diff --git a/tests/client/torture_client_callbacks.c b/tests/client/torture_client_callbacks.c
index 3b9b85a3..d92f8b31 100644
--- a/tests/client/torture_client_callbacks.c
+++ b/tests/client/torture_client_callbacks.c
@@ -149,6 +149,7 @@ static void torture_open_success(void **state)
 
     assert_int_equal(STATE_SUCCESS, cb_state->open_response);
 
+    free(cb_state);
     ssh_channel_free(channel);
 }
 
@@ -170,6 +171,7 @@ static void torture_open_failure(void **state)
 
     assert_int_equal(STATE_FAILURE, cb_state->open_response);
 
+    free(cb_state);
     ssh_channel_free(channel);
 }
 
@@ -194,6 +196,7 @@ static void torture_request_success(void **state)
 
     assert_int_equal(STATE_SUCCESS, cb_state->request_response);
 
+    free(cb_state);
     ssh_channel_free(channel);
 }
 
@@ -218,6 +221,7 @@ static void torture_request_failure(void **state)
 
     assert_int_equal(STATE_SUCCESS, cb_state->request_response);
 
+    free(cb_state);
     ssh_channel_free(channel);
 }
 
diff --git a/tests/external_override/torture_override.c b/tests/external_override/torture_override.c
index f351d52e..4622ec49 100644
--- a/tests/external_override/torture_override.c
+++ b/tests/external_override/torture_override.c
@@ -56,7 +56,7 @@ static int sshd_setup(void **state)
     s = *((struct torture_state **)state);
     s->private_data = test_state;
 
-    test_state->orig_dir = strdup(torture_get_current_working_dir());
+    test_state->orig_dir = torture_get_current_working_dir();
     assert_non_null(test_state->orig_dir);
 
     temp_dir = torture_make_temp_dir(template);
@@ -137,7 +137,7 @@ static void test_algorithm(ssh_session session,
                            const char *cipher,
                            const char *hostkey)
 {
-    char data[256];
+    char data[256] = {0};
     int rc;
 
     if (kex != NULL) {
@@ -161,7 +161,7 @@ static void test_algorithm(ssh_session session,
     assert_ssh_return_code(session, rc);
 
     /* send ignore packets of all sizes */
-    memset(data, 'A', sizeof(data));
+    memset(data, 'A', sizeof(data) - 1);
     ssh_send_ignore(session, data);
     ssh_handle_packets(session, 50);
 
diff --git a/tests/unittests/torture_pki_rsa_uri.c b/tests/unittests/torture_pki_rsa_uri.c
index 11c6a3d8..a13e470c 100644
--- a/tests/unittests/torture_pki_rsa_uri.c
+++ b/tests/unittests/torture_pki_rsa_uri.c
@@ -292,6 +292,8 @@ torture_run_tests(void)
                                 setup_directory_structure,
                                 teardown_directory_structure);
 
+    ssh_free(session);
+
     ssh_finalize();
 
     return rc;
diff --git a/tests/unittests/torture_session_keys.c b/tests/unittests/torture_session_keys.c
index a5ec3d89..11993ee0 100644
--- a/tests/unittests/torture_session_keys.c
+++ b/tests/unittests/torture_session_keys.c
@@ -73,6 +73,7 @@ static void torture_session_keys(UNUSED_PARAM(void **state))
     assert_int_equal(rc, 0);
 
     test_crypto.shared_secret = ssh_make_string_bn(k_string);
+    SSH_STRING_FREE(k_string);
 
     rc = ssh_generate_session_keys(&session);
     assert_int_equal(rc, 0);
@@ -84,7 +85,13 @@ static void torture_session_keys(UNUSED_PARAM(void **state))
     assert_memory_equal(test_crypto.encryptMAC, eMAC, 32);
     assert_memory_equal(test_crypto.decryptMAC, dMAC, 32);
 
-    SSH_STRING_FREE(k_string);
+    bignum_safe_free(test_crypto.shared_secret);
+    SAFE_FREE(test_crypto.encryptIV);
+    SAFE_FREE(test_crypto.decryptIV);
+    SAFE_FREE(test_crypto.encryptkey);
+    SAFE_FREE(test_crypto.decryptkey);
+    SAFE_FREE(test_crypto.encryptMAC);
+    SAFE_FREE(test_crypto.decryptMAC);
 }
 
 int torture_run_tests(void) {