+  GNUNET_free_nz ((void *) argv);
   return ret;
 }
 
diff --git a/src/fs/gnunet-search.c b/src/fs/gnunet-search.c
index e0b9a31fd..098633379 100644
--- a/src/fs/gnunet-search.c
+++ b/src/fs/gnunet-search.c
@@ -371,7 +371,7 @@ main (int argc, char *const *argv)
                          NULL))
     ? ret
     : 1;
-  GNUNET_free ((void *) argv);
+  GNUNET_free_nz ((void *) argv);
   return ret;
 }
 
diff --git a/src/fs/gnunet-unindex.c b/src/fs/gnunet-unindex.c
index bf32de812..afc547127 100644
--- a/src/fs/gnunet-unindex.c
+++ b/src/fs/gnunet-unindex.c
@@ -197,7 +197,7 @@ main (int argc, char *const *argv)
            NULL))
         ? ret
         : 1;
-  GNUNET_free ((void *) argv);
+  GNUNET_free_nz ((void *) argv);
   return ret;
 }
 
diff --git a/src/gns/gnunet-bcd.c b/src/gns/gnunet-bcd.c
index 6ceff4a9a..f71f477ef 100644
--- a/src/gns/gnunet-bcd.c
+++ b/src/gns/gnunet-bcd.c
@@ -525,7 +525,7 @@ main (int argc, char *const *argv)
                              NULL))
         ? 0
         : 1;
-  GNUNET_free ((void *) argv);
+  GNUNET_free_nz ((void *) argv);
   return ret;
 }
 
diff --git a/src/gns/gnunet-dns2gns.c b/src/gns/gnunet-dns2gns.c
index 8ec1f1cdb..eb9996b36 100644
--- a/src/gns/gnunet-dns2gns.c
+++ b/src/gns/gnunet-dns2gns.c
@@ -775,7 +775,7 @@ main (int argc,
                          _ ("GNUnet DNS-to-GNS proxy (a DNS server)"),
                          options,
                          &run, NULL)) ? 0 : 1;
-  GNUNET_free ((void *) argv);
+  GNUNET_free_nz ((void *) argv);
   return ret;
 }
 
diff --git a/src/gns/gnunet-gns-benchmark.c b/src/gns/gnunet-gns-benchmark.c
index 0dcff7566..b36a83f21 100644
--- a/src/gns/gnunet-gns-benchmark.c
+++ b/src/gns/gnunet-gns-benchmark.c
@@ -610,7 +610,7 @@ main (int argc,
                           &run,
                           NULL))
     ret = 1;
-  GNUNET_free ((void *) argv);
+  GNUNET_free_nz ((void *) argv);
   return ret;
 }
 
diff --git a/src/gns/gnunet-gns-import.c b/src/gns/gnunet-gns-import.c
index 0c104ee0d..2c7c56411 100644
--- a/src/gns/gnunet-gns-import.c
+++ b/src/gns/gnunet-gns-import.c
@@ -486,7 +486,7 @@ main (int argc, char *const *argv)
                             "This program will import some GNS authorities into your GNS namestore."),
                           options,
                           &run, NULL);
-  GNUNET_free ((void *) argv);
+  GNUNET_free_nz ((void *) argv);
   return GNUNET_OK == r ? ret : 1;
 }
 
diff --git a/src/gns/gnunet-gns.c b/src/gns/gnunet-gns.c
index d52761ef8..eb1d4f23f 100644
--- a/src/gns/gnunet-gns.c
+++ b/src/gns/gnunet-gns.c
@@ -376,7 +376,7 @@ main (int argc, char *const *argv)
                             options,
                             &run,
                             NULL);
-  GNUNET_free ((void *) argv);
+  GNUNET_free_nz ((void *) argv);
   if (GNUNET_OK != ret)
     return 1;
   return global_ret;
diff --git a/src/gnsrecord/perf_gnsrecord_crypto.c b/src/gnsrecord/perf_gnsrecord_crypto.c
index b2614eb77..eb4633f75 100644
--- a/src/gnsrecord/perf_gnsrecord_crypto.c
+++ b/src/gnsrecord/perf_gnsrecord_crypto.c
@@ -107,7 +107,7 @@ run (void *cls,
              GNUNET_YES),
            ROUNDS);
   for (unsigned int i = 0; i < RECORDS; i++)
-    GNUNET_free ((void *) s_rd[i].data);
+    GNUNET_free_nz ((void *) s_rd[i].data);
   GNUNET_free (s_rd);
 }
 
diff --git a/src/gnsrecord/test_gnsrecord_serialization.c b/src/gnsrecord/test_gnsrecord_serialization.c
index 22d9f8396..d268cb7f3 100644
--- a/src/gnsrecord/test_gnsrecord_serialization.c
+++ b/src/gnsrecord/test_gnsrecord_serialization.c
@@ -132,7 +132,7 @@ run (void *cls,
 
   for (c = 0; c < rd_count; c++)
   {
-    GNUNET_free ((void *) src[c].data);
+    GNUNET_free_nz ((void *) src[c].data);
   }
 }
 
diff --git a/src/hostlist/gnunet-daemon-hostlist.c b/src/hostlist/gnunet-daemon-hostlist.c
index ca77545cd..704c796b4 100644
--- a/src/hostlist/gnunet-daemon-hostlist.c
+++ b/src/hostlist/gnunet-daemon-hostlist.c
@@ -409,7 +409,7 @@ main (int argc, char *const *argv)
                          _ ("GNUnet hostlist server and client"),
                          options,
                          &run, NULL)) ? 0 : 1;
-  GNUNET_free ((void *) argv);
+  GNUNET_free_nz ((void *) argv);
   return ret;
 }
 
diff --git a/src/identity/gnunet-identity.c b/src/identity/gnunet-identity.c
index 1350376d9..8445a0ee5 100644
--- a/src/identity/gnunet-identity.c
+++ b/src/identity/gnunet-identity.c
@@ -439,7 +439,7 @@ main (int argc, char *const *argv)
                             options,
                             &run,
                             NULL);
-  GNUNET_free ((void *) argv);
+  GNUNET_free_nz ((void *) argv);
 
   if (GNUNET_OK != res)
     return 3;
diff --git a/src/include/gnunet_common.h b/src/include/gnunet_common.h
index 78aeb3de7..033a68894 100644
--- a/src/include/gnunet_common.h
+++ b/src/include/gnunet_common.h
@@ -1209,7 +1209,10 @@ GNUNET_is_zero_ (const void *a,
  * @param n number of elements in the array
  * @param type name of the struct or union, i.e. pass 'struct Foo'.
  */
-#define GNUNET_new_array(n, type) (type *) GNUNET_malloc ((n) * sizeof(type))
+#define GNUNET_new_array(n, type) ({ \
+    GNUNET_assert (SIZE_MAX / sizeof (type) >= n); \
+    (type *) GNUNET_malloc ((n) * sizeof(type));   \
+  })
 
 /**
  * @ingroup memory
@@ -1284,23 +1287,23 @@ GNUNET_is_zero_ (const void *a,
  * @ingroup memory
  * Wrapper around free. Frees the memory referred to by ptr.
  * Note that it is generally better to free memory that was
- * allocated with #GNUNET_array_grow using #GNUNET_array_grow(mem, size, 0) instead of #GNUNET_free.
+ * allocated with #GNUNET_array_grow using #GNUNET_array_grow(mem, size, 0) instead of #GNUNET_free_nz.
  *
  * @param ptr location where to free the memory. ptr must have
  *     been returned by #GNUNET_strdup, #GNUNET_strndup, #GNUNET_malloc or #GNUNET_array_grow earlier.
  */
-#define GNUNET_free(ptr) GNUNET_xfree_ (ptr, __FILE__, __LINE__)
+#define GNUNET_free_nz(ptr) GNUNET_xfree_ (ptr, __FILE__, __LINE__)
 
 /**
  * @ingroup memory
  * Wrapper around free. Frees the memory referred to by ptr and sets ptr to NULL.
  * Note that it is generally better to free memory that was
- * allocated with #GNUNET_array_grow using #GNUNET_array_grow(mem, size, 0) instead of #GNUNET_freez.
+ * allocated with #GNUNET_array_grow using #GNUNET_array_grow(mem, size, 0) instead of #GNUNET_free.
  *
  * @param ptr location where to free the memory. ptr must have
  *     been returned by #GNUNET_strdup, #GNUNET_strndup, #GNUNET_malloc or #GNUNET_array_grow earlier.
  */
-#define GNUNET_freez(ptr) do { \
+#define GNUNET_free(ptr) do { \
     GNUNET_xfree_ (ptr, __FILE__, __LINE__); \
     ptr = NULL; \
 } while (0)
@@ -1389,22 +1392,58 @@ GNUNET_is_zero_ (const void *a,
 
