diff --git a/channels/rdpemsc/server/mouse_cursor_main.c b/channels/rdpemsc/server/mouse_cursor_main.c
index 9713a25ff..649ec8f96 100644
--- a/channels/rdpemsc/server/mouse_cursor_main.c
+++ b/channels/rdpemsc/server/mouse_cursor_main.c
@@ -499,8 +499,11 @@ static wStream* mouse_cursor_server_packet_new(size_t size, RDP_MOUSE_CURSOR_PDU
 		return NULL;
 	}
 
-	Stream_Write_UINT8(s, pduType);
-	Stream_Write_UINT8(s, header->updateType);
+	WINPR_ASSERT(pduType <= UINT8_MAX);
+	Stream_Write_UINT8(s, (BYTE)pduType);
+
+	WINPR_ASSERT(header->updateType <= UINT8_MAX);
+	Stream_Write_UINT8(s, (BYTE)header->updateType);
 	Stream_Write_UINT16(s, header->reserved);
 
 	return s;
diff --git a/libfreerdp/cache/brush.c b/libfreerdp/cache/brush.c
index 94900764c..243ed1d87 100644
--- a/libfreerdp/cache/brush.c
+++ b/libfreerdp/cache/brush.c
@@ -58,19 +58,17 @@ struct rdp_brush_cache
 
 static BOOL update_gdi_patblt(rdpContext* context, PATBLT_ORDER* patblt)
 {
-	BYTE style = 0;
 	BOOL ret = TRUE;
-	rdpBrush* brush = NULL;
-	const rdpCache* cache = NULL;
 
 	WINPR_ASSERT(context);
 	WINPR_ASSERT(patblt);
 
-	cache = context->cache;
+	const rdpCache* cache = context->cache;
 	WINPR_ASSERT(cache);
 
-	brush = &patblt->brush;
-	style = brush->style;
+	rdpBrush* brush = &patblt->brush;
+	WINPR_ASSERT(brush->style <= UINT8_MAX);
+	const BYTE style = (BYTE)brush->style;
 
 	if (brush->style & CACHED_BRUSH)
 	{
@@ -96,19 +94,17 @@ static BOOL update_gdi_polygon_sc(rdpContext* context, const POLYGON_SC_ORDER* p
 
 static BOOL update_gdi_polygon_cb(rdpContext* context, POLYGON_CB_ORDER* polygon_cb)
 {
-	BYTE style = 0;
-	rdpBrush* brush = NULL;
-	rdpCache* cache = NULL;
 	BOOL ret = TRUE;
 
 	WINPR_ASSERT(context);
 	WINPR_ASSERT(polygon_cb);
 
-	cache = context->cache;
+	rdpCache* cache = context->cache;
 	WINPR_ASSERT(cache);
 
-	brush = &polygon_cb->brush;
-	style = brush->style;
+	rdpBrush* brush = &polygon_cb->brush;
+	WINPR_ASSERT(brush->style <= UINT8_MAX);
+	const BYTE style = (UINT8)brush->style;
 
 	if (brush->style & CACHED_BRUSH)
 	{
diff --git a/libfreerdp/core/activation.c b/libfreerdp/core/activation.c
index c518bc008..a9a68ae9e 100644
--- a/libfreerdp/core/activation.c
+++ b/libfreerdp/core/activation.c
@@ -273,11 +273,9 @@ static BOOL rdp_write_client_persistent_key_list_pdu(wStream* s,
 	return TRUE;
 }
 
-static UINT32 rdp_load_persistent_key_list(rdpRdp* rdp, UINT64** pKeyList)
+static UINT16 rdp_load_persistent_key_list(rdpRdp* rdp, UINT64** pKeyList)
 {
-	int count = 0;
-	int status = 0;
-	UINT32 keyCount = 0;
+	UINT16 keyCount = 0;
 	UINT64* keyList = NULL;
 	rdpPersistentCache* persistent = NULL;
 	rdpSettings* settings = rdp->settings;
@@ -295,14 +293,17 @@ static UINT32 rdp_load_persistent_key_list(rdpRdp* rdp, UINT64** pKeyList)
 	if (!persistent)
 		return 0;
 
-	status = persistent_cache_open(persistent, settings->BitmapCachePersistFile, FALSE, 0);
+	const int status =
+	    persistent_cache_open(persistent, settings->BitmapCachePersistFile, FALSE, 0);
 
 	if (status < 1)
 		goto error;
 
-	count = persistent_cache_get_count(persistent);
+	const int count = persistent_cache_get_count(persistent);
+	if ((count < 0) || (count > UINT16_MAX))
+		goto error;
 
-	keyCount = (UINT32)count;
+	keyCount = (UINT16)count;
 	keyList = (UINT64*)calloc(keyCount, sizeof(UINT64));
 
 	if (!keyList)
@@ -348,11 +349,20 @@ BOOL rdp_send_client_persistent_key_list_pdu(rdpRdp* rdp)
 	if (keyCount > keyMaxFrag)
 		keyCount = keyMaxFrag;
 
-	info.totalEntriesCache0 = settings->BitmapCacheV2CellInfo[0].numEntries;
-	info.totalEntriesCache1 = settings->BitmapCacheV2CellInfo[1].numEntries;
-	info.totalEntriesCache2 = settings->BitmapCacheV2CellInfo[2].numEntries;
-	info.totalEntriesCache3 = settings->BitmapCacheV2CellInfo[3].numEntries;
-	info.totalEntriesCache4 = settings->BitmapCacheV2CellInfo[4].numEntries;
+	WINPR_ASSERT(settings->BitmapCacheV2CellInfo[0].numEntries <= UINT16_MAX);
+	info.totalEntriesCache0 = (UINT16)settings->BitmapCacheV2CellInfo[0].numEntries;
+
+	WINPR_ASSERT(settings->BitmapCacheV2CellInfo[1].numEntries <= UINT16_MAX);
+	info.totalEntriesCache1 = (UINT16)settings->BitmapCacheV2CellInfo[1].numEntries;
+
+	WINPR_ASSERT(settings->BitmapCacheV2CellInfo[2].numEntries <= UINT16_MAX);
+	info.totalEntriesCache2 = (UINT16)settings->BitmapCacheV2CellInfo[2].numEntries;
+
+	WINPR_ASSERT(settings->BitmapCacheV2CellInfo[3].numEntries <= UINT16_MAX);
+	info.totalEntriesCache3 = (UINT16)settings->BitmapCacheV2CellInfo[3].numEntries;
+
+	WINPR_ASSERT(settings->BitmapCacheV2CellInfo[4].numEntries <= UINT16_MAX);
+	info.totalEntriesCache4 = (UINT16)settings->BitmapCacheV2CellInfo[4].numEntries;
 
