diff --git a/ccan/README b/ccan/README
index 17f9a28d1..24ee7eb0c 100644
--- a/ccan/README
+++ b/ccan/README
@@ -1,3 +1,3 @@
 CCAN imported from http://ccodearchive.net.
 
-CCAN version: init-2549-gba79e21b
+CCAN version: init-2565-g3942778b
diff --git a/ccan/ccan/bitops/test/run.c b/ccan/ccan/bitops/test/run.c
index 5dba932d4..6bb3acf50 100644
--- a/ccan/ccan/bitops/test/run.c
+++ b/ccan/ccan/bitops/test/run.c
@@ -10,7 +10,7 @@ int main(void)
 	plan_tests(68 + 6 * (31 + 63));
 
 	for (i = 0; i < 32; i++)
-		ok1(bitops_ffs32(1 << i) == i+1);
+		ok1(bitops_ffs32(1U << i) == i+1);
 	ok1(bitops_ffs32(0) == 0);
 	for (i = 0; i < 64; i++)
 		ok1(bitops_ffs64((uint64_t)1 << i) == i+1);
@@ -25,19 +25,19 @@ int main(void)
 	ok1(bitops_ffs64(0) == 0);
 
 	for (i = 0; i < 32; i++)
-		ok1(bitops_clz32(1 << i) == 31 - i);
+		ok1(bitops_clz32(1U << i) == 31 - i);
 	for (i = 0; i < 64; i++)
 		ok1(bitops_clz64((uint64_t)1 << i) == 63 - i);
 
 	/* Lower bits don't effect results */
 	for (i = 0; i < 32; i++)
-		ok1(bitops_clz32((1 << i) + (1 << i)-1) == 31 - i);
+		ok1(bitops_clz32((1U << i) + (1U << i)-1) == 31 - i);
 	for (i = 0; i < 64; i++)
 		ok1(bitops_clz64(((uint64_t)1 << i) + ((uint64_t)1 << i)-1)
 		    == 63 - i);
 
 	for (i = 0; i < 32; i++)
-		ok1(bitops_ctz32(1 << i) == i);
+		ok1(bitops_ctz32(1U << i) == i);
 	for (i = 0; i < 64; i++)
 		ok1(bitops_ctz64((uint64_t)1 << i) == i);
 
diff --git a/ccan/ccan/crypto/hmac_sha256/hmac_sha256.c b/ccan/ccan/crypto/hmac_sha256/hmac_sha256.c
index 0392afe5c..2238f9dc8 100644
--- a/ccan/ccan/crypto/hmac_sha256/hmac_sha256.c
+++ b/ccan/ccan/crypto/hmac_sha256/hmac_sha256.c
@@ -35,7 +35,8 @@ void hmac_sha256_init(struct hmac_sha256_ctx *ctx,
 	 *  (e.g., if K is of length 20 bytes and B=64, then K will be
 	 *   appended with 44 zero bytes 0x00)
 	 */
-	memcpy(k_ipad, k, ksize);
+	if (ksize != 0)
+		memcpy(k_ipad, k, ksize);
 	memset((char *)k_ipad + ksize, 0, HMAC_SHA256_BLOCKSIZE - ksize);
 
 	/*
diff --git a/ccan/ccan/htable/htable_type.h b/ccan/ccan/htable/htable_type.h
index bb5ea086b..0aacb7f33 100644
--- a/ccan/ccan/htable/htable_type.h
+++ b/ccan/ccan/htable/htable_type.h
@@ -159,8 +159,7 @@
 						size_t seed,		\
 						struct name##_iter *iter) \
 	{								\
-		/* Note &iter->i == NULL iff iter is NULL */		\
-		return htable_pick(&ht->raw, seed, &iter->i);			\
+		return htable_pick(&ht->raw, seed, iter ? &iter->i : NULL); \
 	}								\
 	static inline UNNEEDED type *name##_first(const struct name *ht, \
 					 struct name##_iter *iter)	\
diff --git a/ccan/ccan/ilog/ilog.h b/ccan/ccan/ilog/ilog.h
index 9adbb8243..32702b178 100644
--- a/ccan/ccan/ilog/ilog.h
+++ b/ccan/ccan/ilog/ilog.h
@@ -120,7 +120,10 @@ int ilog64_nz(uint64_t _v) CONST_FUNCTION;
 #endif
 
