thodg/libgit2

diff --git a/src/describe.c b/src/describe.c
index 9b41316..fb39c58 100644
--- a/src/describe.c
+++ b/src/describe.c
@@ -397,7 +397,7 @@ static int show_suffix(
 	const git_oid* id,
 	size_t abbrev_size)
 {
-	int error, size;
+	int error, size = 0;
 
 	char hex_oid[GIT_OID_HEXSZ];
 
@@ -818,7 +818,8 @@ int git_describe_format(git_buf *out, const git_describe_result *result, const g
 	/* If we didn't find *any* tags, we fall back to the commit's id */
 	if (result->fallback_to_id) {
 		char hex_oid[GIT_OID_HEXSZ + 1] = {0};
-		int size;
+		int size = 0;
+
 		if ((error = find_unique_abbrev_size(
 			     &size, repo, &result->commit_id, opts.abbreviated_size)) < 0)
 			return -1;
diff --git a/src/global.c b/src/global.c
index 514b96c..1e6bf82 100644
--- a/src/global.c
+++ b/src/global.c
@@ -63,8 +63,12 @@ void openssl_locking_function(int mode, int n, const char *file, int line)
 		git_mutex_unlock(&openssl_locks[n]);
 	}
 }
-#endif
 
+static void shutdown_ssl(void)
+{
+	git__free(openssl_locks);
+}
+#endif
 
 static void init_ssl(void)
 {
@@ -112,6 +116,8 @@ static void init_ssl(void)
 
 		CRYPTO_set_locking_callback(openssl_locking_function);
 	}
+
+	git__on_shutdown(shutdown_ssl);
 # endif
 #endif
 }
diff --git a/src/mwindow.c b/src/mwindow.c
index 1d64d26..0444cd9 100644
--- a/src/mwindow.c
+++ b/src/mwindow.c
@@ -41,6 +41,8 @@ int git_mwindow_files_init(void)
 	if (git__pack_cache)
 		return 0;
 
+	git__on_shutdown(git_mwindow_files_free);
+
 	return git_strmap_alloc(&git__pack_cache);
 }
 
diff --git a/src/path.c b/src/path.c
index 143c564..effe2ff 100644
--- a/src/path.c
+++ b/src/path.c
@@ -1198,7 +1198,9 @@ int git_path_dirload_with_stat(
 
 			if (error == GIT_ENOTFOUND) {
 				/* file was removed between readdir and lstat */
+				char *entry_path = git_vector_get(contents, i);
 				git_vector_remove(contents, i--);
+				git__free(entry_path);
 			} else {
 				/* Treat the file as unreadable if we get any other error */
 				memset(&ps->st, 0, sizeof(ps->st));
@@ -1215,8 +1217,9 @@ int git_path_dirload_with_stat(
 			ps->path[ps->path_len] = '\0';
 		}
 		else if (!S_ISREG(ps->st.st_mode) && !S_ISLNK(ps->st.st_mode)) {
-			/* skip everything but dirs, plain files, and symlinks */
+			char *entry_path = git_vector_get(contents, i);
 			git_vector_remove(contents, i--);
+			git__free(entry_path);
 		}
 	}
 
diff --git a/src/remote.c b/src/remote.c
index 362c226..4629175 100644
--- a/src/remote.c
+++ b/src/remote.c
@@ -116,9 +116,9 @@ static int get_check_cert(int *out, git_repository *repo)
 
 static int canonicalize_url(git_buf *out, const char *in)
 {
+#ifdef GIT_WIN32
 	const char *c;
 