 	info.numEntriesCache0 = MIN(keyCount, info.totalEntriesCache0);
 	keyCount -= info.numEntriesCache0;
diff --git a/libfreerdp/core/autodetect.c b/libfreerdp/core/autodetect.c
index a9bd64e44..2b741d7bd 100644
--- a/libfreerdp/core/autodetect.c
+++ b/libfreerdp/core/autodetect.c
@@ -376,7 +376,9 @@ static BOOL autodetect_send_netchar_result(rdpAutoDetect* autodetect, RDP_TRANSP
 			Stream_Write_UINT8(s, 0x0E);                       /* headerLength (1 byte) */
 			Stream_Write_UINT8(s, TYPE_ID_AUTODETECT_REQUEST); /* headerTypeId (1 byte) */
 			Stream_Write_UINT16(s, sequenceNumber);            /* sequenceNumber (2 bytes) */
-			Stream_Write_UINT16(s, result->type);              /* requestType (2 bytes) */
+			WINPR_ASSERT((result->type <= UINT16_MAX));
+			WINPR_ASSERT((result->type >= 0));
+			Stream_Write_UINT16(s, (UINT16)result->type);      /* requestType (2 bytes) */
 			Stream_Write_UINT32(s, result->baseRTT);           /* baseRTT (4 bytes) */
 			Stream_Write_UINT32(s, result->averageRTT);        /* averageRTT (4 bytes) */
 			break;
@@ -384,7 +386,9 @@ static BOOL autodetect_send_netchar_result(rdpAutoDetect* autodetect, RDP_TRANSP
 			Stream_Write_UINT8(s, 0x0E);                       /* headerLength (1 byte) */
 			Stream_Write_UINT8(s, TYPE_ID_AUTODETECT_REQUEST); /* headerTypeId (1 byte) */
 			Stream_Write_UINT16(s, sequenceNumber);            /* sequenceNumber (2 bytes) */
-			Stream_Write_UINT16(s, result->type);              /* requestType (2 bytes) */
+			WINPR_ASSERT((result->type <= UINT16_MAX));
+			WINPR_ASSERT((result->type >= 0));
+			Stream_Write_UINT16(s, (UINT16)result->type);      /* requestType (2 bytes) */
 			Stream_Write_UINT32(s, result->bandwidth);         /* bandwidth (4 bytes) */
 			Stream_Write_UINT32(s, result->averageRTT);        /* averageRTT (4 bytes) */
 			break;
@@ -392,7 +396,9 @@ static BOOL autodetect_send_netchar_result(rdpAutoDetect* autodetect, RDP_TRANSP
 			Stream_Write_UINT8(s, 0x12);                       /* headerLength (1 byte) */
 			Stream_Write_UINT8(s, TYPE_ID_AUTODETECT_REQUEST); /* headerTypeId (1 byte) */
 			Stream_Write_UINT16(s, sequenceNumber);            /* sequenceNumber (2 bytes) */
-			Stream_Write_UINT16(s, result->type);              /* requestType (2 bytes) */
+			WINPR_ASSERT((result->type <= UINT16_MAX));
+			WINPR_ASSERT((result->type >= 0));
+			Stream_Write_UINT16(s, (UINT16)result->type);      /* requestType (2 bytes) */
 			Stream_Write_UINT32(s, result->baseRTT);           /* baseRTT (4 bytes) */
 			Stream_Write_UINT32(s, result->bandwidth);         /* bandwidth (4 bytes) */
 			Stream_Write_UINT32(s, result->averageRTT);        /* averageRTT (4 bytes) */
diff --git a/libfreerdp/core/capabilities.c b/libfreerdp/core/capabilities.c
index 2934e5e17..af2e5c395 100644
--- a/libfreerdp/core/capabilities.c
+++ b/libfreerdp/core/capabilities.c
@@ -3494,15 +3494,11 @@ static BOOL rdp_write_rfx_client_capability_container(wStream* s, const rdpSetti
  */
 static BOOL rdp_write_nsc_client_capability_container(wStream* s, const rdpSettings* settings)
 {
-	BYTE colorLossLevel = 0;
-	BYTE fAllowSubsampling = 0;
-	BYTE fAllowDynamicFidelity = 0;
-
 	WINPR_ASSERT(settings);
 
-	fAllowDynamicFidelity = settings->NSCodecAllowDynamicColorFidelity;
-	fAllowSubsampling = settings->NSCodecAllowSubsampling;
-	colorLossLevel = settings->NSCodecColorLossLevel;
+	const BOOL fAllowDynamicFidelity = settings->NSCodecAllowDynamicColorFidelity;
+	const BOOL fAllowSubsampling = settings->NSCodecAllowSubsampling;
+	UINT32 colorLossLevel = settings->NSCodecColorLossLevel;
 
 	if (colorLossLevel < 1)
 		colorLossLevel = 1;
@@ -3515,9 +3511,10 @@ static BOOL rdp_write_nsc_client_capability_container(wStream* s, const rdpSetti
 
 	Stream_Write_UINT16(s, 3); /* codecPropertiesLength */
 	/* TS_NSCODEC_CAPABILITYSET */
-	Stream_Write_UINT8(s, fAllowDynamicFidelity); /* fAllowDynamicFidelity (1 byte) */
-	Stream_Write_UINT8(s, fAllowSubsampling);     /* fAllowSubsampling (1 byte) */
-	Stream_Write_UINT8(s, colorLossLevel);        /* colorLossLevel (1 byte) */
+	Stream_Write_UINT8(s,
+	                   fAllowDynamicFidelity ? TRUE : FALSE); /* fAllowDynamicFidelity (1 byte) */
+	Stream_Write_UINT8(s, fAllowSubsampling ? TRUE : FALSE);  /* fAllowSubsampling (1 byte) */
+	Stream_Write_UINT8(s, (UINT8)colorLossLevel);             /* colorLossLevel (1 byte) */
 	return TRUE;
 }
 
diff --git a/libfreerdp/core/connection.c b/libfreerdp/core/connection.c
index 38bbfdd9a..91c4de3d2 100644
--- a/libfreerdp/core/connection.c
+++ b/libfreerdp/core/connection.c
@@ -347,8 +347,11 @@ BOOL rdp_client_connect(rdpRdp* rdp)
 		return FALSE;
 	}
 