 #ifdef builtin_ilog32_nz
-#define ilog32(_v) (builtin_ilog32_nz(_v)&-!!(_v))
+/* This used to be builtin_ilog32_nz(_v)&-!!(_v), which means it zeroes out
+ * the undefined builtin_ilog32_nz(0) return.  But clang UndefinedBehaviorSantizer
+ * complains, so do the branch: */
+#define ilog32(_v) ((_v) ? builtin_ilog32_nz(_v) : 0)
 #define ilog32_nz(_v) builtin_ilog32_nz(_v)
 #else
 #define ilog32_nz(_v) ilog32(_v)
@@ -128,7 +131,7 @@ int ilog64_nz(uint64_t _v) CONST_FUNCTION;
 #endif /* builtin_ilog32_nz */
 
 #ifdef builtin_ilog64_nz
-#define ilog64(_v) (builtin_ilog64_nz(_v)&-!!(_v))
+#define ilog32(_v) ((_v) ? builtin_ilog32_nz(_v) : 0)
 #define ilog64_nz(_v) builtin_ilog64_nz(_v)
 #else
 #define ilog64_nz(_v) ilog64(_v)
diff --git a/ccan/ccan/io/fdpass/_info b/ccan/ccan/io/fdpass/_info
index ba09025aa..0b10e8a8b 100644
--- a/ccan/ccan/io/fdpass/_info
+++ b/ccan/ccan/io/fdpass/_info
@@ -32,12 +32,20 @@
  *					read_more, buf);
  *	}
  *
+ *	// Clean up allocation so -fsanitize=address doesn't see leak!
+ *	static void free_buf(struct io_conn *c, struct buf *buf)
+ *	{
+ *		free(buf);
+ *	}
+ *
  *	// Child has received fd, start reading loop.
  *	static struct io_plan *got_infd(struct io_conn *conn, int *infd)
  *	{
  *		struct buf *buf = calloc(1, sizeof(*buf));
+ *		struct io_conn *new_conn;
  *
- *		io_new_conn(NULL, *infd, read_more, buf);
+ *		new_conn = io_new_conn(NULL, *infd, read_more, buf);
+ *		io_set_finish(new_conn, free_buf, buf);
  *		return io_close(conn);
  *	}
  *	// Child is receiving the fd to read into. 
diff --git a/ccan/ccan/mem/mem.h b/ccan/ccan/mem/mem.h
index 19f69c038..20286dcbe 100644
--- a/ccan/ccan/mem/mem.h
+++ b/ccan/ccan/mem/mem.h
@@ -104,7 +104,7 @@ void *memcchr(void const *data, int c, size_t data_len);
 PURE_FUNCTION
 static inline bool memeq(const void *a, size_t al, const void *b, size_t bl)
 {
-	return al == bl && !memcmp(a, b, bl);
+	return al == bl && (al == 0 || !memcmp(a, b, bl));
 }
 