-#ifdef GIT_WIN32
 	/* Given a UNC path like \\server\path, we need to convert this
 	 * to //server/path for compatibility with core git.
 	 */
@@ -1255,6 +1255,7 @@ static int opportunistic_updates(const git_remote *remote, git_vector *refs, con
 
 		error = git_reference_create(&ref, remote->repo, refname.ptr, &head->oid, true, sig, msg);
 		git_buf_free(&refname);
+		git_reference_free(ref);
 
 		if (error < 0)
 			return error;
diff --git a/src/thread-utils.h b/src/thread-utils.h
index 8deedce..dd1136c 100644
--- a/src/thread-utils.h
+++ b/src/thread-utils.h
@@ -183,8 +183,10 @@ GIT_INLINE(int64_t) git_atomic64_add(git_atomic64 *a, int64_t addend)
 
 /* Pthreads Mutex */
 #define git_mutex unsigned int
-static int git_mutex_init(git_mutex* mutex) { GIT_UNUSED(mutex); return 0; }
-static int git_mutex_lock(git_mutex* mutex) { GIT_UNUSED(mutex); return 0; }
+GIT_INLINE(int) git_mutex_init(git_mutex *mutex) \
+	{ GIT_UNUSED(mutex); return 0; }
+GIT_INLINE(int) git_mutex_lock(git_mutex *mutex) \
+	{ GIT_UNUSED(mutex); return 0; }
 #define git_mutex_unlock(a) (void)0
 #define git_mutex_free(a) (void)0
 
diff --git a/src/transaction.c b/src/transaction.c
index ebb943c..1a4fffb 100644
--- a/src/transaction.c
+++ b/src/transaction.c
@@ -274,7 +274,7 @@ static int update_target(git_refdb *db, transaction_node *node)
 	} else if (node->ref_type == GIT_REF_SYMBOLIC) {
 		ref = git_reference__alloc_symbolic(node->name, node->target.symbolic);
 	} else {
-		assert(0);
+		abort();
 	}
 
 	GITERR_CHECK_ALLOC(ref);
@@ -287,7 +287,7 @@ static int update_target(git_refdb *db, transaction_node *node)
 	} else if (node->ref_type == GIT_REF_SYMBOLIC) {
 		error = git_refdb_unlock(db, node->payload, true, update_reflog, ref, node->sig, node->message);
 	} else {
-		assert(0);
+		abort();
 	}
 
 	git_reference_free(ref);
@@ -300,7 +300,7 @@ int git_transaction_commit(git_transaction *tx)
 {
 	transaction_node *node;
 	git_strmap_iter pos;
-	int error;
+	int error = 0;
 
 	assert(tx);
 
diff --git a/src/transports/http.c b/src/transports/http.c
index bcfeaee..4070b68 100644
--- a/src/transports/http.c
+++ b/src/transports/http.c
@@ -552,7 +552,7 @@ static int http_connect(http_subtransport *t)
 #ifdef GIT_SSL
 	if ((!error || error == GIT_ECERTIFICATE) && t->owner->certificate_check_cb != NULL) {
                 X509 *cert = SSL_get_peer_certificate(t->socket.ssl.ssl);
-		git_cert_x509 cert_info;
+		git_cert_x509 cert_info, *cert_info_ptr;
                 int len, is_valid;
 		unsigned char *guard, *encoded_cert;
 
@@ -581,7 +581,10 @@ static int http_connect(http_subtransport *t)
 		cert_info.cert_type = GIT_CERT_X509;
 		cert_info.data = encoded_cert;
 		cert_info.len = len;
-		error = t->owner->certificate_check_cb((git_cert *) &cert_info, is_valid, t->connection_data.host, t->owner->message_cb_payload);
+
+		cert_info_ptr = &cert_info;
+
+		error = t->owner->certificate_check_cb((git_cert *) cert_info_ptr, is_valid, t->connection_data.host, t->owner->message_cb_payload);
 		git__free(encoded_cert);
 
 		if (error < 0) {
diff --git a/src/transports/ssh.c b/src/transports/ssh.c
index 3868a52..1f6716f 100644
--- a/src/transports/ssh.c
+++ b/src/transports/ssh.c
@@ -457,30 +457,34 @@ static int _git_ssh_setup_conn(
 	LIBSSH2_SESSION* session=NULL;
 	LIBSSH2_CHANNEL* channel=NULL;
 
