diff --git a/ChangeLog b/ChangeLog
index 034bf52b..65bd1058 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+Fri Mar 10 01:34:42 CET 2006 Daniel Veillard <daniel@veillard.com>
+
+	* runtest.c schematron.c testAutomata.c tree.c valid.c xinclude.c
+	  xmlcatalog.c xmlreader.c xmlregexp.c xpath.c: end of first
+	  pass on coverity reports.
+
 Thu Mar  9 19:36:14 CET 2006 Daniel Veillard <daniel@veillard.com>
 
 	* relaxng.c xmlschemas.c xmlschemastypes.c: more cleanups based
diff --git a/runtest.c b/runtest.c
index 02fc159c..cf0fb63a 100644
--- a/runtest.c
+++ b/runtest.c
@@ -617,7 +617,7 @@ static int compareFiles(const char *r1, const char *r2) {
     while (1) {
         res1 = read(fd1, bytes1, 4096);
         res2 = read(fd2, bytes2, 4096);
-	if (res1 != res2) {
+	if ((res1 != res2) || (res1 < 0)) {
 	    close(fd1);
 	    close(fd2);
 	    return(1);
@@ -2545,7 +2545,7 @@ static void
 handleURI(const char *str, const char *base, FILE *o) {
     int ret;
     xmlURIPtr uri;
-    xmlChar *res = NULL, *parsed = NULL;
+    xmlChar *res = NULL;
 
     uri = xmlCreateURI();
 
@@ -2568,8 +2568,6 @@ handleURI(const char *str, const char *base, FILE *o) {
     }
     if (res != NULL)
 	xmlFree(res);
-    if (parsed != NULL)
-	xmlFree(parsed);
     xmlFreeURI(uri);
 }
 
diff --git a/schematron.c b/schematron.c
index 98184acc..0a90ff80 100644
--- a/schematron.c
+++ b/schematron.c
@@ -1044,11 +1044,10 @@ done:
         if (doc != NULL)
 	    xmlFreeDoc(doc);
     }
-    if (href == NULL)
-        xmlFree(href);
-    if (base == NULL)
+    xmlFree(href);
+    if (base != NULL)
         xmlFree(base);
-    if (URI == NULL)
+    if (URI != NULL)
         xmlFree(URI);
     return(ret);
 }
@@ -1207,13 +1206,15 @@ exit:
     if (!preserve) {
 	xmlFreeDoc(doc);
     }
-    if (ctxt->nberrors != 0) {
-        xmlSchematronFree(ret);
-        ret = NULL;
-    } else {
-        ret->namespaces = ctxt->namespaces;
-        ret->nbNamespaces = ctxt->nbNamespaces;
-	ctxt->namespaces = NULL;
+    if (ret != NULL) {
+	if (ctxt->nberrors != 0) {
+	    xmlSchematronFree(ret);
+	    ret = NULL;
+	} else {
+	    ret->namespaces = ctxt->namespaces;
+	    ret->nbNamespaces = ctxt->nbNamespaces;
+	    ctxt->namespaces = NULL;
+	}
     }
     return (ret);
 }
@@ -1519,7 +1520,7 @@ xmlSchematronNextNode(xmlNodePtr cur) {
     
     do {
 	cur = cur->parent;
-	if (cur == NULL) return(NULL);
+	if (cur == NULL) break;
 	if (cur->type == XML_DOCUMENT_NODE) return(NULL);
 	if (cur->next != NULL) {
 	    cur = cur->next;
diff --git a/testAutomata.c b/testAutomata.c
index a168a4b0..a3969b14 100644
--- a/testAutomata.c
+++ b/testAutomata.c
@@ -53,6 +53,7 @@ testRegexpFile(const char *filename) {
         xmlGenericError(xmlGenericErrorContext,
 		"Cannot create automata\n");
 	fclose(input);
+	return;
     }
     states[0] = xmlAutomataGetInitState(am);
     if (states[0] == NULL) {
@@ -60,6 +61,7 @@ testRegexpFile(const char *filename) {
 		"Cannot get start state\n");
 	xmlFreeAutomata(am);
 	fclose(input);
+	return;
     }
     ret = 0;
 