+	const UINT32 port = settings->ServerPort;
+	WINPR_ASSERT(port <= UINT32_MAX);
+
 	nego_init(rdp->nego);
-	nego_set_target(rdp->nego, hostname, settings->ServerPort);
+	nego_set_target(rdp->nego, hostname, (UINT16)port);
 
 	if (settings->GatewayEnabled)
 	{
diff --git a/libfreerdp/core/info.c b/libfreerdp/core/info.c
index 579a95c5a..2f8e6694c 100644
--- a/libfreerdp/core/info.c
+++ b/libfreerdp/core/info.c
@@ -537,11 +537,11 @@ static BOOL rdp_write_extended_info_packet(rdpRdp* rdp, wStream* s)
 		goto fail;
 
 	Stream_Write_UINT16(s, clientAddressFamily); /* clientAddressFamily (2 bytes) */
-	Stream_Write_UINT16(s, cbClientAddress);     /* cbClientAddress (2 bytes) */
+	Stream_Write_UINT16(s, (UINT16)cbClientAddress); /* cbClientAddress (2 bytes) */
 
 	Stream_Write(s, clientAddress, cbClientAddress); /* clientAddress */
 
-	Stream_Write_UINT16(s, cbClientDir); /* cbClientDir (2 bytes) */
+	Stream_Write_UINT16(s, (UINT16)cbClientDir); /* cbClientDir (2 bytes) */
 
 	Stream_Write(s, clientDir, cbClientDir); /* clientDir */
 
diff --git a/libfreerdp/core/nego.c b/libfreerdp/core/nego.c
index 3679475f0..fcf81050b 100644
--- a/libfreerdp/core/nego.c
+++ b/libfreerdp/core/nego.c
@@ -466,7 +466,7 @@ BOOL nego_send_preconnection_pdu(rdpNego* nego)
 			free(wszPCB);
 			return FALSE;
 		}
-		cchPCB = len;
+		cchPCB = (UINT16)len;
 		cchPCB += 1; /* zero-termination */
 		cbSize += cchPCB * sizeof(WCHAR);
 	}
diff --git a/libfreerdp/core/orders.c b/libfreerdp/core/orders.c
index 31be3e66a..23a91ba30 100644
--- a/libfreerdp/core/orders.c
+++ b/libfreerdp/core/orders.c
@@ -43,6 +43,18 @@
 
 #define TAG FREERDP_TAG("core.orders")
 
+static inline const char* gdi_rob3_code_string_checked(UINT32 rob)
+{
+	WINPR_ASSERT((rob) <= UINT8_MAX);
+	return gdi_rop3_code_string((BYTE)rob);
+}
+
+static inline DWORD gdi_rop3_code_checked(UINT32 code)
+{
+	WINPR_ASSERT(code <= UINT8_MAX);
+	return gdi_rop3_code((UINT8)code);
+}
+
 static const char primary_order_str[] = "Primary Drawing Order";
 static const char secondary_order_str[] = "Secondary Drawing Order";
 static const char alt_sec_order_str[] = "Alternate Secondary Drawing Order";
@@ -556,7 +568,7 @@ static INLINE BOOL update_write_coord_int(wStream* s, INT32 coord, const char* n
 		return FALSE;
 	}
 
-	Stream_Write_UINT16(s, coord);
+	Stream_Write_UINT16(s, (UINT16)coord);
 	return TRUE;
 }
 static INLINE BOOL update_read_color(wStream* s, UINT32* color)
@@ -783,7 +795,7 @@ static INLINE BOOL update_write_4byte_unsigned(wStream* s, UINT32 value)
 
 	if (value <= 0x3F)
 	{
-		Stream_Write_UINT8(s, value);
+		Stream_Write_UINT8(s, (UINT8)value);
 	}
 	else if (value <= 0x3FFF)
 	{
@@ -1346,6 +1358,8 @@ BOOL update_write_patblt_order(wStream* s, ORDER_INFO* orderInfo, PATBLT_ORDER*
 static BOOL update_read_scrblt_order(const char* orderName, wStream* s, const ORDER_INFO* orderInfo,
                                      SCRBLT_ORDER* scrblt)
 {
+	WINPR_ASSERT(orderInfo);
+	WINPR_ASSERT(scrblt);
 	if (read_order_field_coord(orderName, orderInfo, s, 1, &scrblt->nLeftRect, FALSE) &&
 	    read_order_field_coord(orderName, orderInfo, s, 2, &scrblt->nTopRect, FALSE) &&
 	    read_order_field_coord(orderName, orderInfo, s, 3, &scrblt->nWidth, FALSE) &&
@@ -1359,6 +1373,8 @@ static BOOL update_read_scrblt_order(const char* orderName, wStream* s, const OR
 
 size_t update_approximate_scrblt_order(ORDER_INFO* orderInfo, const SCRBLT_ORDER* scrblt)
 {
+	WINPR_ASSERT(orderInfo);
+	WINPR_ASSERT(scrblt);
 	WINPR_UNUSED(orderInfo);
 	WINPR_UNUSED(scrblt);
 	return 32;
@@ -1366,6 +1382,8 @@ size_t update_approximate_scrblt_order(ORDER_INFO* orderInfo, const SCRBLT_ORDER
 
 BOOL update_write_scrblt_order(wStream* s, ORDER_INFO* orderInfo, const SCRBLT_ORDER* scrblt)
 {
+	WINPR_ASSERT(orderInfo);
+	WINPR_ASSERT(scrblt);
 	if (!Stream_EnsureRemainingCapacity(s, update_approximate_scrblt_order(orderInfo, scrblt)))
 		return FALSE;
 
@@ -1383,7 +1401,8 @@ BOOL update_write_scrblt_order(wStream* s, ORDER_INFO* orderInfo, const SCRBLT_O
 	if (!update_write_coord(s, scrblt->nHeight))
 		return FALSE;
 	orderInfo->fieldFlags |= ORDER_FIELD_05;
-	Stream_Write_UINT8(s, scrblt->bRop);
+	WINPR_ASSERT(scrblt->bRop <= UINT8_MAX);
+	Stream_Write_UINT8(s, (UINT8)scrblt->bRop);
 	orderInfo->fieldFlags |= ORDER_FIELD_06;
 	if (!update_write_coord(s, scrblt->nXSrc))
 		return FALSE;
@@ -3760,26 +3779,28 @@ static BOOL update_recv_primary_order(rdpUpdate* update, wStream* s, BYTE flags)
 		case ORDER_TYPE_DSTBLT:
 		{
 			WLog_Print(up->log, WLOG_DEBUG, "%s %s rop=%s [0x%08" PRIx32 "]", primary_order_str,
-			           orderName, gdi_rop3_code_string(primary->dstblt.bRop),
-			           gdi_rop3_code(primary->dstblt.bRop));
+			           orderName, gdi_rob3_code_string_checked(primary->dstblt.bRop),
+			           gdi_rop3_code_checked(primary->dstblt.bRop));
 			rc = IFCALLRESULT(defaultReturn, primary->common.DstBlt, context, &primary->dstblt);
 		}
 		break;
 
