diff --git a/CHANGES b/CHANGES
index f7bbc72fe6..b6a09ffa01 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,5 @@
+2248.   [cleanup]       Fix several errors reported by Coverity. [RT #17160]
+
 2247.	[doc]		Sort doc/misc/options. [RT #17067]
 
 2246.	[bug]		Make the startup of test servers (ans.pl) more
diff --git a/lib/bind/dst/dst_api.c b/lib/bind/dst/dst_api.c
index d3976ef543..7ff5d13ca4 100644
--- a/lib/bind/dst/dst_api.c
+++ b/lib/bind/dst/dst_api.c
@@ -1,5 +1,5 @@
 #ifndef LINT
-static const char rcsid[] = "$Header: /u0/home/explorer/proj/ISC/git-conversion/cvsroot/bind9/lib/bind/dst/Attic/dst_api.c,v 1.16 2007/08/27 03:32:26 marka Exp $";
+static const char rcsid[] = "$Header: /u0/home/explorer/proj/ISC/git-conversion/cvsroot/bind9/lib/bind/dst/Attic/dst_api.c,v 1.17 2007/09/24 17:18:25 each Exp $";
 #endif
 
 /*
@@ -434,6 +434,7 @@ dst_s_write_private_key(const DST_KEY *key)
 		if ((nn = fwrite(encoded_block, 1, len, fp)) != len) {
 			EREPORT(("dst_write_private_key(): Write failure on %s %d != %d errno=%d\n",
 				 file, len, nn, errno));
+			fclose(fp);
 			return (-5);
 		}
 		fclose(fp);
diff --git a/lib/bind/dst/hmac_link.c b/lib/bind/dst/hmac_link.c
index eca5f01353..23e4bb6e6d 100644
--- a/lib/bind/dst/hmac_link.c
+++ b/lib/bind/dst/hmac_link.c
@@ -1,6 +1,6 @@
 #ifdef HMAC_MD5
 #ifndef LINT
-static const char rcsid[] = "$Header: /u0/home/explorer/proj/ISC/git-conversion/cvsroot/bind9/lib/bind/dst/Attic/hmac_link.c,v 1.7 2007/02/26 01:51:43 marka Exp $";
+static const char rcsid[] = "$Header: /u0/home/explorer/proj/ISC/git-conversion/cvsroot/bind9/lib/bind/dst/Attic/hmac_link.c,v 1.8 2007/09/24 17:18:25 each Exp $";
 #endif
 /*
  * Portions Copyright (c) 1995-1998 by Trusted Information Systems, Inc.
@@ -223,6 +223,7 @@ dst_buffer_to_hmac_md5(DST_KEY *dkey, const u_char *key, const int keylen)
 	HMAC_Key *hkey = NULL;
 	MD5_CTX ctx;
 	int local_keylen = keylen;
+	u_char tk[MD5_LEN];
 
 	if (dkey == NULL || key == NULL || keylen < 0)
 		return (-1);
@@ -235,7 +236,6 @@ dst_buffer_to_hmac_md5(DST_KEY *dkey, const u_char *key, const int keylen)
 
 	/* if key is longer than HMAC_LEN bytes reset it to key=MD5(key) */
 	if (keylen > HMAC_LEN) {
-		u_char tk[MD5_LEN];
 		MD5Init(&ctx);
 		MD5Update(&ctx, key, keylen);
 		MD5Final(tk, &ctx);
diff --git a/lib/dns/tsig.c b/lib/dns/tsig.c
index f1391e52da..5ab20a348c 100644
--- a/lib/dns/tsig.c
+++ b/lib/dns/tsig.c
@@ -16,7 +16,7 @@
  */
 