diff --git a/tree.c b/tree.c
index ff3cb75a..14ca0186 100644
--- a/tree.c
+++ b/tree.c
@@ -5513,6 +5513,11 @@ xmlSearchNs(xmlDocPtr doc, xmlNodePtr node, const xmlChar *nameSpace) {
 	    node->nsDef = cur;
 	    return(cur);
 	}
+	if (doc == NULL) {
+	    doc = node->doc;
+	    if (doc == NULL)
+		return(NULL);
+	}
 	if (doc->oldNs == NULL) {
 	    /*
 	     * Allocate a new Namespace and fill the fields.
@@ -5650,6 +5655,11 @@ xmlSearchNsByHref(xmlDocPtr doc, xmlNodePtr node, const xmlChar * href)
             node->nsDef = cur;
             return (cur);
         }
+	if (doc == NULL) {
+	    doc = node->doc;
+	    if (doc == NULL)
+		return(NULL);
+	}
         if (doc->oldNs == NULL) {
             /*
              * Allocate a new Namespace and fill the fields.
@@ -8379,7 +8389,7 @@ xmlDOMWrapAdoptBranch(xmlDOMWrapCtxtPtr ctxt,
     xmlNodePtr cur, curElem = NULL;
     xmlNsMapPtr nsMap = NULL;
     xmlNsMapItemPtr mi;
-    xmlNsPtr ns;
+    xmlNsPtr ns = NULL;
     int depth = -1, adoptStr = 1;
     /* gather @parent's ns-decls. */
     int parnsdone = 0;
@@ -8716,8 +8726,7 @@ xmlDOMWrapCloneNode(xmlDOMWrapCtxtPtr ctxt,
     xmlNodePtr resultClone = NULL, clone = NULL, parentClone = NULL, prevClone = NULL;
     xmlNsPtr cloneNs = NULL, *cloneNsDefSlot = NULL;    
 
-    if ((node == NULL) || (resNode == NULL) ||
-	(sourceDoc == NULL) || (destDoc == NULL))
+    if ((node == NULL) || (resNode == NULL) || (destDoc == NULL))
 	return(-1);
     /*
     * TODO: Initially we support only element-nodes.
@@ -8736,6 +8745,8 @@ xmlDOMWrapCloneNode(xmlDOMWrapCtxtPtr ctxt,
     }
     if (sourceDoc == NULL)
 	sourceDoc = node->doc;    
+    if (sourceDoc == NULL)
+        return (-1);
 
     *resNode = NULL;
    
@@ -9121,7 +9132,8 @@ leave_node:
 	    /*
 	    * Set clone->last.
 	    */
-	    clone->parent->last = clone;
+	    if (clone->parent != NULL)
+		clone->parent->last = clone;
 	    clone = clone->parent;
 	    parentClone = clone->parent; 
 	    /*
diff --git a/valid.c b/valid.c
index 1bd0ef98..edf54261 100644
--- a/valid.c
+++ b/valid.c
@@ -4064,9 +4064,11 @@ xmlValidateAttributeDecl(xmlValidCtxtPtr ctxt, xmlDocPtr doc,
 	     * element in the external subset.
 	     */
 	    nbId = 0;
-	    table = (xmlAttributeTablePtr) doc->intSubset->attributes;
-	    xmlHashScan3(table, NULL, NULL, attr->elem, (xmlHashScanner)
-		         xmlValidateAttributeIdCallback, &nbId);
+	    if (doc->intSubset != NULL) {
+		table = (xmlAttributeTablePtr) doc->intSubset->attributes;
+		xmlHashScan3(table, NULL, NULL, attr->elem, (xmlHashScanner)
+			     xmlValidateAttributeIdCallback, &nbId);
+	    }
 	}
 	if (nbId > 1) {
 	    