 /**
diff --git a/ccan/ccan/membuf/_info b/ccan/ccan/membuf/_info
index bdcbce2b2..a859318c6 100644
--- a/ccan/ccan/membuf/_info
+++ b/ccan/ccan/membuf/_info
@@ -26,13 +26,16 @@
  *
  *	membuf_init(&charbuf, malloc(10), 10, membuf_realloc);
  *
- *	for (int i = 1; i < argc; i++)
- *		strcpy(membuf_add(&charbuf, strlen(argv[i])), argv[i]);
+ *	for (int i = 1; i < argc; i++) {
+ *		size_t len = strlen(argv[i]);
+ *		memcpy(membuf_add(&charbuf, len), argv[i], len);
+ *	}
  *
  *	// This is dumb, we could do all at once, but shows technique.
  *	while (membuf_num_elems(&charbuf) > 0)
  *		printf("%c", *(char *)membuf_consume(&charbuf, 1));
  *	printf("\n");
+ *	free(membuf_cleanup(&charbuf));
  *	return 0;
  * }
  */
diff --git a/ccan/ccan/opt/test/run-set_alloc.c b/ccan/ccan/opt/test/run-set_alloc.c
index 1dbb351be..2d7410ae2 100644
--- a/ccan/ccan/opt/test/run-set_alloc.c
+++ b/ccan/ccan/opt/test/run-set_alloc.c
@@ -59,8 +59,8 @@ static void *reallocfn(void *ptr, size_t size)
 static void freefn(void *ptr)
 {
 	free_count++;
-	free(ptr);
 	*find_ptr(ptr) = NULL;
+	free(ptr);
 }
 
 int main(int argc, char *argv[])
diff --git a/ccan/ccan/opt/usage.c b/ccan/ccan/opt/usage.c
index 12f44a487..8ee4ebd03 100644
--- a/ccan/ccan/opt/usage.c
+++ b/ccan/ccan/opt/usage.c
@@ -72,7 +72,8 @@ static size_t consume_words(const char *words, size_t maxlen, size_t *prefix,
 		}
 	}
 
-	*start = (words[oldlen - 1] == '\n');
+	if (oldlen != 0)
+		*start = (words[oldlen - 1] == '\n');
 	return oldlen;
 }
 
diff --git a/ccan/ccan/rbuf/rbuf.c b/ccan/ccan/rbuf/rbuf.c
index d8d658d37..cc10cf3d7 100644
--- a/ccan/ccan/rbuf/rbuf.c
+++ b/ccan/ccan/rbuf/rbuf.c
@@ -74,9 +74,11 @@ char *rbuf_read_str(struct rbuf *rbuf, char term)
 	ssize_t r = 0;
 	size_t prev = 0;
 
-	while (!(p = memchr(membuf_elems(&rbuf->m) + prev,
-			    term,
-			    membuf_num_elems(&rbuf->m) - prev))) {
+	/* memchr(NULL, ..., 0) is illegal.  FML. */
+	while (membuf_num_elems(&rbuf->m) == prev
+	       || !(p = memchr(membuf_elems(&rbuf->m) + prev,
+			       term,
+			       membuf_num_elems(&rbuf->m) - prev))) {
 		prev += r;
 		r = get_more(rbuf);
 		if (r < 0)
diff --git a/ccan/ccan/tal/tal.c b/ccan/ccan/tal/tal.c
index 2d05dd93f..1230d8cac 100644
--- a/ccan/ccan/tal/tal.c
+++ b/ccan/ccan/tal/tal.c
@@ -28,7 +28,8 @@ enum prop_type {
 
 struct tal_hdr {
 	struct list_node list;
-	struct prop_hdr *prop;
+	/* Use is_prop_hdr tell if this is a struct prop_hdr or string! */
+	char *prop;
 	/* XOR with TAL_PTR_OBFUSTICATOR */
 	intptr_t parent_child;
 	size_t bytelen;
@@ -36,7 +37,8 @@ struct tal_hdr {
 
 struct prop_hdr {
 	enum prop_type type;
-	struct prop_hdr *next;
+	/* Use is_prop_hdr to tell if this is a struct prop_hdr or string! */
+	char *next;
 };
 
 struct children {
@@ -72,7 +74,7 @@ static struct {
 	struct tal_hdr hdr;
 	struct children c;
 } null_parent = { { { &null_parent.hdr.list, &null_parent.hdr.list },
-		    &null_parent.c.hdr, TAL_PTR_OBFUSTICATOR, 0 },
+		(char *)&null_parent.c.hdr, TAL_PTR_OBFUSTICATOR, 0 },
 		  { { CHILDREN, NULL },
 		    &null_parent.hdr,
 		    { { &null_parent.c.children.n,
@@ -123,9 +125,11 @@ void tal_cleanup(void)
 }
 