 /**
  * @ingroup memory
- * Append an element to a list (growing the list by one).
+ * Append an element to an array (growing the array by one).
  *
- * @param arr base-pointer of the vector, may be NULL if size is 0;
+ * @param arr base-pointer of the vector, may be NULL if @a len is 0;
  *        will be updated to reflect the new address. The TYPE of
  *        arr is important since size is the number of elements and
  *        not the size in bytes
- * @param size the number of elements in the existing vector (number
+ * @param len the number of elements in the existing vector (number
  *        of elements to copy over), will be updated with the new
- *        array size
+ *        array length
  * @param element the element that will be appended to the array
  */
-#define GNUNET_array_append(arr, size, element) \
+#define GNUNET_array_append(arr, len, element) \
+  do                                            \
+  {                                             \
+    GNUNET_assert ((len) + 1 > (len)); \
+    GNUNET_array_grow (arr, len, len + 1);    \
+    (arr) [len - 1] = element;                  \
+  } while (0)
+
+
+/**
+ * @ingroup memory
+ * Append @a arr2 to @a arr1 (growing @a arr1
+ * as needed).  The @a arr2 array is left unchanged. Naturally
+ * this function performs a shallow copy. Both arrays must have
+ * the same type for their elements.
+ *
+ * @param arr1 base-pointer of the vector, may be NULL if @a len is 0;
+ *        will be updated to reflect the new address. The TYPE of
+ *        arr is important since size is the number of elements and
+ *        not the size in bytes
+ * @param len1 the number of elements in the existing vector (number
+ *        of elements to copy over), will be updated with the new
+ *        array size
+ * @param arr2 base-pointer a second array to concatenate, may be NULL if @a len2 is 0;
+ *        will be updated to reflect the new address. The TYPE of
+ *        arr is important since size is the number of elements and
+ *        not the size in bytes
+ * @param len the number of elements in the existing vector (number
+ *        of elements to copy over), will be updated with the new
+ *        array size
+
+ */
+#define GNUNET_array_concatenate(arr1, len1, arr2, len2)   \
   do                                            \
   {                                             \
-    GNUNET_array_grow (arr, size, size + 1);    \
-    (arr) [size - 1] = element;                  \
+    const typeof (*arr2) * _a1 = (arr1);  \
+    const typeof (*arr1) * _a2 = (arr2);  \
+    GNUNET_assert ((len1) + (len2) >= (len1));                    \
+    GNUNET_assert (SIZE_MAX / sizeof (*_a1) >= ((len1) + (len2))); \
+    GNUNET_array_grow (arr1, len1, (len1) + (len2));            \
+    memcpy (&(arr1) [(len1) - (len2)], _a2, (len2) * sizeof (*arr1));    \
   } while (0)
 
 /**
diff --git a/src/include/gnunet_json_lib.h b/src/include/gnunet_json_lib.h
index 82b8502e0..27996f18d 100644
--- a/src/include/gnunet_json_lib.h
+++ b/src/include/gnunet_json_lib.h
@@ -219,13 +219,25 @@ GNUNET_JSON_spec_json (const char *name, json_t **jsonp);
 
 
 /**
+ * boolean.
+ *
+ * @param name name of the JSON field
+ * @param[out] b where to store the boolean found under @a name
+ */
+struct GNUNET_JSON_Specification
+GNUNET_JSON_spec_bool (const char *name,
+                       bool *b);
+
+
+/**
  * 8-bit integer.
  *
  * @param name name of the JSON field
  * @param[out] u8 where to store the integer found under @a name
  */
 struct GNUNET_JSON_Specification
-GNUNET_JSON_spec_uint8 (const char *name, uint8_t *u8);
+GNUNET_JSON_spec_uint8 (const char *name,
+                        uint8_t *u8);
 
 
 /**
@@ -235,7 +247,8 @@ GNUNET_JSON_spec_uint8 (const char *name, uint8_t *u8);
  * @param[out] u16 where to store the integer found under @a name
  */
 struct GNUNET_JSON_Specification
-GNUNET_JSON_spec_uint16 (const char *name, uint16_t *u16);
+GNUNET_JSON_spec_uint16 (const char *name,
+                         uint16_t *u16);
 
 
 /**
@@ -245,7 +258,8 @@ GNUNET_JSON_spec_uint16 (const char *name, uint16_t *u16);
  * @param[out] u32 where to store the integer found under @a name
  */
 struct GNUNET_JSON_Specification
-GNUNET_JSON_spec_uint32 (const char *name, uint32_t *u32);
+GNUNET_JSON_spec_uint32 (const char *name,
+                         uint32_t *u32);
 
 
 /**
@@ -255,7 +269,19 @@ GNUNET_JSON_spec_uint32 (const char *name, uint32_t *u32);
  * @param[out] u64 where to store the integer found under @a name
  */
 struct GNUNET_JSON_Specification
-GNUNET_JSON_spec_uint64 (const char *name, uint64_t *u64);
+GNUNET_JSON_spec_uint64 (const char *name,
+                         uint64_t *u64);
+
+
+/**
+ * 64-bit signed integer.
+ *
+ * @param name name of the JSON field
+ * @param[out] i64 where to store the integer found under @a name
+ */
+struct GNUNET_JSON_Specification
+GNUNET_JSON_spec_int64 (const char *name,
+                        int64_t *i64);
 
 
 /**
diff --git a/src/json/Makefile.am b/src/json/Makefile.am
index 5968a3596..9cd80851c 100644
--- a/src/json/Makefile.am
+++ b/src/json/Makefile.am
@@ -37,6 +37,7 @@ TESTS = \
 
 test_json_SOURCES = \
   test_json.c
+test_json_CFLAGS = $(MHD_CFLAGS) $(AM_CFLAGS)
 test_json_LDADD = \
   libgnunetjson.la \
   $(top_builddir)/src/util/libgnunetutil.la \
diff --git a/src/json/json_gnsrecord.c b/src/json/json_gnsrecord.c
index bfbdd96ee..37f0c03da 100644
--- a/src/json/json_gnsrecord.c
+++ b/src/json/json_gnsrecord.c
@@ -50,10 +50,10 @@ cleanup_recordinfo (struct GnsRecordInfo *gnsrecord_info)
 {
   if (NULL != *(gnsrecord_info->rd))
   {
-    for (int i = 0; i < *(gnsrecord_info->rd_count); i++)
+    for (unsigned int i = 0; i < *(gnsrecord_info->rd_count); i++)
     {
       if (NULL != (*(gnsrecord_info->rd))[i].data)
-        GNUNET_free ((char *) (*(gnsrecord_info->rd))[i].data);
+        GNUNET_free_nz ((char *) (*(gnsrecord_info->rd))[i].data);
     }
     GNUNET_free (*(gnsrecord_info->rd));
     *(gnsrecord_info->rd) = NULL;
diff --git a/src/json/json_helper.c b/src/json/json_helper.c
index a405b8c3b..02bd6bfab 100644
--- a/src/json/json_helper.c
+++ b/src/json/json_helper.c
@@ -327,6 +327,60 @@ GNUNET_JSON_spec_json (const char *name,
 
 
 /**
+ * Parse given JSON object to a bool.
+ *
+ * @param cls closure, NULL
+ * @param root the json object representing data
+ * @param[out] spec where to write the data
+ * @return #GNUNET_OK upon successful parsing; #GNUNET_SYSERR upon error
+ */
+static int
+parse_bool (void *cls,
+            json_t *root,
+            struct GNUNET_JSON_Specification *spec)
+{
+  bool *b = spec->ptr;
+
+  if (json_true () == root)
+  {
+    *b = true;
+    return GNUNET_OK;
+  }
+  if (json_false () == root)
+  {
+    *b = false;
+    return GNUNET_OK;
+  }
+  GNUNET_break_op (0);
+  return GNUNET_SYSERR;
+}
+
+
+/**
+ * boolean.
+ *
+ * @param name name of the JSON field
+ * @param[out] b where to store the boolean found under @a name
+ */
+struct GNUNET_JSON_Specification
+GNUNET_JSON_spec_bool (const char *name,
+                       bool *b)
+{
+  struct GNUNET_JSON_Specification ret = {
+    .parser = &parse_bool,
+    .cleaner = NULL,
+    .cls = NULL,
+    .field = name,
+    .ptr = b,
+    .ptr_size = sizeof(bool),
+    .size_ptr = NULL
+  };
+
+  return ret;
+}
+
+
+/**
  * Parse given JSON object to a uint8_t.
  *
  * @param cls closure, NULL
@@ -495,7 +549,7 @@ GNUNET_JSON_spec_uint32 (const char *name,
 