diff --git a/xinclude.c b/xinclude.c
index 503eb764..21670a9b 100644
--- a/xinclude.c
+++ b/xinclude.c
@@ -388,9 +388,11 @@ xmlXIncludeFreeContext(xmlXIncludeCtxtPtr ctxt) {
 	if (ctxt->incTab[i] != NULL)
 	    xmlXIncludeFreeRef(ctxt->incTab[i]);
     }
-    for (i = 0;i < ctxt->txtNr;i++) {
-	if (ctxt->txturlTab[i] != NULL)
-	    xmlFree(ctxt->txturlTab[i]);
+    if (ctxt->txturlTab != NULL) {
+	for (i = 0;i < ctxt->txtNr;i++) {
+	    if (ctxt->txturlTab[i] != NULL)
+		xmlFree(ctxt->txturlTab[i]);
+	}
     }
     if (ctxt->incTab != NULL)
 	xmlFree(ctxt->incTab);
@@ -1401,9 +1403,14 @@ xmlXIncludeLoadDoc(xmlXIncludeCtxtPtr ctxt, const xmlChar *url, int nr) {
     URL = xmlSaveUri(uri);
     xmlFreeURI(uri);
     if (URL == NULL) {
-	xmlXIncludeErr(ctxt, ctxt->incTab[nr]->ref, 
-	               XML_XINCLUDE_HREF_URI,
-		       "invalid value URI %s\n", url);
+        if (ctxt->incTab != NULL)
+	    xmlXIncludeErr(ctxt, ctxt->incTab[nr]->ref, 
+			   XML_XINCLUDE_HREF_URI,
+			   "invalid value URI %s\n", url);
+	else
+	    xmlXIncludeErr(ctxt, NULL,
+			   XML_XINCLUDE_HREF_URI,
+			   "invalid value URI %s\n", url);
 	if (fragment != NULL)
 	    xmlFree(fragment);
 	return(-1);
@@ -2315,10 +2322,7 @@ xmlXIncludeDoProcess(xmlXIncludeCtxtPtr ctxt, xmlDocPtr doc, xmlNodePtr tree) {
 	if (ret < 0)
 	    return(-1);
     }
-    if (tree)
-	start = ctxt->incNr;
-    else
-        start = ctxt->incBase;
+    start = ctxt->incNr;
 
     /*
      * First phase: lookup the elements in the document
diff --git a/xmlcatalog.c b/xmlcatalog.c
index 0597e888..6f193b17 100644
--- a/xmlcatalog.c
+++ b/xmlcatalog.c
@@ -120,7 +120,10 @@ static void usershell(void) {
 	    command[i++] = *cur++;
 	}
 	command[i] = 0;
-	if (i == 0) continue;
+	if (i == 0) {
+	    free(cmdline);
+	    continue;
+	}
 	nbargs++;
 