 /* We carefully start all real properties with a zero byte. */
-static bool is_literal(const struct prop_hdr *prop)
+static struct prop_hdr *is_prop_hdr(const char *ptr)
 {
-	return ((char *)prop)[0] != 0;
+	if (*ptr != 0)
+		return NULL;
+	return (struct prop_hdr *)ptr;
 }
 
 #ifndef NDEBUG
@@ -174,8 +178,11 @@ static struct tal_hdr *to_tal_hdr(const void *ctx)
 	check_bounds(ignore_destroying_bit(t->parent_child));
 	check_bounds(t->list.next);
 	check_bounds(t->list.prev);
-	if (t->prop && !is_literal(t->prop))
-		check_bounds(t->prop);
+	if (t->prop) {
+		struct prop_hdr *p = is_prop_hdr(t->prop);
+		if (p)
+			check_bounds(p);
+	}
 	return t;
 }
 
@@ -215,13 +222,12 @@ static void notify(const struct tal_hdr *ctx,
 		   enum tal_notify_type type, const void *info,
 		   int saved_errno)
 {
-        const struct prop_hdr *p;
+        const char *ptr;
+	const struct prop_hdr *p;
 
-        for (p = ctx->prop; p; p = p->next) {
+        for (ptr = ctx->prop; ptr && (p = is_prop_hdr(ptr)) != NULL; ptr = p->next) {
 		struct notifier *n;
 
-                if (is_literal(p))
-			break;
                 if (p->type != NOTIFIER)
 			continue;
 		n = (struct notifier *)p;
@@ -255,29 +261,54 @@ static void *allocate(size_t size)
 	return ret;
 }
 
-static struct prop_hdr **find_property_ptr(const struct tal_hdr *t,
-					   enum prop_type type)
+/* Returns a pointer to the pointer: can cast (*ret) to a (struct prop_ptr *) */
+static char **find_property_ptr(struct tal_hdr *t, enum prop_type type)
 {
-        struct prop_hdr **p;
+	char **ptr;
+        struct prop_hdr *p;
 
-        for (p = (struct prop_hdr **)&t->prop; *p; p = &(*p)->next) {
-                if (is_literal(*p)) {
-                        if (type == NAME)
-                                return p;
-                        break;
-                }
-                if ((*p)->type == type)
-                        return p;
-        }
-        return NULL;
+	/* NAME is special, as it can be a literal: see find_name_property */
+	assert(type != NAME);
+	for (ptr = &t->prop; *ptr; ptr = &p->next) {
+		if (!is_prop_hdr(*ptr))
+			break;
+		p = (struct prop_hdr *)*ptr;
+                if (p->type == type)
+                        return ptr;
+	}
+	return NULL;
 }
 
-static void *find_property(const struct tal_hdr *parent, enum prop_type type)
+/* This is special:
+ * NULL - not found
+ * *literal: true - char **, pointer to literal pointer.
+ * *literal: false - struct prop_hdr **, pointer to header ptr.
+ */
+static char **find_name_property(struct tal_hdr *t, bool *literal)
 {
-        struct prop_hdr **p = find_property_ptr(parent, type);
+	char **ptr;
+        struct prop_hdr *p;
 
-        if (p)
-                return *p;
+	for (ptr = &t->prop; *ptr; ptr = &p->next) {
+		if (!is_prop_hdr(*ptr)) {
+			*literal = true;
+			return ptr;
+		}
+		p = (struct prop_hdr *)*ptr;
+                if (p->type == NAME) {
+			*literal = false;
+                        return ptr;
+		}
+	}
+	return NULL;
+}
+
+static void *find_property(struct tal_hdr *parent, enum prop_type type)
+{
+        char **ptr = find_property_ptr(parent, type);
+
+        if (ptr)
+                return (struct prop_hdr *)*ptr;
         return NULL;
 }
 