 
 /**
- * Parse given JSON object to a uint8_t.
+ * Parse given JSON object to a uint64_t.
  *
  * @param cls closure, NULL
  * @param root the json object representing data
@@ -545,6 +599,57 @@ GNUNET_JSON_spec_uint64 (const char *name,
 }
 
 
+/**
+ * Parse given JSON object to a int64_t.
+ *
+ * @param cls closure, NULL
+ * @param root the json object representing data
+ * @param[out] spec where to write the data
+ * @return #GNUNET_OK upon successful parsing; #GNUNET_SYSERR upon error
+ */
+static int
+parse_i64 (void *cls,
+           json_t *root,
+           struct GNUNET_JSON_Specification *spec)
+{
+  json_int_t val;
+  int64_t *up = spec->ptr;
+
+  if (! json_is_integer (root))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  val = json_integer_value (root);
+  *up = (int64_t) val;
+  return GNUNET_OK;
+}
+
+
+/**
+ * 64-bit signed integer.
+ *
+ * @param name name of the JSON field
+ * @param[out] i64 where to store the integer found under @a name
+ */
+struct GNUNET_JSON_Specification
+GNUNET_JSON_spec_int64 (const char *name,
+                        int64_t *i64)
+{
+  struct GNUNET_JSON_Specification ret = {
+    .parser = &parse_i64,
+    .cleaner = NULL,
+    .cls = NULL,
+    .field = name,
+    .ptr = i64,
+    .ptr_size = sizeof(int64_t),
+    .size_ptr = NULL
+  };
+
+  return ret;
+}
+
+
 /* ************ GNUnet-specific parser specifications ******************* */
 
 /**
diff --git a/src/json/test_json_mhd.c b/src/json/test_json_mhd.c
index 5ab1b63ca..642715f25 100644
--- a/src/json/test_json_mhd.c
+++ b/src/json/test_json_mhd.c
@@ -27,6 +27,7 @@
 #include "gnunet_util_lib.h"
 #include "gnunet_json_lib.h"
 #include "gnunet_curl_lib.h"
+#include "gnunet_mhd_compat.h"
 #include <zlib.h>
 
 #define MAX_SIZE 1024 * 1024
@@ -36,7 +37,7 @@ static json_t *bigj;
 static int global_ret;
 
 
-static int
+static MHD_RESULT
 access_handler_cb (void *cls,
                    struct MHD_Connection *connection,
                    const char *url,
diff --git a/src/namecache/gnunet-namecache.c b/src/namecache/gnunet-namecache.c
index 15a0c96ee..2e3c733e6 100644
--- a/src/namecache/gnunet-namecache.c
+++ b/src/namecache/gnunet-namecache.c
@@ -235,10 +235,10 @@ main (int argc, char *const *argv)
                                        &run,
                                        NULL))
   {
-    GNUNET_free ((void *) argv);
+    GNUNET_free_nz ((void *) argv);
     return 1;
   }
-  GNUNET_free ((void *) argv);
+  GNUNET_free_nz ((void *) argv);
   return ret;
 }
 
diff --git a/src/namecache/test_namecache_api_cache_block.c b/src/namecache/test_namecache_api_cache_block.c
index 9b150c9d9..12b72d93b 100644
--- a/src/namecache/test_namecache_api_cache_block.c
+++ b/src/namecache/test_namecache_api_cache_block.c
@@ -39,7 +39,7 @@ static struct GNUNET_NAMECACHE_Handle *nsh;
 
 static struct GNUNET_SCHEDULER_Task *endbadly_task;
 
-static struct GNUNET_CRYPTO_EcdsaPrivateKey *privkey;
+static struct GNUNET_CRYPTO_EcdsaPrivateKey privkey;
 
 static struct GNUNET_CRYPTO_EcdsaPublicKey pubkey;
 
@@ -56,11 +56,6 @@ cleanup ()
     GNUNET_NAMECACHE_disconnect (nsh);
     nsh = NULL;
   }
-  if (NULL != privkey)
-  {
-    GNUNET_free (privkey);
-    privkey = NULL;
-  }
   GNUNET_SCHEDULER_shutdown ();
 }
 
@@ -188,10 +183,12 @@ run (void *cls,
                    "N0UJMP015AFUNR2BTNM3FKPBLG38913BL8IDMCO2H0A1LIB81960.zkey");
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Using zonekey file `%s' \n",
               hostkey_file);
-  privkey = GNUNET_CRYPTO_ecdsa_key_create_from_file (hostkey_file);
+  GNUNET_assert (GNUNET_SYSERR !=
+                 GNUNET_CRYPTO_ecdsa_key_from_file (hostkey_file,
+                                                    GNUNET_YES,
+                                                    &privkey));
   GNUNET_free (hostkey_file);
-  GNUNET_assert (privkey != NULL);
-  GNUNET_CRYPTO_ecdsa_key_get_public (privkey, &pubkey);
+  GNUNET_CRYPTO_ecdsa_key_get_public (&privkey, &pubkey);
 
 
   rd.expiration_time = GNUNET_TIME_absolute_get ().abs_value_us + 10000000000;
@@ -200,7 +197,7 @@ run (void *cls,
   rd.data = GNUNET_malloc (TEST_RECORD_DATALEN);
   rd.flags = 0;
   memset ((char *) rd.data, 'a', TEST_RECORD_DATALEN);
-  block = GNUNET_GNSRECORD_block_create (privkey,
+  block = GNUNET_GNSRECORD_block_create (&privkey,
                                          GNUNET_TIME_UNIT_FOREVER_ABS,
                                          name, &rd, 1);
   if (NULL == block)
@@ -232,7 +229,7 @@ run (void *cls,
                 _ ("Namecache cannot cache no block\n"));
   }
   GNUNET_free (block);
-  GNUNET_free ((void *) rd.data);
+  GNUNET_free_nz ((void *) rd.data);
 }
 
 
diff --git a/src/namestore/gnunet-namestore-fcfsd.c b/src/namestore/gnunet-namestore-fcfsd.c
index 67fc5bdf4..34641d22e 100644
--- a/src/namestore/gnunet-namestore-fcfsd.c
+++ b/src/namestore/gnunet-namestore-fcfsd.c
@@ -1210,7 +1210,7 @@ main (int argc,
                            "GNU Name System First Come First Serve name registration service"),
                          options,
                          &run, NULL)) ? 0 : 1;
-  GNUNET_free ((void *) argv);
+  GNUNET_free_nz ((void *) argv);
   GNUNET_CRYPTO_ecdsa_key_clear (&fcfs_zone_pkey);
   return ret;
 }
diff --git a/src/namestore/gnunet-namestore.c b/src/namestore/gnunet-namestore.c
index 25dfda59b..508566a49 100644
--- a/src/namestore/gnunet-namestore.c
+++ b/src/namestore/gnunet-namestore.c
@@ -1688,11 +1688,11 @@ main (int argc, char *const *argv)
                                   &run,
                                   NULL)))
   {
-    GNUNET_free ((void *) argv);
+    GNUNET_free_nz ((void *) argv);
     GNUNET_CRYPTO_ecdsa_key_clear (&zone_pkey);
     return lret;
   }
-  GNUNET_free ((void *) argv);
+  GNUNET_free_nz ((void *) argv);
   GNUNET_CRYPTO_ecdsa_key_clear (&zone_pkey);
   return ret;
 }
diff --git a/src/namestore/gnunet-zoneimport.c b/src/namestore/gnunet-zoneimport.c
index eca02bdc3..5b4e41475 100644
--- a/src/namestore/gnunet-zoneimport.c
+++ b/src/namestore/gnunet-zoneimport.c
@@ -1866,7 +1866,7 @@ main (int argc, char *const *argv)
                                               &run,
                                               NULL)))
     return ret;
-  GNUNET_free ((void *) argv);
+  GNUNET_free_nz ((void *) argv);
   fprintf (stderr,
            "Rejected %u names, had %u cached, did %u lookups, stored %u record sets\n"
            "Found %u records, %u lookups failed, %u/%u pending on shutdown\n",
diff --git a/src/namestore/plugin_rest_namestore.c b/src/namestore/plugin_rest_namestore.c
index d2a93a286..c0bf4b048 100644
--- a/src/namestore/plugin_rest_namestore.c
+++ b/src/namestore/plugin_rest_namestore.c
@@ -267,7 +267,7 @@ cleanup_handle (void *cls)
     for (int i = 0; i < handle->rd_count; i++)
     {
       if (NULL != handle->rd[i].data)
-        GNUNET_free ((void *) handle->rd[i].data);
+        GNUNET_free_nz ((void *) handle->rd[i].data);
     }
     GNUNET_free (handle->rd);
   }
diff --git a/src/namestore/test_namestore_api_lookup_private.c b/src/namestore/test_namestore_api_lookup_private.c
index 98fdb1b43..d0ad726cc 100644
--- a/src/namestore/test_namestore_api_lookup_private.c
+++ b/src/namestore/test_namestore_api_lookup_private.c
@@ -212,7 +212,7 @@ run (void *cls,
                 _ ("Namestore cannot store no block\n"));
   }
 