+	t->current_stream = NULL;
+
 	*stream = NULL;
 	if (ssh_stream_alloc(t, url, cmd, stream) < 0)
 		return -1;
 
 	s = (ssh_stream *)*stream;
+	s->session = NULL;
+	s->channel = NULL;
 
 	if (!git__prefixcmp(url, prefix_ssh)) {
 		if ((error = gitno_extract_url_parts(&host, &port, &path, &user, &pass, url, default_port)) < 0)
-			goto on_error;
+			goto done;
 	} else {
 		if ((error = git_ssh_extract_url_parts(&host, &user, url)) < 0)
-			goto on_error;
+			goto done;
 		port = git__strdup(default_port);
 		GITERR_CHECK_ALLOC(port);
 	}
 
 	if ((error = gitno_connect(&s->socket, host, port, 0)) < 0)
-		goto on_error;
+		goto done;
 
 	if ((error = _git_ssh_session_create(&session, s->socket)) < 0)
-		goto on_error;
+		goto done;
 
 	if (t->owner->certificate_check_cb != NULL) {
-		git_cert_hostkey cert = { 0 };
+		git_cert_hostkey cert = { 0 }, *cert_ptr;
 		const char *key;
 
 		cert.cert_type = GIT_CERT_HOSTKEY_LIBSSH2;
@@ -499,37 +503,41 @@ static int _git_ssh_setup_conn(
 
 		if (cert.type == 0) {
 			giterr_set(GITERR_SSH, "unable to get the host key");
-			return -1;
+			error = -1;
+			goto done;
 		}
 
 		/* We don't currently trust any hostkeys */
 		giterr_clear();
-		error = t->owner->certificate_check_cb((git_cert *) &cert, 0, host, t->owner->message_cb_payload);
+
+		cert_ptr = &cert;
+
+		error = t->owner->certificate_check_cb((git_cert *) cert_ptr, 0, host, t->owner->message_cb_payload);
 		if (error < 0) {
 			if (!giterr_last())
 				giterr_set(GITERR_NET, "user cancelled hostkey check");
 
-			goto on_error;
+			goto done;
 		}
-        }
+	}
 
 	/* we need the username to ask for auth methods */
 	if (!user) {
 		if ((error = request_creds(&cred, t, NULL, GIT_CREDTYPE_USERNAME)) < 0)
-			goto on_error;
+			goto done;
 
 		user = git__strdup(((git_cred_username *) cred)->username);
 		cred->free(cred);
 		cred = NULL;
 		if (!user)
-			goto on_error;
+			goto done;
 	} else if (user && pass) {
 		if ((error = git_cred_userpass_plaintext_new(&cred, user, pass)) < 0)
-			goto on_error;
+			goto done;
 	}
 
 	if ((error = list_auth_methods(&auth_methods, session, user)) < 0)
-		goto on_error;
+		goto done;
 
 	error = GIT_EAUTH;
 	/* if we already have something to try */
@@ -543,25 +551,25 @@ static int _git_ssh_setup_conn(
 		}
 
 		if ((error = request_creds(&cred, t, user, auth_methods)) < 0)
-			goto on_error;
+			goto done;
 
 		if (strcmp(user, git_cred__username(cred))) {
 			giterr_set(GITERR_SSH, "username does not match previous request");
 			error = -1;
-			goto on_error;
+			goto done;
 		}
 
 		error = _git_ssh_authenticate_session(session, cred);
 	}
 
 	if (error < 0)
-		goto on_error;
+		goto done;
 
 	channel = libssh2_channel_open_session(session);
 	if (!channel) {
 		error = -1;
 		ssh_error(session, "Failed to open SSH channel");
-		goto on_error;
+		goto done;
 	}
 
 	libssh2_channel_set_blocking(channel, 1);
@@ -570,36 +578,25 @@ static int _git_ssh_setup_conn(
 	s->channel = channel;
 
 	t->current_stream = s;
-	if (cred)
-		cred->free(cred);
 