@@ -287,7 +318,7 @@ static void init_property(struct prop_hdr *hdr,
 {
 	hdr->type = type;
 	hdr->next = parent->prop;
-	parent->prop = hdr;
+	parent->prop = (char *)hdr;
 }
 
 static struct notifier *add_notifier_property(struct tal_hdr *t,
@@ -321,17 +352,20 @@ static enum tal_notify_type del_notifier_property(struct tal_hdr *t,
 						  bool match_extra_arg,
 						  void *extra_arg)
 {
-        struct prop_hdr **p;
+	char **ptr;
+	struct prop_hdr *p;
 
-        for (p = (struct prop_hdr **)&t->prop; *p; p = &(*p)->next) {
+	for (ptr = &t->prop; *ptr; ptr = &p->next) {
 		struct notifier *n;
 		enum tal_notify_type types;
 
-                if (is_literal(*p))
+		p = is_prop_hdr(*ptr);
+		if (!p)
 			break;
-                if ((*p)->type != NOTIFIER)
+
+                if (p->type != NOTIFIER)
 			continue;
-		n = (struct notifier *)*p;
+		n = (struct notifier *)p;
 		if (n->u.notifyfn != fn)
 			continue;
 
@@ -341,8 +375,8 @@ static enum tal_notify_type del_notifier_property(struct tal_hdr *t,
 		    && extra_arg != EXTRA_ARG(n))
 			continue;
 
-		*p = (*p)->next;
-		freefn(n);
+		*ptr = p->next;
+		freefn(p);
 		return types & ~(NOTIFY_IS_DESTRUCTOR|NOTIFY_EXTRA_ARG);
         }
         return 0;
@@ -388,7 +422,8 @@ static bool add_child(struct tal_hdr *parent, struct tal_hdr *child)
 
 static void del_tree(struct tal_hdr *t, const tal_t *orig, int saved_errno)
 {
-	struct prop_hdr **prop, *p, *next;
+	struct prop_hdr *prop;
+	char *ptr, *next;
 
 	assert(!taken(from_tal_hdr(t)));
 
@@ -402,10 +437,10 @@ static void del_tree(struct tal_hdr *t, const tal_t *orig, int saved_errno)
 	notify(t, TAL_NOTIFY_FREE, (tal_t *)orig, saved_errno);
 
 	/* Now free children and groups. */
-	prop = find_property_ptr(t, CHILDREN);
+	prop = find_property(t, CHILDREN);
 	if (prop) {
 		struct tal_hdr *i;
-		struct children *c = (struct children *)*prop;
+		struct children *c = (struct children *)prop;
 
 		while ((i = list_top(&c->children, struct tal_hdr, list))) {
 			list_del(&i->list);
@@ -414,9 +449,9 @@ static void del_tree(struct tal_hdr *t, const tal_t *orig, int saved_errno)
 	}
 
         /* Finally free our properties. */
-        for (p = t->prop; p && !is_literal(p); p = next) {
-                next = p->next;
-		freefn(p);
+	for (ptr = t->prop; ptr && (prop = is_prop_hdr(ptr)); ptr = next) {
+                next = prop->next;
+		freefn(ptr);
         }
         freefn(t);
 }
@@ -590,25 +625,34 @@ bool tal_del_destructor2_(const tal_t *ctx, void (*destroy)(void *me, void *arg)
 bool tal_set_name_(tal_t *ctx, const char *name, bool literal)
 {
         struct tal_hdr *t = debug_tal(to_tal_hdr(ctx));
-        struct prop_hdr **prop = find_property_ptr(t, NAME);
+	bool was_literal;
+	char **nptr;
 