-  GNUNET_free ((void *) rd.data);
+  GNUNET_free_nz ((void *) rd.data);
 }
 
 
diff --git a/src/namestore/test_namestore_api_lookup_public.c b/src/namestore/test_namestore_api_lookup_public.c
index 83a5a78f6..039c7cbf6 100644
--- a/src/namestore/test_namestore_api_lookup_public.c
+++ b/src/namestore/test_namestore_api_lookup_public.c
@@ -221,7 +221,7 @@ run (void *cls,
                 _ ("Namestore cannot store no block\n"));
   }
 
-  GNUNET_free ((void *) rd.data);
+  GNUNET_free_nz ((void *) rd.data);
 }
 
 
diff --git a/src/namestore/test_namestore_api_lookup_shadow.c b/src/namestore/test_namestore_api_lookup_shadow.c
index 08c428731..d399d903a 100644
--- a/src/namestore/test_namestore_api_lookup_shadow.c
+++ b/src/namestore/test_namestore_api_lookup_shadow.c
@@ -254,7 +254,7 @@ run (void *cls,
     GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                 _ ("Namestore cannot store no block\n"));
   }
-  GNUNET_free ((void *) rd.data);
+  GNUNET_free_nz ((void *) rd.data);
 }
 
 
diff --git a/src/namestore/test_namestore_api_lookup_shadow_filter.c b/src/namestore/test_namestore_api_lookup_shadow_filter.c
index 634a6a3c4..40dbeb90f 100644
--- a/src/namestore/test_namestore_api_lookup_shadow_filter.c
+++ b/src/namestore/test_namestore_api_lookup_shadow_filter.c
@@ -336,8 +336,8 @@ run (void *cls,
                 _ ("Namestore cannot store no block\n"));
   }
 
-  GNUNET_free ((void *) records[0].data);
-  GNUNET_free ((void *) records[1].data);
+  GNUNET_free_nz ((void *) records[0].data);
+  GNUNET_free_nz ((void *) records[1].data);
 }
 
 
diff --git a/src/namestore/test_namestore_api_monitoring.c b/src/namestore/test_namestore_api_monitoring.c
index d26492517..cc00adf44 100644
--- a/src/namestore/test_namestore_api_monitoring.c
+++ b/src/namestore/test_namestore_api_monitoring.c
@@ -94,17 +94,17 @@ do_shutdown ()
 
   if (s_rd_1 != NULL)
   {
-    GNUNET_free ((void *) s_rd_1->data);
+    GNUNET_free_nz ((void *) s_rd_1->data);
     GNUNET_free (s_rd_1);
   }
   if (s_rd_2 != NULL)
   {
-    GNUNET_free ((void *) s_rd_2->data);
+    GNUNET_free_nz ((void *) s_rd_2->data);
     GNUNET_free (s_rd_2);
   }
   if (s_rd_3 != NULL)
   {
-    GNUNET_free ((void *) s_rd_3->data);
+    GNUNET_free_nz ((void *) s_rd_3->data);
     GNUNET_free (s_rd_3);
   }
 }
diff --git a/src/namestore/test_namestore_api_monitoring_existing.c b/src/namestore/test_namestore_api_monitoring_existing.c
index 040a63f91..728fcc25e 100644
--- a/src/namestore/test_namestore_api_monitoring_existing.c
+++ b/src/namestore/test_namestore_api_monitoring_existing.c
@@ -111,17 +111,17 @@ end (void *cls)
   }
   if (NULL != s_rd_1)
   {
-    GNUNET_free ((void *) s_rd_1->data);
+    GNUNET_free_nz ((void *) s_rd_1->data);
     GNUNET_free (s_rd_1);
   }
   if (NULL != s_rd_2)
   {
-    GNUNET_free ((void *) s_rd_2->data);
+    GNUNET_free_nz ((void *) s_rd_2->data);
     GNUNET_free (s_rd_2);
   }
   if (NULL != s_rd_3)
   {
-    GNUNET_free ((void *) s_rd_3->data);
+    GNUNET_free_nz ((void *) s_rd_3->data);
     GNUNET_free (s_rd_3);
   }
 }
diff --git a/src/namestore/test_namestore_api_remove.c b/src/namestore/test_namestore_api_remove.c
index 3f0c4c123..e575821e8 100644
--- a/src/namestore/test_namestore_api_remove.c
+++ b/src/namestore/test_namestore_api_remove.c
@@ -187,7 +187,7 @@ run (void *cls,
     GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                 _ ("Namestore cannot store no block\n"));
   }
-  GNUNET_free ((void *) rd.data);
+  GNUNET_free_nz ((void *) rd.data);
 }
 
 
diff --git a/src/namestore/test_namestore_api_store.c b/src/namestore/test_namestore_api_store.c
index ab211aeae..9223b56a3 100644
--- a/src/namestore/test_namestore_api_store.c
+++ b/src/namestore/test_namestore_api_store.c
@@ -138,7 +138,7 @@ run (void *cls,
     GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                 _ ("Namestore cannot store no block\n"));
   }
-  GNUNET_free ((void *) rd.data);
+  GNUNET_free_nz ((void *) rd.data);
 }
 
 
diff --git a/src/namestore/test_namestore_api_store_update.c b/src/namestore/test_namestore_api_store_update.c
index 65dbdbd8c..7a5a69a6c 100644
--- a/src/namestore/test_namestore_api_store_update.c
+++ b/src/namestore/test_namestore_api_store_update.c
@@ -274,7 +274,7 @@ run (void *cls,
     GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                 _ ("Namestore cannot store no block\n"));
   }
-  GNUNET_free ((void *) rd.data);
+  GNUNET_free_nz ((void *) rd.data);
 }
 
 
diff --git a/src/namestore/test_namestore_api_zone_iteration.c b/src/namestore/test_namestore_api_zone_iteration.c
index d69b7cc62..a363ee28d 100644
--- a/src/namestore/test_namestore_api_zone_iteration.c
+++ b/src/namestore/test_namestore_api_zone_iteration.c
@@ -37,9 +37,9 @@ static struct GNUNET_NAMESTORE_Handle *nsh;
 
 static struct GNUNET_SCHEDULER_Task *endbadly_task;
 
-static struct GNUNET_CRYPTO_EcdsaPrivateKey *privkey;
+static struct GNUNET_CRYPTO_EcdsaPrivateKey privkey;
 
-static struct GNUNET_CRYPTO_EcdsaPrivateKey *privkey2;
+static struct GNUNET_CRYPTO_EcdsaPrivateKey privkey2;
 
 static struct GNUNET_NAMESTORE_ZoneIterator *zi;
 
@@ -88,32 +88,22 @@ end (void *cls)
     GNUNET_SCHEDULER_cancel (endbadly_task);
     endbadly_task = NULL;
   }
-  if (NULL != privkey)
-  {
-    GNUNET_free (privkey);
-    privkey = NULL;
-  }
-  if (NULL != privkey2)
-  {
-    GNUNET_free (privkey2);
-    privkey2 = NULL;
-  }
   GNUNET_free_non_null (s_name_1);
   GNUNET_free_non_null (s_name_2);
   GNUNET_free_non_null (s_name_3);
   if (NULL != s_rd_1)
   {
-    GNUNET_free ((void *) s_rd_1->data);
+    GNUNET_free_nz ((void *) s_rd_1->data);
     GNUNET_free (s_rd_1);
   }
   if (NULL != s_rd_2)
   {
-    GNUNET_free ((void *) s_rd_2->data);
+    GNUNET_free_nz ((void *) s_rd_2->data);
     GNUNET_free (s_rd_2);
   }
   if (NULL != s_rd_3)
   {
-    GNUNET_free ((void *) s_rd_3->data);
+    GNUNET_free_nz ((void *) s_rd_3->data);
     GNUNET_free (s_rd_3);
   }
   if (NULL != nsh)
@@ -161,7 +151,7 @@ zone_proc (void *cls,
 
