diff --git a/src/session_server_tls.c b/src/session_server_tls.c
index 62b789f..ac30210 100644
--- a/src/session_server_tls.c
+++ b/src/session_server_tls.c
@@ -51,6 +51,11 @@
     ASN1_TIME_print(bio, t);
     n = BIO_pending(bio);
     cp = malloc(n + 1);
+    if (!cp) {
+        ERRMEM;
+        BIO_free(bio);
+        return NULL;
+    }
     n = BIO_read(bio, cp, n);
     if (n < 0) {
         BIO_free(bio);
@@ -68,6 +73,10 @@
     unsigned int i;
 
     *str = malloc(dig_len * 3);
+    if (!*str) {
+        ERRMEM;
+        return;
+    }
     for (i = 0; i < dig_len - 1; ++i) {
         sprintf((*str) + (i * 3), "%02x:", digest[i]);
     }
@@ -194,6 +203,10 @@
             *strchr(common_name, '/') = '\0';
         }
         *username = strdup(common_name);
+        if (!*username) {
+            ERRMEM;
+            return 1;
+        }
         free(subject);
     } else {
         /* retrieve subjectAltName's rfc822Name (email), dNSName and iPAddress values */
@@ -211,6 +224,10 @@
             if ((map_type == NC_TLS_CTN_SAN_ANY || map_type == NC_TLS_CTN_SAN_RFC822_NAME) &&
                     san_name->type == GEN_EMAIL) {
                 *username = strdup((char *)ASN1_STRING_data(san_name->d.rfc822Name));
+                if (!*username) {
+                    ERRMEM;
+                    return 1;
+                }
                 break;
             }
 
@@ -218,6 +235,10 @@
             if ((map_type == NC_TLS_CTN_SAN_ANY || map_type == NC_TLS_CTN_SAN_DNS_NAME) &&
                     san_name->type == GEN_DNS) {
                 *username = strdup((char *)ASN1_STRING_data(san_name->d.dNSName));
+                if (!*username) {
+                    ERRMEM;
+                    return 1;
+                }
                 break;
             }
 
@@ -284,6 +305,11 @@
     int ret = 0;
     struct nc_ctn *ctn;
 
+    if (!buf) {
+        ERRMEM;
+        return -1;
+    }
+
     if (!ctn_first || !cert || !map_type || !name) {
         free(buf);
         return -1;
@@ -1316,6 +1342,10 @@
     }
 
     new = malloc(sizeof *new);
+    if (!new) {
+        ERRMEM;
+        return -1;
+    }
 
     new->fingerprint = lydict_insert(server_opts.ctx, fingerprint, 0);
     new->name = lydict_insert(server_opts.ctx, name, 0);