         /* Get rid of any old name */
-        if (prop) {
-                struct name *oldname = (struct name *)*prop;
-                if (is_literal(&oldname->hdr))
-                        *prop = NULL;
-                else {
-                        *prop = oldname->hdr.next;
+	nptr = find_name_property(t, &was_literal);
+	if (nptr) {
+		if (was_literal)
+			*nptr = NULL;
+		else {
+			struct name *oldname;
+
+			oldname = (struct name *)*nptr;
+			*nptr = oldname->hdr.next;
 			freefn(oldname);
-                }
+		}
         }
 
         if (literal && name[0]) {
-                struct prop_hdr **p;
+		char **ptr;
+		struct prop_hdr *prop;
 
                 /* Append literal. */
-                for (p = &t->prop; *p && !is_literal(*p); p = &(*p)->next);
-                *p = (struct prop_hdr *)name;
+		for (ptr = &t->prop; *ptr; ptr = &prop->next) {
+			prop = is_prop_hdr(*ptr);
+			if (!prop)
+				break;
+		}
+                *ptr = (char *)name;
         } else if (!add_name_property(t, name))
 		return false;
 
@@ -620,15 +664,16 @@ bool tal_set_name_(tal_t *ctx, const char *name, bool literal)
 
 const char *tal_name(const tal_t *t)
 {
-        struct name *n;
+	char **nptr;
+	bool literal;
 
-	n = find_property(debug_tal(to_tal_hdr(t)), NAME);
-	if (!n)
+	nptr = find_name_property(debug_tal(to_tal_hdr(t)), &literal);
+	if (!nptr)
 		return NULL;
+	if (literal)
+		return *nptr;
 
-	if (is_literal(&n->hdr))
-		return (const char *)n;
-	return n->name;
+	return ((struct name *)(*nptr))->name;
 }
 
 size_t tal_bytelen(const tal_t *ptr)
@@ -803,7 +848,7 @@ void *tal_dup_(const tal_t *ctx, const void *p, size_t size,
 	}
 
 	ret = tal_alloc_arr_(ctx, size, n + extra, false, label);
-	if (ret)
+	if (ret && p)
 		memcpy(ret, p, nbytes);
 	return ret;
 }
@@ -832,36 +877,38 @@ void tal_set_backend(void *(*alloc_fn)(size_t size),
 static void dump_node(unsigned int indent, const struct tal_hdr *t)
 {
 	unsigned int i;
-        const struct prop_hdr *p;
+        const struct prop_hdr *prop;
+	const char *ptr;
 
 	for (i = 0; i < indent; i++)
 		fprintf(stderr, "  ");
 	fprintf(stderr, "%p len=%zu", t, t->bytelen);
-        for (p = t->prop; p; p = p->next) {
+        for (ptr = t->prop; ptr; ptr = prop->next) {
 		struct children *c;
 		struct name *n;
 		struct notifier *no;
-                if (is_literal(p)) {
-			fprintf(stderr, " \"%s\"", (const char *)p);
+                prop = is_prop_hdr(ptr);
+		if (!prop) {
+			fprintf(stderr, " \"%s\"", ptr);
 			break;
 		}
-		switch (p->type) {
+		switch (prop->type) {
 		case CHILDREN:
-			c = (struct children *)p;
+			c = (struct children *)prop;
 			fprintf(stderr, " CHILDREN(%p):parent=%p,children={%p,%p}",
-			       p, c->parent,
+			       prop, c->parent,
 			       c->children.n.prev, c->children.n.next);
 			break;
 		case NAME:
-			n = (struct name *)p;
-			fprintf(stderr, " NAME(%p):%s", p, n->name);
+			n = (struct name *)prop;
+			fprintf(stderr, " NAME(%p):%s", prop, n->name);
 			break;
 		case NOTIFIER:
-			no = (struct notifier *)p;
-			fprintf(stderr, " NOTIFIER(%p):fn=%p", p, no->u.notifyfn);
+			no = (struct notifier *)prop;
+			fprintf(stderr, " NOTIFIER(%p):fn=%p", prop, no->u.notifyfn);
 			break;
 		default:
-			fprintf(stderr, " **UNKNOWN(%p):%i**", p, p->type);
+			fprintf(stderr, " **UNKNOWN(%p):%i**", prop, prop->type);
 		}
 	}
 	fprintf(stderr, "\n");
@@ -873,7 +920,7 @@ static void tal_dump_(unsigned int level, const struct tal_hdr *t)
 