 	/*
diff --git a/xmlreader.c b/xmlreader.c
index 0bdf0719..c8bcf7b2 100644
--- a/xmlreader.c
+++ b/xmlreader.c
@@ -1136,7 +1136,7 @@ xmlTextReaderGetSuccessor(xmlNodePtr cur) {
     if (cur->next != NULL) return(cur->next) ;
     do {
         cur = cur->parent;
-        if (cur == NULL) return(NULL);
+        if (cur == NULL) break;
         if (cur->next != NULL) return(cur->next);
     } while (cur != NULL);
     return(cur);
@@ -1469,11 +1469,11 @@ node_found:
 	    return -1;
 	xmlXIncludeProcessNode(reader->xincctxt, reader->node);
     }
-    if (reader->node->type == XML_XINCLUDE_START) {
+    if ((reader->node != NULL) && (reader->node->type == XML_XINCLUDE_START)) {
         reader->in_xinclude++;
 	goto get_next_node;
     } 
-    if (reader->node->type == XML_XINCLUDE_END) {
+    if ((reader->node != NULL) && (reader->node->type == XML_XINCLUDE_END)) {
         reader->in_xinclude--;
 	goto get_next_node;
     }
diff --git a/xmlregexp.c b/xmlregexp.c
index 21091f39..8d7ee97f 100644
--- a/xmlregexp.c
+++ b/xmlregexp.c
@@ -3010,6 +3010,7 @@ xmlFARegExec(xmlRegexpPtr comp, const xmlChar *content) {
 	 * if we are working on a range like "AB{0,2}", where B is not present,
 	 * we don't want to break.
 	 */
+	len = 1;
 	if ((exec->inputString[exec->index] == 0) && (exec->counts == NULL)) {
 	    /*
 	     * if there is a transition, we must check if
@@ -3038,6 +3039,10 @@ xmlFARegExec(xmlRegexpPtr comp, const xmlChar *content) {
 		int count;
 		xmlRegCounterPtr counter;
 
+		if (exec->counts == NULL) {
+		    exec->status = -1;
+		    goto error;
+		}
 		/*
 		 * A counted transition.
 		 */
@@ -3067,6 +3072,10 @@ xmlFARegExec(xmlRegexpPtr comp, const xmlChar *content) {
 		     * before potentially saving and rollback
 		     */
 		    if (trans->counter >= 0) {
+			if (exec->counts == NULL) {
+			    exec->status = -1;
+			    goto error;
+			}
 #ifdef DEBUG_REGEXP_EXEC
 			printf("Increasing count %d\n", trans->counter);
 #endif
@@ -3122,6 +3131,10 @@ xmlFARegExec(xmlRegexpPtr comp, const xmlChar *content) {
 			goto rollback;
 		    }
 		    if (trans->counter >= 0) {
+			if (exec->counts == NULL) {
+			    exec->status = -1;
+			    goto error;
+			}
 #ifdef DEBUG_REGEXP_EXEC
 			printf("Decreasing count %d\n", trans->counter);
 #endif
@@ -3158,6 +3171,10 @@ xmlFARegExec(xmlRegexpPtr comp, const xmlChar *content) {
 		    xmlFARegExecSave(exec);
 		}
 		if (trans->counter >= 0) {
+		    if (exec->counts == NULL) {
+		        exec->status = -1;
+			goto error;
+		    }
 #ifdef DEBUG_REGEXP_EXEC
 		    printf("Increasing count %d\n", trans->counter);
 #endif
@@ -3165,6 +3182,10 @@ xmlFARegExec(xmlRegexpPtr comp, const xmlChar *content) {
 		}
 		if ((trans->count >= 0) &&
 		    (trans->count < REGEXP_ALL_COUNTER)) {
+		    if (exec->counts == NULL) {
+		        exec->status = -1;
+			goto error;
+		    }
 #ifdef DEBUG_REGEXP_EXEC
 		    printf("resetting count %d on transition\n",
 		           trans->count);
@@ -3200,6 +3221,7 @@ rollback:
 progress:
 	continue;
     }
+error:
     if (exec->rollbacks != NULL) {
 	if (exec->counts != NULL) {
 	    int i;
@@ -3606,6 +3628,7 @@ xmlRegExecPushStringInternal(xmlRegExecCtxtPtr exec, const xmlChar *value,
 			}
 			if ((count >= counter->min) &&
 			    (count < counter->max) &&
+			    (t->atom != NULL) &&
 			    (xmlStrEqual(value, t->atom->valuep))) {
 			    ret = 1;
 			    break;
@@ -4035,15 +4058,16 @@ xmlRegExecGetValues(xmlRegExecCtxtPtr exec, int err,
 	        /* this should not be reached but ... */
 	        TODO;
 	    } else if (trans->counter >= 0) {
-		xmlRegCounterPtr counter;
+		xmlRegCounterPtr counter = NULL;
 		int count;
 