 		case ORDER_TYPE_PATBLT:
 		{
+			WINPR_ASSERT(primary->patblt.bRop <= UINT8_MAX);
 			WLog_Print(up->log, WLOG_DEBUG, "%s %s rop=%s [0x%08" PRIx32 "]", primary_order_str,
-			           orderName, gdi_rop3_code_string(primary->patblt.bRop),
-			           gdi_rop3_code(primary->patblt.bRop));
+			           orderName, gdi_rob3_code_string_checked(primary->patblt.bRop),
+			           gdi_rop3_code_checked(primary->patblt.bRop));
 			rc = IFCALLRESULT(defaultReturn, primary->common.PatBlt, context, &primary->patblt);
 		}
 		break;
 
 		case ORDER_TYPE_SCRBLT:
 		{
+			WINPR_ASSERT(primary->scrblt.bRop <= UINT8_MAX);
 			WLog_Print(up->log, WLOG_DEBUG, "%s %s rop=%s [0x%08" PRIx32 "]", primary_order_str,
-			           orderName, gdi_rop3_code_string(primary->scrblt.bRop),
-			           gdi_rop3_code(primary->scrblt.bRop));
+			           orderName, gdi_rob3_code_string_checked((UINT8)primary->scrblt.bRop),
+			           gdi_rop3_code_checked(primary->scrblt.bRop));
 			rc = IFCALLRESULT(defaultReturn, primary->common.ScrBlt, context, &primary->scrblt);
 		}
 		break;
@@ -3803,8 +3824,8 @@ static BOOL update_recv_primary_order(rdpUpdate* update, wStream* s, BYTE flags)
 		case ORDER_TYPE_MULTI_DSTBLT:
 		{
 			WLog_Print(up->log, WLOG_DEBUG, "%s %s rop=%s [0x%08" PRIx32 "]", primary_order_str,
-			           orderName, gdi_rop3_code_string(primary->multi_dstblt.bRop),
-			           gdi_rop3_code(primary->multi_dstblt.bRop));
+			           orderName, gdi_rob3_code_string_checked(primary->multi_dstblt.bRop),
+			           gdi_rop3_code_checked(primary->multi_dstblt.bRop));
 			rc = IFCALLRESULT(defaultReturn, primary->common.MultiDstBlt, context,
 			                  &primary->multi_dstblt);
 		}
@@ -3813,8 +3834,8 @@ static BOOL update_recv_primary_order(rdpUpdate* update, wStream* s, BYTE flags)
 		case ORDER_TYPE_MULTI_PATBLT:
 		{
 			WLog_Print(up->log, WLOG_DEBUG, "%s %s rop=%s [0x%08" PRIx32 "]", primary_order_str,
-			           orderName, gdi_rop3_code_string(primary->multi_patblt.bRop),
-			           gdi_rop3_code(primary->multi_patblt.bRop));
+			           orderName, gdi_rob3_code_string_checked(primary->multi_patblt.bRop),
+			           gdi_rop3_code_checked(primary->multi_patblt.bRop));
 			rc = IFCALLRESULT(defaultReturn, primary->common.MultiPatBlt, context,
 			                  &primary->multi_patblt);
 		}
@@ -3823,8 +3844,8 @@ static BOOL update_recv_primary_order(rdpUpdate* update, wStream* s, BYTE flags)
 		case ORDER_TYPE_MULTI_SCRBLT:
 		{
 			WLog_Print(up->log, WLOG_DEBUG, "%s %s rop=%s [0x%08" PRIx32 "]", primary_order_str,
-			           orderName, gdi_rop3_code_string(primary->multi_scrblt.bRop),
-			           gdi_rop3_code(primary->multi_scrblt.bRop));
+			           orderName, gdi_rob3_code_string_checked(primary->multi_scrblt.bRop),
+			           gdi_rop3_code_checked(primary->multi_scrblt.bRop));
 			rc = IFCALLRESULT(defaultReturn, primary->common.MultiScrBlt, context,
 			                  &primary->multi_scrblt);
 		}
@@ -3862,18 +3883,20 @@ static BOOL update_recv_primary_order(rdpUpdate* update, wStream* s, BYTE flags)
 
 		case ORDER_TYPE_MEMBLT:
 		{
+			WINPR_ASSERT(primary->memblt.bRop <= UINT8_MAX);
 			WLog_Print(up->log, WLOG_DEBUG, "%s %s rop=%s [0x%08" PRIx32 "]", primary_order_str,
-			           orderName, gdi_rop3_code_string(primary->memblt.bRop),
-			           gdi_rop3_code(primary->memblt.bRop));
+			           orderName, gdi_rob3_code_string_checked(primary->memblt.bRop),
+			           gdi_rop3_code_checked(primary->memblt.bRop));
 			rc = IFCALLRESULT(defaultReturn, primary->common.MemBlt, context, &primary->memblt);
 		}
 		break;
 
 		case ORDER_TYPE_MEM3BLT:
 		{
+			WINPR_ASSERT(primary->mem3blt.bRop <= UINT8_MAX);
 			WLog_Print(up->log, WLOG_DEBUG, "%s %s rop=%s [0x%08" PRIx32 "]", primary_order_str,
-			           orderName, gdi_rop3_code_string(primary->mem3blt.bRop),
-			           gdi_rop3_code(primary->mem3blt.bRop));
+			           orderName, gdi_rob3_code_string_checked(primary->mem3blt.bRop),
+			           gdi_rop3_code_checked(primary->mem3blt.bRop));
 			rc = IFCALLRESULT(defaultReturn, primary->common.Mem3Blt, context, &primary->mem3blt);
 		}
 		break;
diff --git a/libfreerdp/core/peer.c b/libfreerdp/core/peer.c
index 915d1200f..24d41f5eb 100644
--- a/libfreerdp/core/peer.c
+++ b/libfreerdp/core/peer.c
@@ -93,7 +93,9 @@ static HANDLE freerdp_peer_virtual_channel_open(freerdp_peer* client, const char
 		return (HANDLE)peerChannel;
 	}
 
-	peerChannel = server_channel_common_new(client, index, mcsChannel->ChannelId, 128, NULL, name);
+	WINPR_ASSERT(index <= UINT16_MAX);
+	peerChannel =
+	    server_channel_common_new(client, (UINT16)index, mcsChannel->ChannelId, 128, NULL, name);
 
 	if (peerChannel)
 	{
@@ -187,7 +189,8 @@ static int freerdp_peer_virtual_channel_write(freerdp_peer* client, HANDLE hChan
 
