4 files changed, 32 insertions, 0 deletions
diff --git a/src/common/crypto.c b/src/common/crypto.c
index a247a87d48..f4e86683d9 100644
--- a/src/common/crypto.c
+++ b/src/common/crypto.c
@@ -2756,6 +2756,8 @@ base64_decode(char *dest, size_t destlen, const char *src, size_t srclen)
   if (destlen > SIZE_T_CEILING)
     return -1;
 
+  memset(dest, 0, destlen);
+
   EVP_DecodeInit(&ctx);
   EVP_DecodeUpdate(&ctx, (unsigned char*)dest, &len,
                    (unsigned char*)src, srclen);
@@ -2777,6 +2779,8 @@ base64_decode(char *dest, size_t destlen, const char *src, size_t srclen)
   if (destlen > SIZE_T_CEILING)
     return -1;
 
+  memset(dest, 0, destlen);
+
   /* Iterate over all the bytes in src.  Each one will add 0 or 6 bits to the
    * value we're decoding.  Accumulate bits in <b>n</b>, and whenever we have
    * 24 bits, batch them into 3 bytes and flush those bytes to dest.
@@ -2956,6 +2960,8 @@ base32_decode(char *dest, size_t destlen, const char *src, size_t srclen)
   tor_assert((nbits/8) <= destlen); /* We need enough space. */
   tor_assert(destlen < SIZE_T_CEILING);
 
+  memset(dest, 0, destlen);
+
   /* Convert base32 encoded chars to the 5-bit values that they represent. */
   tmp = tor_malloc_zero(srclen);
   for (j = 0; j < srclen; ++j) {
diff --git a/src/common/sandbox.c b/src/common/sandbox.c
index dbbaa59d7c..e43b64b913 100644
--- a/src/common/sandbox.c
+++ b/src/common/sandbox.c
@@ -164,6 +164,7 @@ static int filter_nopar_gen[] = {
 #endif
     SCMP_SYS(stat),
     SCMP_SYS(uname),
+    SCMP_SYS(wait4),
     SCMP_SYS(write),
     SCMP_SYS(writev),
     SCMP_SYS(exit_group),
diff --git a/src/common/tortls.c b/src/common/tortls.c
index 999d97131c..d637a8e4d9 100644
--- a/src/common/tortls.c
+++ b/src/common/tortls.c
@@ -33,6 +33,20 @@
     #include <ws2tcpip.h>
  #endif
 #endif
+
+#ifdef __GNUC__
+#define GCC_VERSION (__GNUC__ * 100 + __GNUC_MINOR__)
+#endif
+
+#if __GNUC__ && GCC_VERSION >= 402
+#if GCC_VERSION >= 406
+#pragma GCC diagnostic push
+#endif
+/* Some versions of OpenSSL declare SSL_get_selected_srtp_profile twice in
+ * srtp.h. Suppress the GCC warning so we can build with -Wredundant-decl. */
+#pragma GCC diagnostic ignored "-Wredundant-decls"
+#endif
+
 #include <openssl/ssl.h>
 #include <openssl/ssl3.h>
 #include <openssl/err.h>
@@ -41,6 +55,14 @@
 #include <openssl/bio.h>
 #include <openssl/opensslv.h>
 
+#if __GNUC__ && GCC_VERSION >= 402
+#if GCC_VERSION >= 406
+#pragma GCC diagnostic pop
+#else
+#pragma GCC diagnostic warning "-Wredundant-decls"
+#endif
+#endif
+
 #ifdef USE_BUFFEREVENTS
 #include <event2/bufferevent_ssl.h>
 #include <event2/buffer.h>
diff --git a/src/common/util.c b/src/common/util.c
index 2d7893b38a..04cc6b12c6 100644
--- a/src/common/util.c
+++ b/src/common/util.c
@@ -1129,6 +1129,9 @@ base16_decode(char *dest, size_t destlen, const char *src, size_t srclen)
     return -1;
   if (destlen < srclen/2 || destlen > SIZE_T_CEILING)
     return -1;
+
+  memset(dest, 0, destlen);
+
   end = src+srclen;
   while (src<end) {
     v1 = hex_decode_digit_(*src);