 	dump_node(level, t);
 
-	children = find_property(t, CHILDREN);
+	children = find_property((struct tal_hdr *)t, CHILDREN);
 	if (children) {
 		struct tal_hdr *i;
 
@@ -904,7 +951,8 @@ static bool check_err(struct tal_hdr *t, const char *errorstr,
 static bool check_node(struct children *parent_child,
 		       struct tal_hdr *t, const char *errorstr)
 {
-	struct prop_hdr *p;
+	struct prop_hdr *prop;
+	char *p;
 	struct name *name = NULL;
 	struct children *children = NULL;
 
@@ -914,23 +962,24 @@ static bool check_node(struct children *parent_child,
 	if (ignore_destroying_bit(t->parent_child) != parent_child)
 		return check_err(t, errorstr, "incorrect parent");
 
-	for (p = t->prop; p; p = p->next) {
-		if (is_literal(p)) {
+	for (p = t->prop; p; p = prop->next) {
+		prop = is_prop_hdr(p);
+		if (!prop) {
 			if (name)
 				return check_err(t, errorstr,
 						 "has extra literal");
 			break;
 		}
-		if (!in_bounds(p))
+		if (!in_bounds(prop))
 			return check_err(t, errorstr,
 					 "has bad property pointer");
 
-		switch (p->type) {
+		switch (prop->type) {
 		case CHILDREN:
 			if (children)
 				return check_err(t, errorstr,
 						 "has two child nodes");
-			children = (struct children *)p;
+			children = (struct children *)prop;
 			break;
 		case NOTIFIER:
 			break;
@@ -938,7 +987,7 @@ static bool check_node(struct children *parent_child,
 			if (name)
 				return check_err(t, errorstr,
 						 "has two names");
-			name = (struct name *)p;
+			name = (struct name *)prop;
 			break;
 		default:
 			return check_err(t, errorstr, "has unknown property");
diff --git a/ccan/ccan/tal/test/run-notifier.c b/ccan/ccan/tal/test/run-notifier.c
index 150f00ada..47e436408 100644
--- a/ccan/ccan/tal/test/run-notifier.c
+++ b/ccan/ccan/tal/test/run-notifier.c
@@ -13,8 +13,8 @@ static void *my_realloc(void *old, size_t size)
 	void *new = realloc(old, size);
 	if (new == old) {
 		void *p = malloc(size);
-		memcpy(p, old, size);
-		free(old);
+		memcpy(p, new, size);
+		free(new);
 		new = p;
 	}
 	return new;
diff --git a/ccan/ccan/tcon/tcon.h b/ccan/ccan/tcon/tcon.h
index df3aac88b..e0f84b383 100644
--- a/ccan/ccan/tcon/tcon.h
+++ b/ccan/ccan/tcon/tcon.h
@@ -147,7 +147,8 @@
  * It evaluates to @x so you can chain it.
  */
 #define tcon_check_ptr(x, canary, expr)				\
-	(sizeof((expr) ? (expr) : &(x)->_tcon[0].canary) ? (x) : (x))
+	(sizeof(&(x)->_tcon[0].canary == (expr)) ? (x) : (x))
+
 