 		Stream_Write(s, buffer, chunkSize);
 
-		if (!rdp_send(rdp, s, peerChannel->channelId))
+		WINPR_ASSERT(peerChannel->channelId <= UINT16_MAX);
+		if (!rdp_send(rdp, s, (UINT16)peerChannel->channelId))
 			return -1;
 
 		buffer += chunkSize;
diff --git a/libfreerdp/core/proxy.c b/libfreerdp/core/proxy.c
index 6d0b4db11..cf1435746 100644
--- a/libfreerdp/core/proxy.c
+++ b/libfreerdp/core/proxy.c
@@ -258,14 +258,14 @@ static BOOL check_no_proxy(rdpSettings* settings, const char* no_proxy)
 							struct sockaddr_in mask;
 
 							if (inet_pton(AF_INET, current, &mask.sin_addr))
-								result = cidr4_match(&sa4.sin_addr, &mask.sin_addr, sub);
+								result = cidr4_match(&sa4.sin_addr, &mask.sin_addr, (UINT8)sub);
 						}
 						else if (is_ipv6)
 						{
 							struct sockaddr_in6 mask;
 
 							if (inet_pton(AF_INET6, current, &mask.sin6_addr))
-								result = cidr6_match(&sa6.sin6_addr, &mask.sin6_addr, sub);
+								result = cidr6_match(&sa6.sin6_addr, &mask.sin6_addr, (UINT8)sub);
 						}
 					}
 					else
@@ -766,7 +766,7 @@ static BOOL socks_proxy_connect(rdpContext* context, BIO* bufferedBio, const cha
                                 const char* proxyPassword, const char* hostname, UINT16 port)
 {
 	int status = 0;
-	int nauthMethods = 1;
+	BYTE nauthMethods = 1;
 	int writeLen = 3;
 	BYTE buf[3 + 255 + 255] = { 0 }; /* biggest packet is user/pass auth */
 	const size_t hostnlen = strnlen(hostname, 255);
diff --git a/libfreerdp/core/rdstls.c b/libfreerdp/core/rdstls.c
index d7fad612f..93e6f124f 100644
--- a/libfreerdp/core/rdstls.c
+++ b/libfreerdp/core/rdstls.c
@@ -265,10 +265,10 @@ static BOOL rdstls_write_data(wStream* s, UINT32 length, const BYTE* data)
 {
 	WINPR_ASSERT(data || (length == 0));
 
-	if (!Stream_EnsureRemainingCapacity(s, 2))
+	if (!Stream_EnsureRemainingCapacity(s, 2) || (length > UINT16_MAX))
 		return FALSE;
 
-	Stream_Write_UINT16(s, length);
+	Stream_Write_UINT16(s, (UINT16)length);
 
 	if (!Stream_EnsureRemainingCapacity(s, length))
 		return FALSE;
@@ -463,7 +463,6 @@ static BOOL rdstls_process_authentication_request_with_password(rdpRdstls* rdstl
 	char* clientDomain = NULL;
 
 	const BYTE* serverRedirectionGuid = NULL;
-	UINT16 serverRedirectionGuidLength = 0;
 	const char* serverPassword = NULL;
 	const char* serverUsername = NULL;
 	const char* serverDomain = NULL;
@@ -484,7 +483,7 @@ static BOOL rdstls_process_authentication_request_with_password(rdpRdstls* rdstl
 		goto fail;
 
 	serverRedirectionGuid = freerdp_settings_get_pointer(settings, FreeRDP_RedirectionGuid);
-	serverRedirectionGuidLength =
+	const UINT32 serverRedirectionGuidLength =
 	    freerdp_settings_get_uint32(settings, FreeRDP_RedirectionGuidLength);
 	serverUsername = freerdp_settings_get_string(settings, FreeRDP_Username);
 	serverDomain = freerdp_settings_get_string(settings, FreeRDP_Domain);
diff --git a/libfreerdp/core/settings.c b/libfreerdp/core/settings.c
index c7aad0acf..2c2e7fde7 100644
--- a/libfreerdp/core/settings.c
+++ b/libfreerdp/core/settings.c
@@ -715,7 +715,7 @@ static char* freerdp_settings_get_legacy_config_path(void)
 	char product[sizeof(FREERDP_PRODUCT_STRING)] = { 0 };
 
 	for (size_t i = 0; i < sizeof(product); i++)
-		product[i] = tolower(FREERDP_PRODUCT_STRING[i]);
+		product[i] = (char)tolower(FREERDP_PRODUCT_STRING[i]);
 
 	return GetKnownSubPath(KNOWN_PATH_XDG_CONFIG_HOME, product);
 }
diff --git a/libfreerdp/core/tcp.c b/libfreerdp/core/tcp.c
index cd4ce1022..989130f25 100644
--- a/libfreerdp/core/tcp.c
+++ b/libfreerdp/core/tcp.c
@@ -1201,9 +1201,10 @@ int freerdp_tcp_default_connect(rdpContext* context, rdpSettings* settings, cons
 			{
 				if (settings->TargetNetAddressCount > 0)
 				{
+					WINPR_ASSERT(port <= UINT16_MAX);
 					sockfd = freerdp_tcp_connect_multi(
 					    context, settings->TargetNetAddresses, settings->TargetNetPorts,
-					    settings->TargetNetAddressCount, port, timeout);
+					    settings->TargetNetAddressCount, (UINT16)port, timeout);
 				}
 			}
 		}
diff --git a/libfreerdp/core/tpdu.c b/libfreerdp/core/tpdu.c
index 9718cb11f..f6f051bd1 100644
--- a/libfreerdp/core/tpdu.c
+++ b/libfreerdp/core/tpdu.c
@@ -119,7 +119,8 @@ BOOL tpdu_write_header(wStream* s, UINT16 length, BYTE code)
 	if (!Stream_CheckAndLogRequiredCapacity(TAG, (s), 3))
 		return FALSE;
 