   GNUNET_assert (NULL != zone);
   if (0 == GNUNET_memcmp (zone,
-                          privkey))
+                          &privkey))
   {
     if (0 == strcmp (label, s_name_1))
     {
@@ -207,7 +197,7 @@ zone_proc (void *cls,
     }
   }
   else if (0 == GNUNET_memcmp (zone,
-                               privkey2))
+                               &privkey2))
   {
     if (0 == strcmp (label, s_name_3))
     {
@@ -382,9 +372,11 @@ empty_zone_end (void *cls)
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Using zonekey file `%s' \n",
               hostkey_file);
-  privkey = GNUNET_CRYPTO_ecdsa_key_create_from_file (hostkey_file);
+  GNUNET_assert (GNUNET_SYSERR !=
+                 GNUNET_CRYPTO_ecdsa_key_from_file (hostkey_file,
+                                                    GNUNET_YES,
+                                                    &privkey));
   GNUNET_free (hostkey_file);
-  GNUNET_assert (privkey != NULL);
 
   GNUNET_asprintf (&hostkey_file,
                    "zonefiles%s%s",
@@ -393,16 +385,18 @@ empty_zone_end (void *cls)
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Using zonekey file `%s' \n",
               hostkey_file);
-  privkey2 = GNUNET_CRYPTO_ecdsa_key_create_from_file (hostkey_file);
+  GNUNET_assert (GNUNET_SYSERR !=
+                 GNUNET_CRYPTO_ecdsa_key_from_file (hostkey_file,
+                                                    GNUNET_YES,
+                                                    &privkey2));
   GNUNET_free (hostkey_file);
-  GNUNET_assert (privkey2 != NULL);
 
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Created record 1\n");
 
   GNUNET_asprintf (&s_name_1, "dummy1");
   s_rd_1 = create_record (1);
   GNUNET_NAMESTORE_records_store (nsh,
-                                  privkey,
+                                  &privkey,
                                   s_name_1,
                                   1, s_rd_1,
                                   &put_cont,
@@ -412,7 +406,7 @@ empty_zone_end (void *cls)
   GNUNET_asprintf (&s_name_2, "dummy2");
   s_rd_2 = create_record (1);
   GNUNET_NAMESTORE_records_store (nsh,
-                                  privkey,
+                                  &privkey,
                                   s_name_2,
                                   1, s_rd_2,
                                   &put_cont,
@@ -423,7 +417,7 @@ empty_zone_end (void *cls)
   GNUNET_asprintf (&s_name_3, "dummy3");
   s_rd_3 = create_record (1);
   GNUNET_NAMESTORE_records_store (nsh,
-                                  privkey2,
+                                  &privkey2,
                                   s_name_3,
                                   1,
                                   s_rd_3,
diff --git a/src/namestore/test_namestore_api_zone_iteration_nick.c b/src/namestore/test_namestore_api_zone_iteration_nick.c
index f5ffe3899..b0c4c8211 100644
--- a/src/namestore/test_namestore_api_zone_iteration_nick.c
+++ b/src/namestore/test_namestore_api_zone_iteration_nick.c
@@ -87,17 +87,17 @@ end (void *cls)
 
   if (s_rd_1 != NULL)
   {
-    GNUNET_free ((void *) s_rd_1->data);
+    GNUNET_free_nz ((void *) s_rd_1->data);
     GNUNET_free (s_rd_1);
   }
   if (s_rd_2 != NULL)
   {
-    GNUNET_free ((void *) s_rd_2->data);
+    GNUNET_free_nz ((void *) s_rd_2->data);
     GNUNET_free (s_rd_2);
   }
   if (s_rd_3 != NULL)
   {
-    GNUNET_free ((void *) s_rd_3->data);
+    GNUNET_free_nz ((void *) s_rd_3->data);
     GNUNET_free (s_rd_3);
   }
 }
diff --git a/src/namestore/test_namestore_api_zone_iteration_specific_zone.c b/src/namestore/test_namestore_api_zone_iteration_specific_zone.c
index 97093cb71..0534da001 100644
--- a/src/namestore/test_namestore_api_zone_iteration_specific_zone.c
+++ b/src/namestore/test_namestore_api_zone_iteration_specific_zone.c
@@ -93,17 +93,17 @@ end (void *cls)
   GNUNET_free_non_null (s_name_3);
   if (s_rd_1 != NULL)
   {
-    GNUNET_free ((void *) s_rd_1->data);
+    GNUNET_free_nz ((void *) s_rd_1->data);
     GNUNET_free (s_rd_1);
   }
   if (s_rd_2 != NULL)
   {
-    GNUNET_free ((void *) s_rd_2->data);
+    GNUNET_free_nz ((void *) s_rd_2->data);
     GNUNET_free (s_rd_2);
   }
   if (s_rd_3 != NULL)
   {
-    GNUNET_free ((void *) s_rd_3->data);
+    GNUNET_free_nz ((void *) s_rd_3->data);
     GNUNET_free (s_rd_3);
   }
   if (nsh != NULL)
diff --git a/src/namestore/test_namestore_api_zone_iteration_stop.c b/src/namestore/test_namestore_api_zone_iteration_stop.c
index 81fb4de7e..b71a8789c 100644
--- a/src/namestore/test_namestore_api_zone_iteration_stop.c
+++ b/src/namestore/test_namestore_api_zone_iteration_stop.c
@@ -34,9 +34,9 @@
 
 static struct GNUNET_NAMESTORE_Handle *nsh;
 
-static struct GNUNET_CRYPTO_EcdsaPrivateKey *privkey;
+static struct GNUNET_CRYPTO_EcdsaPrivateKey privkey;
 
-static struct GNUNET_CRYPTO_EcdsaPrivateKey *privkey2;
+static struct GNUNET_CRYPTO_EcdsaPrivateKey privkey2;
 
 static struct GNUNET_NAMESTORE_ZoneIterator *zi;
 
@@ -80,29 +80,19 @@ end (void *cls)
   GNUNET_free_non_null (s_name_3);
   if (s_rd_1 != NULL)
   {
-    GNUNET_free ((void *) s_rd_1->data);
+    GNUNET_free_nz ((void *) s_rd_1->data);
     GNUNET_free (s_rd_1);
   }
   if (s_rd_2 != NULL)
   {
-    GNUNET_free ((void *) s_rd_2->data);
+    GNUNET_free_nz ((void *) s_rd_2->data);
     GNUNET_free (s_rd_2);
   }
   if (s_rd_3 != NULL)
   {
-    GNUNET_free ((void *) s_rd_3->data);
+    GNUNET_free_nz ((void *) s_rd_3->data);
     GNUNET_free (s_rd_3);
   }
-  if (privkey != NULL)
-  {
-    GNUNET_free (privkey);
-    privkey = NULL;
-  }
-  if (privkey2 != NULL)
-  {
-    GNUNET_free (privkey2);
-    privkey2 = NULL;
-  }
 }
 
 
@@ -130,7 +120,7 @@ zone_proc (void *cls,
   int failed = GNUNET_NO;
 
   GNUNET_assert (NULL != zone);
-  if (0 == GNUNET_memcmp (zone, privkey))
+  if (0 == GNUNET_memcmp (zone, &privkey))
   {
     if (0 == strcmp (label, s_name_1))
     {
@@ -175,7 +165,7 @@ zone_proc (void *cls,
       GNUNET_break (0);
     }
   }
-  else if (0 == GNUNET_memcmp (zone, privkey2))
+  else if (0 == GNUNET_memcmp (zone, &privkey2))
   {
     if (0 == strcmp (label, s_name_3))
     {
@@ -368,10 +358,11 @@ empty_zone_proc_end (void *cls)
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Using zonekey file `%s' \n",
               hostkey_file);
-  privkey = GNUNET_CRYPTO_ecdsa_key_create_from_file (hostkey_file);
+  GNUNET_assert (GNUNET_SYSERR
+                 != GNUNET_CRYPTO_ecdsa_key_from_file (hostkey_file,
+                                                       GNUNET_YES,
+                                                       &privkey));
   GNUNET_free (hostkey_file);
-  GNUNET_assert (privkey != NULL);
-
   GNUNET_asprintf (&hostkey_file,
                    "zonefiles%s%s",
                    DIR_SEPARATOR_STR,
@@ -379,17 +370,19 @@ empty_zone_proc_end (void *cls)
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Using zonekey file `%s'\n",
               hostkey_file);
-  privkey2 = GNUNET_CRYPTO_ecdsa_key_create_from_file (hostkey_file);
+  GNUNET_assert (GNUNET_SYSERR !=
+                 GNUNET_CRYPTO_ecdsa_key_from_file (hostkey_file,
+                                                    GNUNET_YES,
+                                                    &privkey2));
   GNUNET_free (hostkey_file);
-  GNUNET_assert (privkey2 != NULL);
-
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Created record 1\n");
 