 		if (err)
 		    count = exec->errCounts[trans->counter];
 		else
 		    count = exec->counts[trans->counter];
-		counter = &exec->comp->counters[trans->counter];
-		if (count < counter->max) {
+		if (exec->comp != NULL)
+		    counter = &exec->comp->counters[trans->counter];
+		if ((counter == NULL) || (count < counter->max)) {
 		    if (atom->neg)
 			values[nb++] = (xmlChar *) atom->valuep2;
 		    else
@@ -4711,6 +4735,7 @@ xmlFAParseCharRef(xmlRegParserCtxtPtr ctxt) {
 	    ((cur >= 'a') && (cur <= 'f')) ||
 	    ((cur >= 'A') && (cur <= 'F'))) {
 	    while (((cur >= '0') && (cur <= '9')) ||
+	           ((cur >= 'a') && (cur <= 'f')) ||
 		   ((cur >= 'A') && (cur <= 'F'))) {
 		if ((cur >= '0') && (cur <= '9'))
 		    ret = ret * 16 + cur - '0';
@@ -5492,9 +5517,9 @@ xmlAutomataNewTransition2(xmlAutomataPtr am, xmlAutomataStatePtr from,
     if ((am == NULL) || (from == NULL) || (token == NULL))
 	return(NULL);
     atom = xmlRegNewAtom(am, XML_REGEXP_STRING);
-    atom->data = data;
     if (atom == NULL)
 	return(NULL);
+    atom->data = data;
     if ((token2 == NULL) || (*token2 == 0)) {
 	atom->valuep = xmlStrdup(token);
     } else {
@@ -5805,10 +5830,7 @@ xmlAutomataNewOnceTrans2(xmlAutomataPtr am, xmlAutomataStatePtr from,
     }    
     atom->data = data;
     atom->quant = XML_REGEXP_QUANT_ONCEONLY;
-    if (min == 0)
-	atom->min = 1;
-    else
-	atom->min = min;
+    atom->min = min;
     atom->max = max;
     /*
      * associate a counter to the transition.
@@ -5867,10 +5889,7 @@ xmlAutomataNewOnceTrans(xmlAutomataPtr am, xmlAutomataStatePtr from,
     atom->valuep = xmlStrdup(token);
     atom->data = data;
     atom->quant = XML_REGEXP_QUANT_ONCEONLY;
-    if (min == 0)
-	atom->min = 1;
-    else
-	atom->min = min;
+    atom->min = min;
     atom->max = max;
     /*
      * associate a counter to the transition.
@@ -6621,7 +6640,9 @@ xmlExpNewAtom(xmlExpCtxtPtr ctxt, const xmlChar *name, int len) {
  */
 xmlExpNodePtr
 xmlExpNewOr(xmlExpCtxtPtr ctxt, xmlExpNodePtr left, xmlExpNodePtr right) {
-    if ((ctxt == NULL) || (left == NULL) || (right == NULL)) {
+    if (ctxt == NULL)
+        return(NULL);
+    if ((left == NULL) || (right == NULL)) {
         xmlExpFree(ctxt, left);
         xmlExpFree(ctxt, right);
         return(NULL);
@@ -6644,7 +6665,9 @@ xmlExpNewOr(xmlExpCtxtPtr ctxt, xmlExpNodePtr left, xmlExpNodePtr right) {
  */
 xmlExpNodePtr
 xmlExpNewSeq(xmlExpCtxtPtr ctxt, xmlExpNodePtr left, xmlExpNodePtr right) {
-    if ((ctxt == NULL) || (left == NULL) || (right == NULL)) {
+    if (ctxt == NULL)
+        return(NULL);
+    if ((left == NULL) || (right == NULL)) {
         xmlExpFree(ctxt, left);
         xmlExpFree(ctxt, right);
         return(NULL);
@@ -6668,7 +6691,9 @@ xmlExpNewSeq(xmlExpCtxtPtr ctxt, xmlExpNodePtr left, xmlExpNodePtr right) {
  */
 xmlExpNodePtr
 xmlExpNewRange(xmlExpCtxtPtr ctxt, xmlExpNodePtr subset, int min, int max) {
-    if ((ctxt == NULL) || (subset == NULL) || (min < 0) || (max < -1) ||
+    if (ctxt == NULL)
+        return(NULL);
+    if ((subset == NULL) || (min < 0) || (max < -1) ||
         ((max >= 0) && (min > max))) {
 	xmlExpFree(ctxt, subset);
         return(NULL);
diff --git a/xpath.c b/xpath.c
index 8accfa61..481ef216 100644
--- a/xpath.c
+++ b/xpath.c
@@ -292,11 +292,12 @@ xmlXPathErrMemory(xmlXPathContextPtr ctxt, const char *extra)
 static void
 xmlXPathPErrMemory(xmlXPathParserContextPtr ctxt, const char *extra)
 {
-    ctxt->error = XPATH_MEMORY_ERROR;
     if (ctxt == NULL)
 	xmlXPathErrMemory(NULL, extra);
-    else
+    else {
+	ctxt->error = XPATH_MEMORY_ERROR;
 	xmlXPathErrMemory(ctxt->context, extra);
+    }
 }
 