-	Stream_Write_UINT8(s, length); /* LI */
+	WINPR_ASSERT(length <= UINT8_MAX);
+	Stream_Write_UINT8(s, (UINT8)length); /* LI */
 	Stream_Write_UINT8(s, code);   /* code */
 
 	if (code == X224_TPDU_DATA)
diff --git a/libfreerdp/core/tpkt.c b/libfreerdp/core/tpkt.c
index 4796da9af..4566c1f6f 100644
--- a/libfreerdp/core/tpkt.c
+++ b/libfreerdp/core/tpkt.c
@@ -166,6 +166,8 @@ BOOL tpkt_write_header(wStream* s, size_t length)
 		return FALSE;
 	Stream_Write_UINT8(s, 3);          /* version */
 	Stream_Write_UINT8(s, 0);          /* reserved */
-	Stream_Write_UINT16_BE(s, length); /* length */
+
+	WINPR_ASSERT(length <= UINT16_MAX);
+	Stream_Write_UINT16_BE(s, (UINT16)length); /* length */
 	return TRUE;
 }
diff --git a/libfreerdp/crypto/base64.c b/libfreerdp/crypto/base64.c
index f63dc1321..315da9203 100644
--- a/libfreerdp/crypto/base64.c
+++ b/libfreerdp/crypto/base64.c
@@ -410,11 +410,8 @@ static INLINE void* base64_decode(const signed char* WINPR_RESTRICT alphabet,
                                   const char* WINPR_RESTRICT s, size_t length,
                                   size_t* WINPR_RESTRICT data_len, BOOL pad)
 {
-	int n[4];
-	BYTE* q = NULL;
+	int n[4] = { 0 };
 	BYTE* data = NULL;
-	size_t nBlocks = 0;
-	size_t outputLen = 0;
 	const size_t remainder = length % 4;
 
 	if ((pad && remainder > 0) || (remainder == 1))
@@ -423,13 +420,13 @@ static INLINE void* base64_decode(const signed char* WINPR_RESTRICT alphabet,
 	if (!pad && remainder)
 		length += 4 - remainder;
 
-	q = data = (BYTE*)malloc(length / 4 * 3 + 1);
+	BYTE* q = data = (BYTE*)malloc(length / 4 * 3 + 1);
 	if (!q)
 		return NULL;
 
 	/* first treat complete blocks */
-	nBlocks = (length / 4);
-	outputLen = 0;
+	const size_t nBlocks = (length / 4);
+	size_t outputLen = 0;
 
 	if (nBlocks < 1)
 	{
@@ -447,9 +444,9 @@ static INLINE void* base64_decode(const signed char* WINPR_RESTRICT alphabet,
 		if ((n[0] == -1) || (n[1] == -1) || (n[2] == -1) || (n[3] == -1))
 			goto out_free;
 
-		q[0] = (n[0] << 2) + (n[1] >> 4);
-		q[1] = ((n[1] & 15) << 4) + (n[2] >> 2);
-		q[2] = ((n[2] & 3) << 6) + n[3];
+		q[0] = (BYTE)((n[0] << 2) + (n[1] >> 4));
+		q[1] = (BYTE)(((n[1] & 15) << 4) + (n[2] >> 2));
+		q[2] = (BYTE)(((n[2] & 3) << 6) + n[3]);
 		outputLen += 3;
 	}
 
@@ -462,7 +459,7 @@ static INLINE void* base64_decode(const signed char* WINPR_RESTRICT alphabet,
 	n[2] = remainder == 2 ? -1 : base64_decode_char(alphabet, *s++);
 	n[3] = remainder >= 2 ? -1 : base64_decode_char(alphabet, *s++);
 
-	q[0] = (n[0] << 2) + (n[1] >> 4);
+	q[0] = (BYTE)((n[0] << 2) + (n[1] >> 4));
 	if (n[2] == -1)
 	{
 		/* XX== */
@@ -470,22 +467,22 @@ static INLINE void* base64_decode(const signed char* WINPR_RESTRICT alphabet,
 		if (n[3] != -1)
 			goto out_free;
 
-		q[1] = ((n[1] & 15) << 4);
+		q[1] = (BYTE)((n[1] & 15) << 4);
 	}
 	else if (n[3] == -1)
 	{
 		/* yyy= */
 		outputLen += 2;
-		q[1] = ((n[1] & 15) << 4) + (n[2] >> 2);
-		q[2] = ((n[2] & 3) << 6);
+		q[1] = (BYTE)(((n[1] & 15) << 4) + (n[2] >> 2));
+		q[2] = (BYTE)((n[2] & 3) << 6);
 	}
 	else
 	{
 		/* XXXX */
 		outputLen += 3;
-		q[0] = (n[0] << 2) + (n[1] >> 4);
-		q[1] = ((n[1] & 15) << 4) + (n[2] >> 2);
-		q[2] = ((n[2] & 3) << 6) + n[3];
+		q[0] = (BYTE)((n[0] << 2) + (n[1] >> 4));
+		q[1] = (BYTE)(((n[1] & 15) << 4) + (n[2] >> 2));
+		q[2] = (BYTE)(((n[2] & 3) << 6) + n[3]);
 	}
 
 	if (data_len)
diff --git a/libfreerdp/crypto/certificate_data.c b/libfreerdp/crypto/certificate_data.c
index 5d754c684..8b8b9af7e 100644
--- a/libfreerdp/crypto/certificate_data.c
+++ b/libfreerdp/crypto/certificate_data.c
@@ -55,7 +55,7 @@ static char* ensure_lowercase(char* str, size_t length)
 {
 	const size_t len = strnlen(str, length);
 	for (size_t x = 0; x < len; x++)
-		str[x] = tolower(str[x]);
+		str[x] = (char)tolower(str[x]);
 	return str;
 }
 static const char* freerdp_certificate_data_hash_(const char* hostname, UINT16 port, char* name,
diff --git a/libfreerdp/crypto/tls.c b/libfreerdp/crypto/tls.c
index 26c8c091f..8cd5772f7 100644
--- a/libfreerdp/crypto/tls.c
+++ b/libfreerdp/crypto/tls.c
@@ -974,7 +974,9 @@ TlsHandshakeResult freerdp_tls_handshake(rdpTls* tls)
 
 		if (tls->isClientMode)
 		{
-			verify_status = tls_verify_certificate(tls, cert, tls_get_server_name(tls), tls->port);
+			WINPR_ASSERT(tls->port <= UINT16_MAX);
+			verify_status =
+			    tls_verify_certificate(tls, cert, tls_get_server_name(tls), (UINT16)tls->port);
 
 			if (verify_status < 1)
 			{
diff --git a/libfreerdp/emu/scard/smartcard_virtual_gids.c b/libfreerdp/emu/scard/smartcard_virtual_gids.c
index 7504551af..2c231c808 100644
--- a/libfreerdp/emu/scard/smartcard_virtual_gids.c
+++ b/libfreerdp/emu/scard/smartcard_virtual_gids.c
@@ -877,7 +877,7 @@ static BOOL vgids_ins_getdata(vgidsContext* context, wStream* s, BYTE** response
 	vgids_reset_context_response(context);
 
