diff --git a/src/p11_attr.c b/src/p11_attr.c
index 4f19dc36..bcade484 100644
--- a/src/p11_attr.c
+++ b/src/p11_attr.c
@@ -141,7 +141,7 @@ void pkcs11_addattr_bn(PKCS11_TEMPLATE *tmpl, int type, const BIGNUM *bn)
 
 	if (buf && BN_bn2bin(bn, buf) == n) {
 		i = pkcs11_addattr(tmpl, type, buf, n);
-		tmpl->allocated |= 1<<i;
+		tmpl->allocated |= 1UL<<i;
 	}
 }
 
@@ -161,7 +161,7 @@ void pkcs11_addattr_obj(PKCS11_TEMPLATE *tmpl, int type, pkcs11_i2d_fn enc, cons
 
 	enc(obj, &p);
 	i = pkcs11_addattr(tmpl, type, buf, n);
-	tmpl->allocated |= 1<<i;
+	tmpl->allocated |= 1UL<<i;
 }
 
 void pkcs11_zap_attrs(PKCS11_TEMPLATE *tmpl)
@@ -171,7 +171,7 @@ void pkcs11_zap_attrs(PKCS11_TEMPLATE *tmpl)
 	if (!tmpl->allocated)
 		return;
 	for (i = 0; i < 32; i++) {
-		if (tmpl->allocated & (1<<i))
+		if (tmpl->allocated & (1UL<<i))
 			OPENSSL_free(tmpl->attrs[i].pValue);
 	}
 	tmpl->allocated = 0;
diff --git a/src/p11_ec.c b/src/p11_ec.c
index 670db1ab..ce65b3d5 100644
--- a/src/p11_ec.c
+++ b/src/p11_ec.c
@@ -257,7 +257,7 @@ static int pkcs11_get_point_x509(EC_KEY *ec, X509 *x509)
 
 #if OPENSSL_VERSION_NUMBER < 0x10100000L
 #define ASN1_STRING_get0_data(os) ((os)->data)
-#define ASN1_STRING_length(x) ((os)->length)
+#define ASN1_STRING_length(os) ((os)->length)
 #endif
 
 /* Retrieve EC point from key into ec
diff --git a/src/p11_rsa.c b/src/p11_rsa.c
index 4809b256..febc7fea 100644
--- a/src/p11_rsa.c
+++ b/src/p11_rsa.c
@@ -69,7 +69,6 @@ int pkcs11_private_encrypt(int flen,
 {
 	PKCS11_SLOT_private *slot;
 	size_t siglen;
-	CK_SESSION_HANDLE session;
 
 	if (!key)
 		return -1;
@@ -78,11 +77,6 @@ int pkcs11_private_encrypt(int flen,
 	if (!slot)
 		return -1;
 
-	if (pkcs11_session_pool_acquire(slot, 0, &session))
-		return -1;
-
-	pkcs11_session_pool_release(slot, session);
-
 	siglen = pkcs11_get_key_size(key);
 	if (pkcs11_evp_pkey_rsa_sign(key,
 		NULL, /* EVP_PKEY unused: RSA-PSS unsupported in ENGINE path */
@@ -102,7 +96,6 @@ int pkcs11_private_decrypt(int flen,
 {
 	PKCS11_SLOT_private *slot;
 	size_t outlen;
-	CK_SESSION_HANDLE session;
 
 	if (padding != RSA_PKCS1_OAEP_PADDING)
 		return -1; /* unsupported */
@@ -114,11 +107,6 @@ int pkcs11_private_decrypt(int flen,
 	if (!slot)
 		return -1;
 
-	if (pkcs11_session_pool_acquire(slot, 0, &session))
-		return -1;
-
-	pkcs11_session_pool_release(slot, session);
-
 	/* Openssl API for RSA_private_decrypt() allows to use
 	 * RSA_PKCS1_OAEP_PADDING only with SHA_1 hash and and MGF1_SHA1 mask
 	 * gen function.  It is not possible to use RFC8017 "Label" or
diff --git a/src/p11_slot.c b/src/p11_slot.c
index 2050cd66..a0875c6c 100644
--- a/src/p11_slot.c
+++ b/src/p11_slot.c
@@ -502,7 +502,7 @@ int pkcs11_init_token(PKCS11_SLOT_private *slot, const char *pin, const char *la
 
 	rv = CRYPTOKI_call(ctx,
 		C_InitToken(slot->id,
-			(CK_UTF8CHAR *) pin, (unsigned long) strlen(pin),
+			(CK_UTF8CHAR *) pin, pin ? (unsigned long) strlen(pin) : 0,
 			(CK_UTF8CHAR *) ck_label));
 	CRYPTOKI_checkerr(CKR_F_PKCS11_INIT_TOKEN, rv);
 
diff --git a/src/util_uri.c b/src/util_uri.c
index 1a6bc28f..311a2006 100644
--- a/src/util_uri.c
+++ b/src/util_uri.c
@@ -929,6 +929,7 @@ static int util_ctx_parse_uri(UTIL_CTX *ctx, PARSED *parsed,
 			n = parse_pkcs11_uri(ctx, object_uri, &match_tok,
 				parsed->obj_id, &parsed->obj_id_len, tmp_pin, &tmp_pin_len, &parsed->obj_label);
 			if (!n) {
+				OPENSSL_cleanse(tmp_pin, sizeof(tmp_pin));
 				UTIL_CTX_log(ctx, LOG_ERR,
 					"The %s ID is not a valid PKCS#11 URI\n"
 					"The PKCS#11 URI format is defined by RFC7512\n",
@@ -938,9 +939,11 @@ static int util_ctx_parse_uri(UTIL_CTX *ctx, PARSED *parsed,
 			if (tmp_pin_len > 0 && tmp_pin[0] != 0) {
 				tmp_pin[tmp_pin_len] = 0;
 				if (!UTIL_CTX_set_pin(ctx, tmp_pin)) {
+					OPENSSL_cleanse(tmp_pin, sizeof(tmp_pin));
 					goto cleanup;
 				}
 			}
+			OPENSSL_cleanse(tmp_pin, sizeof(tmp_pin));
 		} else {
 			n = parse_slot_id_string(ctx, object_uri, &parsed->slot_nr,
 				parsed->obj_id, &parsed->obj_id_len, &parsed->obj_label);