   GNUNET_asprintf (&s_name_1,
                    "dummy1");
   s_rd_1 = create_record (1);
-  GNUNET_NAMESTORE_records_store (nsh, privkey, s_name_1,
+  GNUNET_NAMESTORE_records_store (nsh,
+                                  &privkey, s_name_1,
                                   1, s_rd_1, &put_cont, NULL);
 
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
@@ -398,7 +391,7 @@ empty_zone_proc_end (void *cls)
                    "dummy2");
   s_rd_2 = create_record (1);
   GNUNET_NAMESTORE_records_store (nsh,
-                                  privkey,
+                                  &privkey,
                                   s_name_2,
                                   1,
                                   s_rd_2,
@@ -411,7 +404,7 @@ empty_zone_proc_end (void *cls)
   GNUNET_asprintf (&s_name_3, "dummy3");
   s_rd_3 = create_record (1);
   GNUNET_NAMESTORE_records_store (nsh,
-                                  privkey2,
+                                  &privkey2,
                                   s_name_3,
                                   1,
                                   s_rd_3,
diff --git a/src/nat-auto/gnunet-nat-auto.c b/src/nat-auto/gnunet-nat-auto.c
index d40f4ef32..95a7ced9e 100644
--- a/src/nat-auto/gnunet-nat-auto.c
+++ b/src/nat-auto/gnunet-nat-auto.c
@@ -359,7 +359,7 @@ main (int argc, char *const argv[])
   {
     global_ret = 1;
   }
-  GNUNET_free ((void *) argv);
+  GNUNET_free_nz ((void *) argv);
   return global_ret;
 }
 
diff --git a/src/nat/gnunet-nat.c b/src/nat/gnunet-nat.c
index 857ce5093..5012d6455 100644
--- a/src/nat/gnunet-nat.c
+++ b/src/nat/gnunet-nat.c
@@ -468,7 +468,7 @@ main (int argc, char *const argv[])
   {
     global_ret = 1;
   }
-  GNUNET_free ((void *) argv);
+  GNUNET_free_nz ((void *) argv);
   return global_ret;
 }
 
diff --git a/src/peerinfo-tool/gnunet-peerinfo.c b/src/peerinfo-tool/gnunet-peerinfo.c
index 4d4c4de33..df6c169b5 100644
--- a/src/peerinfo-tool/gnunet-peerinfo.c
+++ b/src/peerinfo-tool/gnunet-peerinfo.c
@@ -855,7 +855,7 @@ main (int argc, char *const *argv)
                              NULL))
         ? 0
         : 1;
-  GNUNET_free ((void *) argv);
+  GNUNET_free_nz ((void *) argv);
   return ret;
 }
 
diff --git a/src/peerinfo-tool/plugin_rest_peerinfo.c b/src/peerinfo-tool/plugin_rest_peerinfo.c
index 14559a8cf..6e156569a 100644
--- a/src/peerinfo-tool/plugin_rest_peerinfo.c
+++ b/src/peerinfo-tool/plugin_rest_peerinfo.c
@@ -272,7 +272,7 @@ cleanup_handle (void *cls)
   if (NULL != handle->emsg)
     GNUNET_free (handle->emsg);
   if (NULL != handle->address)
-    GNUNET_free ((char *) handle->address);
+    GNUNET_free_nz ((char *) handle->address);
   if (NULL != handle->expiration_str)
     GNUNET_free (handle->expiration_str);
   if (NULL != handle->pubkey)
diff --git a/src/pt/gnunet-daemon-pt.c b/src/pt/gnunet-daemon-pt.c
index f8765818b..bcc913bd2 100644
--- a/src/pt/gnunet-daemon-pt.c
+++ b/src/pt/gnunet-daemon-pt.c
@@ -1317,7 +1317,7 @@ main (int argc,
                              NULL))
         ? 0
         : 1;
-  GNUNET_free ((void *) argv);
+  GNUNET_free_nz ((void *) argv);
   return ret;
 }
 
diff --git a/src/pt/test_gns_vpn.c b/src/pt/test_gns_vpn.c
index 9bf497b16..69afca789 100644
--- a/src/pt/test_gns_vpn.c
+++ b/src/pt/test_gns_vpn.c
@@ -45,6 +45,7 @@
 #include "gnunet_gnsrecord_lib.h"
 #include "gnunet_gns_service.h"
 #include "gnunet_testing_lib.h"
+#include "gnunet_mhd_compat.h"
 
 #define PORT 8080
 #define TEST_DOMAIN "www.gnu"
@@ -121,7 +122,7 @@ copy_buffer (void *ptr,
 }
 
 
-static int
+static MHD_RESULT
 mhd_ahc (void *cls,
          struct MHD_Connection *connection,
          const char *url,
@@ -611,7 +612,7 @@ identity_cb (void *cls,
                                        1, &rd,
                                        &commence_testing,
                                        NULL);
-  GNUNET_free ((void **) rd.data);
+  GNUNET_free_nz ((void **) rd.data);
   GNUNET_free (rd_string);
 }
 
diff --git a/src/pt/test_gnunet_vpn.c b/src/pt/test_gnunet_vpn.c
index 42fd52c38..cb9bb61fe 100644
--- a/src/pt/test_gnunet_vpn.c
+++ b/src/pt/test_gnunet_vpn.c
@@ -29,6 +29,7 @@
 #include <microhttpd.h>
 #include "gnunet_vpn_service.h"
 #include "gnunet_testing_lib.h"
+#include "gnunet_mhd_compat.h"
 
 #define PORT 48080
 
@@ -96,7 +97,7 @@ copy_buffer (void *ptr, size_t size, size_t nmemb, void *ctx)
 }
 
 
-static int
+static MHD_RESULT
 mhd_ahc (void *cls,
          struct MHD_Connection *connection,
          const char *url,
diff --git a/src/regex/gnunet-daemon-regexprofiler.c b/src/regex/gnunet-daemon-regexprofiler.c
index eda58fdd2..d94b5ae46 100644
--- a/src/regex/gnunet-daemon-regexprofiler.c
+++ b/src/regex/gnunet-daemon-regexprofiler.c
@@ -118,7 +118,7 @@ shutdown_task (void *cls)
   }
   if (NULL != reannounce_task)
   {
-    GNUNET_free (GNUNET_SCHEDULER_cancel (reannounce_task));
+    GNUNET_free_nz (GNUNET_SCHEDULER_cancel (reannounce_task));
     reannounce_task = NULL;
   }
   if (NULL != dht_handle)
diff --git a/src/revocation/gnunet-revocation.c b/src/revocation/gnunet-revocation.c
index 19fd5ab2c..8b7cf33c6 100644
--- a/src/revocation/gnunet-revocation.c
+++ b/src/revocation/gnunet-revocation.c
@@ -555,7 +555,7 @@ main (int argc, char *const *argv)
                                           NULL))
         ? ret
         : 1;
-  GNUNET_free ((void *) argv);
+  GNUNET_free_nz ((void *) argv);
   return ret;
 }
 
diff --git a/src/statistics/gnunet-statistics.c b/src/statistics/gnunet-statistics.c
index 47bdbf2c1..63afde877 100644
--- a/src/statistics/gnunet-statistics.c
+++ b/src/statistics/gnunet-statistics.c
@@ -881,7 +881,7 @@ main (int argc, char *const *argv)
                      num_nodes,
                      0);
   GNUNET_free_non_null (remote_host);
-  GNUNET_free ((void *) argv);
+  GNUNET_free_nz ((void *) argv);
   return ret;
 }
 
diff --git a/src/template/gnunet-template.c b/src/template/gnunet-template.c
index b33cbcc64..5e250bbdf 100644
--- a/src/template/gnunet-template.c
+++ b/src/template/gnunet-template.c
@@ -78,7 +78,7 @@ main (int argc, char *const *argv)
                                           NULL))
         ? ret
         : 1;
-  GNUNET_free ((void *) argv);
+  GNUNET_free_nz ((void *) argv);
   return ret;
 }
 