 	/* build up file identifier */
-	fileId = ((UINT16)p1 << 8) | p2;
+	fileId = (UINT16)(((UINT16)p1 << 8) | p2);
 
 	/* Do we have a DO reference? */
 	switch (lc)
diff --git a/libfreerdp/gdi/gdi.c b/libfreerdp/gdi/gdi.c
index 3593df5f5..7e712bc73 100644
--- a/libfreerdp/gdi/gdi.c
+++ b/libfreerdp/gdi/gdi.c
@@ -323,6 +323,12 @@ static const BYTE GDI_BS_HATCHED_PATTERNS[] = {
 	0x7E, 0xBD, 0xDB, 0xE7, 0xE7, 0xDB, 0xBD, 0x7E  /* HS_DIACROSS */
 };
 
+static inline DWORD gdi_rop3_code_checked(UINT32 code)
+{
+	WINPR_ASSERT(code <= UINT8_MAX);
+	return gdi_rop3_code((UINT8)code);
+}
+
 BOOL gdi_decode_color(rdpGdi* gdi, const UINT32 srcColor, UINT32* color, UINT32* format)
 {
 	UINT32 SrcFormat = 0;
@@ -571,7 +577,8 @@ static BOOL gdi_dstblt(rdpContext* context, const DSTBLT_ORDER* dstblt)
 
 	gdi = context->gdi;
 	return gdi_BitBlt(gdi->drawing->hdc, dstblt->nLeftRect, dstblt->nTopRect, dstblt->nWidth,
-	                  dstblt->nHeight, NULL, 0, 0, gdi_rop3_code(dstblt->bRop), &gdi->palette);
+	                  dstblt->nHeight, NULL, 0, 0, gdi_rop3_code_checked(dstblt->bRop),
+	                  &gdi->palette);
 }
 
 static BOOL gdi_patblt(rdpContext* context, PATBLT_ORDER* patblt)
@@ -584,7 +591,7 @@ static BOOL gdi_patblt(rdpContext* context, PATBLT_ORDER* patblt)
 	HGDI_BRUSH hbrush = NULL;
 	rdpGdi* gdi = context->gdi;
 	BOOL ret = FALSE;
-	const DWORD rop = gdi_rop3_code(patblt->bRop);
+	const DWORD rop = gdi_rop3_code_checked(patblt->bRop);
 	INT32 nXSrc = 0;
 	INT32 nYSrc = 0;
 	BYTE data[8 * 8 * 4];
@@ -691,7 +698,7 @@ static BOOL gdi_scrblt(rdpContext* context, const SCRBLT_ORDER* scrblt)
 	gdi = context->gdi;
 	return gdi_BitBlt(gdi->drawing->hdc, scrblt->nLeftRect, scrblt->nTopRect, scrblt->nWidth,
 	                  scrblt->nHeight, gdi->primary->hdc, scrblt->nXSrc, scrblt->nYSrc,
-	                  gdi_rop3_code(scrblt->bRop), &gdi->palette);
+	                  gdi_rop3_code_checked(scrblt->bRop), &gdi->palette);
 }
 
 static BOOL gdi_opaque_rect(rdpContext* context, const OPAQUE_RECT_ORDER* opaque_rect)
@@ -834,7 +841,7 @@ static BOOL gdi_memblt(rdpContext* context, MEMBLT_ORDER* memblt)
 	gdi = context->gdi;
 	return gdi_BitBlt(gdi->drawing->hdc, memblt->nLeftRect, memblt->nTopRect, memblt->nWidth,
 	                  memblt->nHeight, bitmap->hdc, memblt->nXSrc, memblt->nYSrc,
-	                  gdi_rop3_code(memblt->bRop), &gdi->palette);
+	                  gdi_rop3_code_checked(memblt->bRop), &gdi->palette);
 }
 
 static BOOL gdi_mem3blt(rdpContext* context, MEM3BLT_ORDER* mem3blt)
@@ -870,7 +877,7 @@ static BOOL gdi_mem3blt(rdpContext* context, MEM3BLT_ORDER* mem3blt)
 
 			ret = gdi_BitBlt(gdi->drawing->hdc, mem3blt->nLeftRect, mem3blt->nTopRect,
 			                 mem3blt->nWidth, mem3blt->nHeight, bitmap->hdc, mem3blt->nXSrc,
-			                 mem3blt->nYSrc, gdi_rop3_code(mem3blt->bRop), &gdi->palette);
+			                 mem3blt->nYSrc, gdi_rop3_code_checked(mem3blt->bRop), &gdi->palette);
 			gdi_DeleteObject((HGDIOBJECT)gdi->drawing->hdc->brush);
 			gdi->drawing->hdc->brush = originalBrush;
 			break;
@@ -942,7 +949,7 @@ static BOOL gdi_mem3blt(rdpContext* context, MEM3BLT_ORDER* mem3blt)
 			gdi->drawing->hdc->brush->nYOrg = brush->y;
 			ret = gdi_BitBlt(gdi->drawing->hdc, mem3blt->nLeftRect, mem3blt->nTopRect,
 			                 mem3blt->nWidth, mem3blt->nHeight, bitmap->hdc, mem3blt->nXSrc,
-			                 mem3blt->nYSrc, gdi_rop3_code(mem3blt->bRop), &gdi->palette);
+			                 mem3blt->nYSrc, gdi_rop3_code_checked(mem3blt->bRop), &gdi->palette);
 			gdi_DeleteObject((HGDIOBJECT)gdi->drawing->hdc->brush);
 			gdi_DeleteObject((HGDIOBJECT)hBmp);
 			gdi->drawing->hdc->brush = originalBrush;
diff --git a/winpr/libwinpr/comm/comm.c b/winpr/libwinpr/comm/comm.c
index d7ce4e976..33bc74cf7 100644
--- a/winpr/libwinpr/comm/comm.c
+++ b/winpr/libwinpr/comm/comm.c
@@ -431,7 +431,7 @@ BOOL GetCommState(HANDLE hFile, LPDCB lpDCB)
 	lpLocalDcb->wReserved = 0; /* must be zero */
 	lpLocalDcb->XonLim = handflow.XonLimit;
 	lpLocalDcb->XoffLim = handflow.XoffLimit;
-	SERIAL_LINE_CONTROL lineControl;
+	SERIAL_LINE_CONTROL lineControl = { 0 };
 
 	if (!CommDeviceIoControl(pComm, IOCTL_SERIAL_GET_LINE_CONTROL, NULL, 0, &lineControl,
 	                         sizeof(SERIAL_LINE_CONTROL), &bytesReturned, NULL))
diff --git a/winpr/libwinpr/comm/comm_io.c b/winpr/libwinpr/comm/comm_io.c
index ab83eb13c..7fc554827 100644
--- a/winpr/libwinpr/comm/comm_io.c
+++ b/winpr/libwinpr/comm/comm_io.c
@@ -53,7 +53,7 @@ static UCHAR svtime(ULONG Ti)
 	else if (Ti > 25500)
 		return 255; /* 0xFF */
 	else
-		return Ti / 100;
+		return (UCHAR)(Ti / 100);
 }
 