-	git__free(host);
-	git__free(port);
-	git__free(path);
-	git__free(user);
-	git__free(pass);
-
-	return 0;
-
-on_error:
-	s->session = NULL;
-	s->channel = NULL;
-	t->current_stream = NULL;
+done:
+	if (error < 0) {
+		if (*stream)
+			ssh_stream_free(*stream);
 
-	if (*stream)
-		ssh_stream_free(*stream);
+		if (session)
+			libssh2_session_free(session);
+	}
 
 	if (cred)
 		cred->free(cred);
 
 	git__free(host);
 	git__free(port);
+	git__free(path);
 	git__free(user);
 	git__free(pass);
 
-	if (session)
-		libssh2_session_free(session);
-
 	return error;
 }
 
diff --git a/tests/clone/local.c b/tests/clone/local.c
index fec3be5..f14b33c 100644
--- a/tests/clone/local.c
+++ b/tests/clone/local.c
@@ -26,7 +26,7 @@ static int git_style_unc_path(git_buf *buf, const char *host, const char *path)
 	if (path[0] == '/')
 		path++;
 
-	if (isalpha(path[0]) && path[1] == ':' && path[2] == '/') {
+	if (git__isalpha(path[0]) && path[1] == ':' && path[2] == '/') {
 		git_buf_printf(buf, "%c$/", path[0]);
 		path += 3;
 	}
diff --git a/tests/config/snapshot.c b/tests/config/snapshot.c
index e47e252..3ea07c1 100644
--- a/tests/config/snapshot.c
+++ b/tests/config/snapshot.c
@@ -37,6 +37,7 @@ void test_config_snapshot__create_snapshot(void)
 	cl_git_pass(git_config_get_int32(&tmp, snapshot, "old.value"));
 	cl_assert_equal_i(5, tmp);
 	
+	git_config_free(new_snapshot);
 	git_config_free(snapshot);
 	git_config_free(cfg);
 }
diff --git a/tests/index/cache.c b/tests/index/cache.c
index de5cd83..3982bf1 100644
--- a/tests/index/cache.c
+++ b/tests/index/cache.c
@@ -170,6 +170,8 @@ void test_index_cache__two_levels(void)
 	tree_cache = git_tree_cache_get(index->tree, "subdir");
 	cl_assert(tree_cache);
 	cl_assert_equal_i(1, tree_cache->entry_count);
+
+	git_index_free(index);
 }
 
 void test_index_cache__read_tree_children(void)
diff --git a/tests/revwalk/mergebase.c b/tests/revwalk/mergebase.c
index fa974eb..aafe97d 100644
--- a/tests/revwalk/mergebase.c
+++ b/tests/revwalk/mergebase.c
@@ -171,6 +171,7 @@ void test_revwalk_mergebase__multiple_merge_bases_many_commits(void)
 	cl_assert_equal_oid(&expected2, &result.ids[1]);
 
 	git_oidarray_free(&result);
+	git__free(input);
 }
 
 void test_revwalk_mergebase__no_off_by_one_missing(void)
diff --git a/tests/submodule/repository_init.c b/tests/submodule/repository_init.c
index 24b47af..e9733a6 100644
--- a/tests/submodule/repository_init.c
+++ b/tests/submodule/repository_init.c
@@ -35,6 +35,7 @@ void test_submodule_repository_init__basic(void)
 	cl_assert(git_path_isfile("submod2/.git/modules/" "sm_gitmodules_only" "/HEAD"));
 
 	git_config_free(cfg);
+	git_submodule_free(sm);
 	git_repository_free(repo);
 	git_buf_free(&dot_git_content);
 }