 /**
  * tcon_type - the type within a container (or void *)
diff --git a/ccan/ccan/tcon/test/compile_fail-container1.c b/ccan/ccan/tcon/test/compile_fail-container1.c
index 44645a7ec..ed1d3e206 100644
--- a/ccan/ccan/tcon/test/compile_fail-container1.c
+++ b/ccan/ccan/tcon/test/compile_fail-container1.c
@@ -25,7 +25,7 @@ struct info_tcon {
 int main(void)
 {
 	struct info_tcon info;
-	struct outer ovar;
+	struct outer ovar = { 0, { 0 } };
 #ifdef FAIL
 #if !HAVE_TYPEOF
 #error We cannot detect type problems without HAVE_TYPEOF
diff --git a/ccan/ccan/tcon/test/compile_fail-container1w.c b/ccan/ccan/tcon/test/compile_fail-container1w.c
index 19ba5bdcc..a03f6514e 100644
--- a/ccan/ccan/tcon/test/compile_fail-container1w.c
+++ b/ccan/ccan/tcon/test/compile_fail-container1w.c
@@ -21,7 +21,7 @@ int main(void)
 {
 	TCON_WRAP(struct info_base,
 		  TCON_CONTAINER(concan, struct outer, inner)) info;
-	struct outer ovar;
+	struct outer ovar = { 0, { 0 } };
 #ifdef FAIL
 #if !HAVE_TYPEOF
 #error We cannot detect type problems without HAVE_TYPEOF
diff --git a/ccan/ccan/tcon/test/compile_fail-container3.c b/ccan/ccan/tcon/test/compile_fail-container3.c
index 9185225a9..dfdfdba9a 100644
--- a/ccan/ccan/tcon/test/compile_fail-container3.c
+++ b/ccan/ccan/tcon/test/compile_fail-container3.c
@@ -25,7 +25,7 @@ struct info_tcon {
 int main(void)
 {
 	struct info_tcon info;
-	struct outer ovar;
+	struct outer ovar = { 0, { 0 } };
 #ifdef FAIL
 #if !HAVE_TYPEOF
 #error We cannot detect type problems without HAVE_TYPEOF
diff --git a/ccan/ccan/tcon/test/compile_fail-container3w.c b/ccan/ccan/tcon/test/compile_fail-container3w.c
index 958e5c8b3..a56e510f1 100644
--- a/ccan/ccan/tcon/test/compile_fail-container3w.c
+++ b/ccan/ccan/tcon/test/compile_fail-container3w.c
@@ -21,7 +21,7 @@ int main(void)
 {
 	TCON_WRAP(struct info_base,
 		  TCON_CONTAINER(concan, struct outer, inner)) info;
-	struct outer ovar;
+	struct outer ovar = { 0, { 0 } };
 #ifdef FAIL
 #if !HAVE_TYPEOF
 #error We cannot detect type problems without HAVE_TYPEOF
diff --git a/ccan/tools/configurator/configurator.c b/ccan/tools/configurator/configurator.c
index f830cbca1..722a6f692 100644
--- a/ccan/tools/configurator/configurator.c
+++ b/ccan/tools/configurator/configurator.c
@@ -197,7 +197,7 @@ static const struct test base_tests[] = {
 	  "return __builtin_clzll(1) == (sizeof(long long)*8 - 1) ? 0 : 1;" },
 	{ "HAVE_BUILTIN_CTZ", "__builtin_ctz support",
 	  "INSIDE_MAIN", NULL, NULL,
-	  "return __builtin_ctz(1 << (sizeof(int)*8 - 1)) == (sizeof(int)*8 - 1) ? 0 : 1;" },
+	  "return __builtin_ctz(1U << (sizeof(int)*8 - 1)) == (sizeof(int)*8 - 1) ? 0 : 1;" },
 	{ "HAVE_BUILTIN_CTZL", "__builtin_ctzl support",
 	  "INSIDE_MAIN", NULL, NULL,
 	  "return __builtin_ctzl(1UL << (sizeof(long)*8 - 1)) == (sizeof(long)*8 - 1) ? 0 : 1;" },