 /*
- * $Id: tsig.c,v 1.129 2007/06/19 23:47:16 tbox Exp $
+ * $Id: tsig.c,v 1.130 2007/09/24 17:18:25 each Exp $
  */
 /*! \file */
 #include <config.h>
@@ -1512,8 +1512,10 @@ dns_tsigkeyring_create(isc_mem_t *mctx, dns_tsig_keyring_t **ringp) {
 		return (ISC_R_NOMEMORY);
 
 	result = isc_rwlock_init(&ring->lock, 0, 0);
-	if (result != ISC_R_SUCCESS)
+	if (result != ISC_R_SUCCESS) {
+		isc_mem_put(mctx, ring, sizeof(dns_tsig_keyring_t));
 		return (result);
+	}
 
 	ring->keys = NULL;
 	result = dns_rbt_create(mctx, free_tsignode, NULL, &ring->keys);
diff --git a/lib/isc/radix.c b/lib/isc/radix.c
index a5f2166197..e35195e87f 100644
--- a/lib/isc/radix.c
+++ b/lib/isc/radix.c
@@ -14,7 +14,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: radix.c,v 1.5 2007/09/19 03:03:29 marka Exp $ */
+/* $Id: radix.c,v 1.6 2007/09/24 17:18:25 each Exp $ */
 
 /*
  * This source was adapted from MRT's RCS Ids:
@@ -289,13 +289,15 @@ isc_radix_insert(isc_radix_tree_t *radix, isc_radix_node_t **target,
 	isc_uint32_t i, j, r;
 	isc_result_t result;
 
-	REQUIRE(radix);
-	REQUIRE(prefix || (source && source->prefix));
-	RUNTIME_CHECK(prefix->bitlen <= radix->maxbits);
+	REQUIRE(radix != NULL);
+	REQUIRE(prefix != NULL || (source != NULL && source->prefix != NULL));
+	RUNTIME_CHECK(prefix == NULL || prefix->bitlen <= radix->maxbits);
 
-	if (!prefix && source && source->prefix)
+	if (prefix == NULL)
 		prefix = source->prefix;
 
+	INSIST(prefix != NULL);
+
 	if (radix->head == NULL) {
 		node = isc_mem_get(radix->mctx, sizeof(isc_radix_node_t));
 		if (node == NULL)
@@ -338,7 +340,7 @@ isc_radix_insert(isc_radix_tree_t *radix, isc_radix_node_t **target,
 		INSIST(node != NULL);
 	}
 
-	INSIST(node->prefix);
+	INSIST(node->prefix != NULL);
 
 	test_addr = isc_prefix_touchar(node->prefix);
 	/* Find the first bit different. */
@@ -364,13 +366,13 @@ isc_radix_insert(isc_radix_tree_t *radix, isc_radix_node_t **target,
 		differ_bit = check_bit;
 
 	parent = node->parent;
-	while (parent && parent->bit >= differ_bit) {
+	while (parent != NULL && parent->bit >= differ_bit) {
 		node = parent;
 		parent = node->parent;
 	}
 
 	if (differ_bit == bitlen && node->bit == bitlen) {
-		if (node->prefix) {
+		if (node->prefix != NULL) {
 			*target = node;
 			return (ISC_R_SUCCESS);
 		}
@@ -406,7 +408,7 @@ isc_radix_insert(isc_radix_tree_t *radix, isc_radix_node_t **target,
 	new_node->l = new_node->r = NULL;
 	radix->num_active_node++;
 
-	if (source) {
+	if (source != NULL) {
 		/*
 		 * If source is non-NULL, then we're merging in a node
 		 * from an existing radix tree.  Node_num values have to
diff --git a/lib/lwres/lwres_gnba.c b/lib/lwres/lwres_gnba.c
index 7843fc3257..d18ae153f2 100644
--- a/lib/lwres/lwres_gnba.c
+++ b/lib/lwres/lwres_gnba.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: lwres_gnba.c,v 1.27 2007/06/19 23:47:22 tbox Exp $ */
+/* $Id: lwres_gnba.c,v 1.28 2007/09/24 17:18:25 each Exp $ */
 
 /*! \file lwres_gnba.c
    These are low-level routines for creating and parsing lightweight
@@ -126,7 +126,6 @@ lwres_gnbarequest_render(lwres_context_t *ctx, lwres_gnbarequest_t *req,
 	REQUIRE(req != NULL);
 	REQUIRE(req->addr.family != 0);
 	REQUIRE(req->addr.length != 0);
-	REQUIRE(req->addr.address != NULL);
 	REQUIRE(pkt != NULL);
 	REQUIRE(b != NULL);