 /**
@@ -1112,10 +1113,6 @@ xmlXPathDebugDumpCompExpr(FILE *output, xmlXPathCompExprPtr comp,
 
     fprintf(output, shift);
 
-    if (comp == NULL) {
-	fprintf(output, "Compiled Expression is NULL\n");
-	return;
-    }
     fprintf(output, "Compiled Expression : %d elements\n",
 	    comp->nbStep);
     i = comp->last;
@@ -1452,9 +1449,11 @@ xmlXPathFormatNumber(double number, char buffer[], int buffersize)
 		/* Use scientific notation */
 		integer_place = DBL_DIG + EXPONENT_DIGITS + 1;
 		fraction_place = DBL_DIG - 1;
-		snprintf(work, sizeof(work),"%*.*e",
+		size = snprintf(work, sizeof(work),"%*.*e",
 			 integer_place, fraction_place, number);
-		after_fraction = strchr(work + DBL_DIG, 'e');
+		while ((size > 0) && (work[size] != 'e')) size--;
+		after_fraction = work + size;
+
 	    }
 	    else {
 		/* Use regular notation */
@@ -3507,7 +3506,8 @@ xmlXPathCastNumberToString (double val) {
 	} else {
 	    /* could be improved */
 	    char buf[100];
-	    xmlXPathFormatNumber(val, buf, 100);
+	    xmlXPathFormatNumber(val, buf, 99);
+	    buf[99] = 0;
 	    ret = xmlStrdup((const xmlChar *) buf);
 	}
     }
@@ -5516,7 +5516,7 @@ xmlXPathNextDescendant(xmlXPathParserContextPtr ctxt, xmlNodePtr cur) {
     
     do {
         cur = cur->parent;
-	if (cur == NULL) return(NULL);
+	if (cur == NULL) break;
 	if (cur == ctxt->context->node) return(NULL);
 	if (cur->next != NULL) {
 	    cur = cur->next;
@@ -5846,7 +5846,7 @@ xmlXPathNextFollowing(xmlXPathParserContextPtr ctxt, xmlNodePtr cur) {
     if (cur->next != NULL) return(cur->next) ;
     do {
         cur = cur->parent;
-        if (cur == NULL) return(NULL);
+        if (cur == NULL) break;
         if (cur == (xmlNodePtr) ctxt->context->doc) return(NULL);
         if (cur->next != NULL) return(cur->next);
     } while (cur != NULL);