diff --git a/src/testbed/gnunet-daemon-latency-logger.c b/src/testbed/gnunet-daemon-latency-logger.c
index 0af718a63..c13750db7 100644
--- a/src/testbed/gnunet-daemon-latency-logger.c
+++ b/src/testbed/gnunet-daemon-latency-logger.c
@@ -317,6 +317,6 @@ main (int argc, char *const *argv)
                          _ (
                            "Daemon to log latency values of connections to neighbours"),
                          options, &run, NULL)) ? 0 : 1;
-  GNUNET_free ((void *) argv);
+  GNUNET_free_nz ((void *) argv);
   return ret;
 }
diff --git a/src/testbed/gnunet-daemon-testbed-blacklist.c b/src/testbed/gnunet-daemon-testbed-blacklist.c
index 070583941..c82f8075f 100644
--- a/src/testbed/gnunet-daemon-testbed-blacklist.c
+++ b/src/testbed/gnunet-daemon-testbed-blacklist.c
@@ -249,6 +249,6 @@ main (int argc, char *const *argv)
                          _ (
                            "Daemon to restrict incoming transport layer connections during testbed deployments"),
                          options, &run, NULL)) ? 0 : 1;
-  GNUNET_free ((void *) argv);
+  GNUNET_free_nz ((void *) argv);
   return ret;
 }
diff --git a/src/testbed/gnunet-daemon-testbed-underlay.c b/src/testbed/gnunet-daemon-testbed-underlay.c
index 09dfee5a6..2bff7cdd4 100644
--- a/src/testbed/gnunet-daemon-testbed-underlay.c
+++ b/src/testbed/gnunet-daemon-testbed-underlay.c
@@ -476,6 +476,6 @@ main (int argc, char *const *argv)
                          (
                            "Daemon to restrict underlay network in testbed deployments"),
                          options, &run, NULL)) ? 0 : 1;
-  GNUNET_free ((void *) argv);
+  GNUNET_free_nz ((void *) argv);
   return ret;
 }
diff --git a/src/testbed/gnunet-testbed-profiler.c b/src/testbed/gnunet-testbed-profiler.c
index cfc6367fe..90813c8e5 100644
--- a/src/testbed/gnunet-testbed-profiler.c
+++ b/src/testbed/gnunet-testbed-profiler.c
@@ -318,7 +318,7 @@ main (int argc, char *const *argv)
   ret =
     GNUNET_PROGRAM_run (argc, argv, "gnunet-testbed-profiler", binaryHelp,
                         options, &run, NULL);
-  GNUNET_free ((void *) argv);
+  GNUNET_free_nz ((void *) argv);
   if (GNUNET_OK != ret)
     return ret;
   if (GNUNET_OK != result)
diff --git a/src/testing/gnunet-testing.c b/src/testing/gnunet-testing.c
index b850d6b13..a9e5042b2 100644
--- a/src/testing/gnunet-testing.c
+++ b/src/testing/gnunet-testing.c
@@ -436,7 +436,7 @@ main (int argc, char *const *argv)
                           GNUNET_YES))
     ? ret
     : 1;
-  GNUNET_free ((void *) argv);
+  GNUNET_free_nz ((void *) argv);
   return ret;
 }
 
diff --git a/src/testing/testing.c b/src/testing/testing.c
index 3e447e1ff..23bc40d7e 100644
--- a/src/testing/testing.c
+++ b/src/testing/testing.c
@@ -1343,7 +1343,7 @@ GNUNET_TESTING_peer_get_identity (struct GNUNET_TESTING_Peer *peer,
     return;
   }
   peer->id = GNUNET_new (struct GNUNET_PeerIdentity);
-  GNUNET_free (
+  GNUNET_free_nz (
     GNUNET_TESTING_hostkey_get (peer->system, peer->key_number, peer->id));
   GNUNET_memcpy (id, peer->id, sizeof(struct GNUNET_PeerIdentity));
 }
diff --git a/src/topology/gnunet-daemon-topology.c b/src/topology/gnunet-daemon-topology.c
index 261d825ea..c6f600df1 100644
--- a/src/topology/gnunet-daemon-topology.c
+++ b/src/topology/gnunet-daemon-topology.c
@@ -1130,7 +1130,7 @@ main (int argc, char *const *argv)
                                           NULL))
         ? 0
         : 1;
-  GNUNET_free ((void *) argv);
+  GNUNET_free_nz ((void *) argv);
   return ret;
 }
 
diff --git a/src/transport/gnunet-communicator-tcp.c b/src/transport/gnunet-communicator-tcp.c
index 82ee309a5..bbfacbffd 100644
--- a/src/transport/gnunet-communicator-tcp.c
+++ b/src/transport/gnunet-communicator-tcp.c
@@ -2285,7 +2285,7 @@ main (int argc, char *const *argv)
                                           NULL))
         ? 0
         : 1;
-  GNUNET_free ((void *) argv);
+  GNUNET_free_nz ((void *) argv);
   return ret;
 }
 
diff --git a/src/transport/gnunet-communicator-udp.c b/src/transport/gnunet-communicator-udp.c
index e0b14f669..72e84567a 100644
--- a/src/transport/gnunet-communicator-udp.c
+++ b/src/transport/gnunet-communicator-udp.c
@@ -2791,7 +2791,7 @@ main (int argc, char *const *argv)
                                           NULL))
         ? 0
         : 1;
-  GNUNET_free ((void *) argv);
+  GNUNET_free_nz ((void *) argv);
   return ret;
 }
 
diff --git a/src/transport/gnunet-communicator-unix.c b/src/transport/gnunet-communicator-unix.c
index 7d7f18a9c..31d2e4ed3 100644
--- a/src/transport/gnunet-communicator-unix.c
+++ b/src/transport/gnunet-communicator-unix.c
@@ -1135,7 +1135,7 @@ main (int argc, char *const *argv)
                              NULL))
         ? 0
         : 1;
-  GNUNET_free ((void *) argv);
+  GNUNET_free_nz ((void *) argv);
   return ret;
 }
 
diff --git a/src/transport/gnunet-transport-profiler.c b/src/transport/gnunet-transport-profiler.c
index 6c13cf059..81678fa20 100644
--- a/src/transport/gnunet-transport-profiler.c
+++ b/src/transport/gnunet-transport-profiler.c
@@ -615,7 +615,7 @@ main (int argc, char *const *argv)
                         options,
                         &run,
                         NULL);
-  GNUNET_free ((void *) argv);
+  GNUNET_free_nz ((void *) argv);
   if (GNUNET_OK == res)
     return ret;
   return 1;
diff --git a/src/transport/gnunet-transport.c b/src/transport/gnunet-transport.c
index 5a437b660..35da5ec10 100644
--- a/src/transport/gnunet-transport.c
+++ b/src/transport/gnunet-transport.c
@@ -1427,7 +1427,7 @@ main (int argc, char *const *argv)
                         options,
                         &run,
                         NULL);
-  GNUNET_free ((void *) argv);
+  GNUNET_free_nz ((void *) argv);
   if (GNUNET_OK == res)
     return ret;
   return 1;
diff --git a/src/transport/tcp_service_legacy.c b/src/transport/tcp_service_legacy.c
index f207863f9..fb4e9c3c9 100644
--- a/src/transport/tcp_service_legacy.c
+++ b/src/transport/tcp_service_legacy.c
@@ -1474,7 +1474,7 @@ shutdown:
   i = 0;
   if (NULL != sctx.addrs)
     while (NULL != sctx.addrs[i])
-      GNUNET_free (sctx.addrs[i++]);
+      GNUNET_free_nz (sctx.addrs[i++]);
   GNUNET_free_non_null (sctx.addrs);
   GNUNET_free_non_null (sctx.addrlens);
   GNUNET_free_non_null (logfile);
@@ -1631,7 +1631,7 @@ LEGACY_SERVICE_stop (struct LEGACY_SERVICE_Context *sctx)
   {
     i = 0;
     while (NULL != sctx->addrs[i])
-      GNUNET_free (sctx->addrs[i++]);
+      GNUNET_free_nz (sctx->addrs[i++]);
     GNUNET_free (sctx->addrs);
   }
   GNUNET_free_non_null (sctx->addrlens);
diff --git a/src/transport/test_plugin_transport.c b/src/transport/test_plugin_transport.c
index 10e07dae5..04687d845 100644
--- a/src/transport/test_plugin_transport.c
+++ b/src/transport/test_plugin_transport.c
@@ -49,7 +49,7 @@ static struct GNUNET_PeerIdentity my_identity;
 /**
  * Our private key.
  */
-static struct GNUNET_CRYPTO_EddsaPrivateKey *my_private_key;
+static struct GNUNET_CRYPTO_EddsaPrivateKey my_private_key;
 
