Be a bit more paranoid by checking allocs and expected types.

lib/initend.c

@@ -152,6 +152,10 @@ xbps_init(struct xbps_handle *xh)
 			xhp->cachedir = cfg_getstr(xhp->cfg, "cachedir");
 	}
 	get_cachedir(xhp);
+	if (xhp->cachedir_priv == NULL) {
+		xbps_end(xh);
+		return ENOMEM;
+	}
 	xhp->cachedir = xhp->cachedir_priv;
 
 	if (xhp->cfg == NULL) {
@@ -199,8 +203,9 @@ xbps_end(struct xbps_handle *xh)
 		return;
 	if (xh->cfg != NULL)
 		cfg_free(xh->cfg);
-
+	if (xh->cachedir_priv != NULL)
 		free(xh->cachedir_priv);
+
 	free(xh);
 	xh = NULL;
 	xhp = NULL;

lib/package_orphans.c

@@ -138,7 +138,10 @@ find_orphan_pkg(prop_object_t obj, void *arg, bool *loop_done)
 			continue;
 
 		pkgdepname = xbps_pkg_name(pkgdep);
-		assert(pkgdepname != NULL);
+		if (pkgdepname == NULL) {
+			prop_object_iterator_release(iter);
+			return ENOMEM;
+		}
 		for (i = 0; i < prop_array_count(od->orphans_user); i++) {
 			prop_array_get_cstring_nocopy(od->orphans_user,
 			    i, &curpkgname);

lib/package_state.c

@@ -285,7 +285,7 @@ xbps_set_pkg_state_installed(const char *pkgname,
 	}
 
 out:
-	if (dict)
+	if (prop_object_type(dict) == PROP_TYPE_DICTIONARY)
 		prop_object_release(dict);
 	if (metadir)
 		free(metadir);

lib/package_unpack.c

@@ -408,6 +408,10 @@ unpack_archive(prop_dictionary_t pkg_repod, struct archive *ar)
 			 * file but renaming it to <file>.old.
 			 */
 			buf = xbps_xasprintf("%s.old", entry_pname);
+			if (buf == NULL) {
+				rv = ENOMEM;
+				goto out;
+			}
 			(void)rename(entry_pname, buf);
 			free(buf);
 			xbps_set_cb_state(XBPS_STATE_CONFIG_FILE, 0,
@@ -538,9 +542,9 @@ out:
 int
 xbps_unpack_binary_pkg(prop_dictionary_t pkg_repod)
 {
-	struct archive *ar;
+	struct archive *ar = NULL;
 	const char *pkgname, *version, *repoloc, *pkgver, *fname;
-	char *bpkg;
+	char *bpkg = NULL;
 	int rv = 0;
 
 	assert(prop_object_type(pkg_repod) == PROP_TYPE_DICTIONARY);
@@ -563,8 +567,8 @@ xbps_unpack_binary_pkg(prop_dictionary_t pkg_repod)
 	}
 
 	if ((ar = archive_read_new()) == NULL) {
-		rv = ENOMEM;
-		goto out;
+		free(bpkg);
+		return ENOMEM;
 	}
 	/*
 	 * Enable support for tar format and all compression methods.
@@ -578,8 +582,12 @@ xbps_unpack_binary_pkg(prop_dictionary_t pkg_repod)
 		    rv, pkgname, version,
 		    "%s: [unpack] failed to open binary package `%s': %s",
 		    pkgver, fname, strerror(rv));
-		goto out;
+		free(bpkg);
+		archive_read_finish(ar);
+		return rv;
 	}
+	free(bpkg);
+
 	/*
 	 * Set package state to half-unpacked.
 	 */
@@ -613,8 +621,6 @@ xbps_unpack_binary_pkg(prop_dictionary_t pkg_repod)
 		    pkgver, strerror(rv));
 	}
 out:
-	if (bpkg)
-		free(bpkg);
 	if (ar)
 		archive_read_finish(ar);
 

lib/repository_pool_find.c

@@ -228,7 +228,7 @@ xbps_repository_pool_find_virtualpkg(const char *pkg, bool bypattern, bool best)
 	assert(pkg != NULL);
 
 	rpf = repo_find_pkg(pkg, bypattern, best, true);
-	if (rpf->pkgd != NULL)
+	if (prop_object_type(rpf->pkgd) == PROP_TYPE_DICTIONARY)
 		pkgd = prop_dictionary_copy(rpf->pkgd);
 	free(rpf);
 
@@ -244,7 +244,7 @@ xbps_repository_pool_find_pkg(const char *pkg, bool bypattern, bool best)
 	assert(pkg != NULL);
 
 	rpf = repo_find_pkg(pkg, bypattern, best, false);
-	if (rpf->pkgd != NULL)
+	if (prop_object_type(rpf->pkgd) == PROP_TYPE_DICTIONARY)
 		pkgd = prop_dictionary_copy(rpf->pkgd);
 	free(rpf);
 
@@ -287,7 +287,7 @@ xbps_repository_pool_dictionary_metadata_plist(const char *pkgname,
 out:
 	if (plistd == NULL)
 		errno = ENOENT;
-	if (pkgd)
+	if (prop_object_type(pkgd) == PROP_TYPE_DICTIONARY)
 		prop_object_release(pkgd);
 
 	return plistd;

lib/util.c

@@ -99,7 +99,7 @@ xbps_check_is_installed_pkg_by_name(const char *pkgname)
 	assert(pkgname != NULL);
 
 	pkgd = xbps_find_virtualpkg_dict_installed(pkgname, false);
-	if (pkgd) {
+	if (prop_object_type(pkgd) == PROP_TYPE_DICTIONARY) {
 		prop_object_release(pkgd);
 		return true;
 	}
@@ -276,7 +276,8 @@ xbps_pkg_has_rundeps(prop_dictionary_t pkgd)
 	assert(prop_object_type(pkgd) == PROP_TYPE_DICTIONARY);
 
 	array = prop_dictionary_get(pkgd, "run_depends");
-	if (array && prop_array_count(array) > 0)
+	if ((prop_object_type(array) == PROP_TYPE_ARRAY) &&
+	     prop_array_count(array) > 0)
 		return true;
 
 	return false;