 /**
  * Our configuration.
@@ -647,16 +647,20 @@ run (void *cls,
   }
 
   max_connect_per_transport = (uint32_t) tneigh;
-  my_private_key = GNUNET_CRYPTO_eddsa_key_create_from_file (keyfile);
-  GNUNET_free (keyfile);
-  if (NULL == my_private_key)
+  if (GNUNET_SYSERR ==
+      GNUNET_CRYPTO_eddsa_key_from_file (keyfile,
+                                         GNUNET_YES,
+                                         &my_private_key))
   {
+    GNUNET_free (keyfile);
     GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                 "Could not access hostkey.  Exiting.\n");
     end_badly_now ();
     return;
   }
-  GNUNET_CRYPTO_eddsa_key_get_public (my_private_key, &my_identity.public_key);
+  GNUNET_free (keyfile);
+  GNUNET_CRYPTO_eddsa_key_get_public (&my_private_key,
+                                      &my_identity.public_key);
 
   hello = GNUNET_HELLO_create (&my_identity.public_key, NULL, NULL, GNUNET_NO);
 
diff --git a/src/util/gnunet-config.c b/src/util/gnunet-config.c
index f101e8b61..5883c1497 100644
--- a/src/util/gnunet-config.c
+++ b/src/util/gnunet-config.c
@@ -331,7 +331,7 @@ main (int argc, char *const *argv)
                         options,
                         &run,
                         NULL);
-  GNUNET_free ((void *) argv);
+  GNUNET_free_nz ((void *) argv);
   if (GNUNET_OK == ret)
     return global_ret;
   return ret;
diff --git a/src/util/gnunet-ecc.c b/src/util/gnunet-ecc.c
index 764a507b6..8e30ac416 100644
--- a/src/util/gnunet-ecc.c
+++ b/src/util/gnunet-ecc.c
@@ -501,7 +501,7 @@ main (int argc, char *const *argv)
                              NULL))
         ? 0
         : 1;
-  GNUNET_free ((void *) argv);
+  GNUNET_free_nz ((void *) argv);
   return ret;
 }
 
diff --git a/src/util/gnunet-resolver.c b/src/util/gnunet-resolver.c
index 6a602c64e..8a6c7fbe9 100644
--- a/src/util/gnunet-resolver.c
+++ b/src/util/gnunet-resolver.c
@@ -171,14 +171,18 @@ main (int argc, char *const *argv)
   };
   int ret;
 
-  if (GNUNET_OK != GNUNET_STRINGS_get_utf8_args (argc, argv, &argc, &argv))
+  if (GNUNET_OK !=
+      GNUNET_STRINGS_get_utf8_args (argc, argv,
+                                    &argc, &argv))
     return 2;
 
   ret = (GNUNET_OK ==
-         GNUNET_PROGRAM_run (argc, argv, "gnunet-resolver [hostname]",
+         GNUNET_PROGRAM_run (argc, argv,
+                             "gnunet-resolver [hostname]",
                              gettext_noop ("Use build-in GNUnet stub resolver"),
-                             options, &run, NULL)) ? 0 : 1;
-  GNUNET_free ((void *) argv);
+                             options,
+                             &run, NULL)) ? 0 : 1;
+  GNUNET_free_nz ((void *) argv);
   return ret;
 }
 
diff --git a/src/util/gnunet-scrypt.c b/src/util/gnunet-scrypt.c
index 8c46136b9..70ba48d82 100644
--- a/src/util/gnunet-scrypt.c
+++ b/src/util/gnunet-scrypt.c
@@ -322,7 +322,7 @@ main (int argc, char *const *argv)
                          NULL))
     ? 0
     : 1;
-  GNUNET_free ((void *) argv);
+  GNUNET_free_nz ((void *) argv);
   GNUNET_free_non_null (pwfn);
   return ret;
 }
diff --git a/src/util/gnunet-uri.c b/src/util/gnunet-uri.c
index 84100ff56..48c46ee49 100644
--- a/src/util/gnunet-uri.c
+++ b/src/util/gnunet-uri.c
@@ -184,7 +184,7 @@ main (int argc, char *const *argv)
   shc_chld = NULL;
   GNUNET_DISK_pipe_close (sigpipe);
   sigpipe = NULL;
-  GNUNET_free ((void *) argv);
+  GNUNET_free_nz ((void *) argv);
   return ((GNUNET_OK == ret) && (0 == exit_code)) ? 0 : 1;
 }
 
diff --git a/src/util/os_priority.c b/src/util/os_priority.c
index 36f0d8e30..5799d893b 100644
--- a/src/util/os_priority.c
+++ b/src/util/os_priority.c
@@ -875,7 +875,7 @@ GNUNET_OS_start_process_s (int pipe_control,
                                     binary_path,
                                     argv);
   while (argv_size > 0)
-    GNUNET_free (argv[--argv_size]);
+    GNUNET_free_nz (argv[--argv_size]);
   GNUNET_free (argv);
   return proc;
 }
diff --git a/src/util/scheduler.c b/src/util/scheduler.c
index 45a6b61e5..93393bd7c 100644
--- a/src/util/scheduler.c
+++ b/src/util/scheduler.c
@@ -584,28 +584,26 @@ dump_backtrace (struct GNUNET_SCHEDULER_Task *t)
 static void
 destroy_task (struct GNUNET_SCHEDULER_Task *t)
 {
-  unsigned int i;
-
   LOG (GNUNET_ERROR_TYPE_DEBUG,
        "destroying task %p\n",
        t);
 
   if (GNUNET_YES == t->own_handles)
   {
-    for (i = 0; i != t->fds_len; ++i)
+    for (unsigned int i = 0; i != t->fds_len; ++i)
     {
       const struct GNUNET_NETWORK_Handle *fd = t->fds[i].fd;
       const struct GNUNET_DISK_FileHandle *fh = t->fds[i].fh;
       if (fd)
       {
-        GNUNET_NETWORK_socket_free_memory_only_ ((struct
-                                                  GNUNET_NETWORK_Handle *) fd);
+        GNUNET_NETWORK_socket_free_memory_only_ (
+          (struct GNUNET_NETWORK_Handle *) fd);
       }
       if (fh)
       {
         // FIXME: on WIN32 this is not enough! A function
         // GNUNET_DISK_file_free_memory_only would be nice
-        GNUNET_free ((void *) fh);
+        GNUNET_free_nz ((void *) fh);
       }
     }
   }
diff --git a/src/util/test_common_allocation.c b/src/util/test_common_allocation.c
index e2fc29e82..a24af7124 100644
--- a/src/util/test_common_allocation.c
+++ b/src/util/test_common_allocation.c
@@ -27,7 +27,7 @@
 
 
 static int
-check ()
+check (void)
 {
 #define MAX_TESTVAL 1024
   char *ptrs[MAX_TESTVAL];
@@ -134,6 +134,28 @@ check ()
 }
 
 
+static int
+check2 (void)
+{
+  char *a1 = NULL;
+  unsigned int a1_len = 0;
+  const char *a2 = "test";
+
+  GNUNET_array_append (a1,
+                       a1_len,
+                       'x');
+  GNUNET_array_concatenate (a1,
+                            a1_len,
+                            a2,
+                            4);
+  GNUNET_assert (0 == strncmp ("xtest",
+                               a1,
+                               5));
+  GNUNET_assert (5 == a1_len);
+  return 0;
+}
+
+
 int
 main (int argc, char *argv[])
 {
@@ -142,7 +164,7 @@ main (int argc, char *argv[])
   GNUNET_log_setup ("test-common-allocation",
                     "WARNING",
                     NULL);
-  ret = check ();
+  ret = check () | check2 ();
   if (ret != 0)
     fprintf (stderr,
              "ERROR %d.\n",
diff --git a/src/vpn/gnunet-vpn.c b/src/vpn/gnunet-vpn.c
index 6dcd227c7..a7f7fc30c 100644
--- a/src/vpn/gnunet-vpn.c
+++ b/src/vpn/gnunet-vpn.c
@@ -357,7 +357,7 @@ main (int argc, char *const *argv)
                                       NULL))
     ? ret
     : 1;
-  GNUNET_free ((void *) argv);
+  GNUNET_free_nz ((void *) argv);
   return ret;
 }