 /**
diff --git a/winpr/libwinpr/comm/comm_ioctl.h b/winpr/libwinpr/comm/comm_ioctl.h
index 11061dc70..9d46df536 100644
--- a/winpr/libwinpr/comm/comm_ioctl.h
+++ b/winpr/libwinpr/comm/comm_ioctl.h
@@ -79,8 +79,8 @@ extern "C"
 	{
 		ULONG ControlHandShake;
 		ULONG FlowReplace;
-		LONG XonLimit;
-		LONG XoffLimit;
+		WORD XonLimit;
+		WORD XoffLimit;
 	} SERIAL_HANDFLOW, *PSERIAL_HANDFLOW;
 
 #define SERIAL_DTR_MASK ((ULONG)0x03)
diff --git a/winpr/libwinpr/rpc/rpc.c b/winpr/libwinpr/rpc/rpc.c
index 10328c672..47e42f0f1 100644
--- a/winpr/libwinpr/rpc/rpc.c
+++ b/winpr/libwinpr/rpc/rpc.c
@@ -761,18 +761,18 @@ RPC_STATUS UuidFromStringA(RPC_CSTR StringUuid, UUID* Uuid)
 			return RPC_S_INVALID_STRING_UUID;
 	}
 
-	Uuid->Data1 = ((bin[0] << 28) | (bin[1] << 24) | (bin[2] << 20) | (bin[3] << 16) |
-	               (bin[4] << 12) | (bin[5] << 8) | (bin[6] << 4) | bin[7]);
-	Uuid->Data2 = ((bin[9] << 12) | (bin[10] << 8) | (bin[11] << 4) | bin[12]);
-	Uuid->Data3 = ((bin[14] << 12) | (bin[15] << 8) | (bin[16] << 4) | bin[17]);
-	Uuid->Data4[0] = ((bin[19] << 4) | bin[20]);
-	Uuid->Data4[1] = ((bin[21] << 4) | bin[22]);
-	Uuid->Data4[2] = ((bin[24] << 4) | bin[25]);
-	Uuid->Data4[3] = ((bin[26] << 4) | bin[27]);
-	Uuid->Data4[4] = ((bin[28] << 4) | bin[29]);
-	Uuid->Data4[5] = ((bin[30] << 4) | bin[31]);
-	Uuid->Data4[6] = ((bin[32] << 4) | bin[33]);
-	Uuid->Data4[7] = ((bin[34] << 4) | bin[35]);
+	Uuid->Data1 = (UINT32)((bin[0] << 28) | (bin[1] << 24) | (bin[2] << 20) | (bin[3] << 16) |
+	                       (bin[4] << 12) | (bin[5] << 8) | (bin[6] << 4) | bin[7]);
+	Uuid->Data2 = (UINT16)((bin[9] << 12) | (bin[10] << 8) | (bin[11] << 4) | bin[12]);
+	Uuid->Data3 = (UINT16)((bin[14] << 12) | (bin[15] << 8) | (bin[16] << 4) | bin[17]);
+	Uuid->Data4[0] = (UINT8)((bin[19] << 4) | bin[20]);
+	Uuid->Data4[1] = (UINT8)((bin[21] << 4) | bin[22]);
+	Uuid->Data4[2] = (UINT8)((bin[24] << 4) | bin[25]);
+	Uuid->Data4[3] = (UINT8)((bin[26] << 4) | bin[27]);
+	Uuid->Data4[4] = (UINT8)((bin[28] << 4) | bin[29]);
+	Uuid->Data4[5] = (UINT8)((bin[30] << 4) | bin[31]);
+	Uuid->Data4[6] = (UINT8)((bin[32] << 4) | bin[33]);
+	Uuid->Data4[7] = (UINT8)((bin[34] << 4) | bin[35]);
 	return RPC_S_OK;
 }
 
diff --git a/winpr/libwinpr/sysinfo/sysinfo.c b/winpr/libwinpr/sysinfo/sysinfo.c
index c2a0f4676..1da6615b3 100644
--- a/winpr/libwinpr/sysinfo/sysinfo.c
+++ b/winpr/libwinpr/sysinfo/sysinfo.c
@@ -107,9 +107,9 @@ static UINT64 mac_get_time_ns(void)
 #include <sys/sysctl.h>
 #endif
 
-static DWORD GetProcessorArchitecture(void)
+static WORD GetProcessorArchitecture(void)
 {
-	DWORD cpuArch = PROCESSOR_ARCHITECTURE_UNKNOWN;
+	WORD cpuArch = PROCESSOR_ARCHITECTURE_UNKNOWN;
 #if defined(ANDROID)
 	AndroidCpuFamily family = android_getCpuFamily();
 
diff --git a/winpr/libwinpr/timezone/timezone.c b/winpr/libwinpr/timezone/timezone.c
index 2476f9479..6bf7663f2 100644
--- a/winpr/libwinpr/timezone/timezone.c
+++ b/winpr/libwinpr/timezone/timezone.c
@@ -348,7 +348,7 @@ static SYSTEMTIME tm2systemtime(const struct tm* t)
 
 	if (t)
 	{
-		st.wYear = (WORD)1900 + t->tm_year;
+		st.wYear = (WORD)(1900 + t->tm_year);
 		st.wMonth = (WORD)t->tm_mon + 1;
 		st.wDay = (WORD)t->tm_mday;
 		st.wDayOfWeek = (WORD)t->tm_wday;
diff --git a/winpr/libwinpr/utils/asn1/asn1.c b/winpr/libwinpr/utils/asn1/asn1.c
index c21bddcc6..0805ff4a4 100644
--- a/winpr/libwinpr/utils/asn1/asn1.c
+++ b/winpr/libwinpr/utils/asn1/asn1.c
@@ -550,18 +550,18 @@ static size_t WinPrAsn1EncIntegerLike(WinPrAsn1Encoder* enc, WinPrAsn1_tag b,
 	{
 		case 2:
 			Stream_Write_UINT8(s, 1);
-			Stream_Write_INT8(s, value);
+			Stream_Write_INT8(s, (INT8)value);
 			break;
 		case 3:
 			Stream_Write_UINT8(s, 2);
-			Stream_Write_INT16_BE(s, value);
+			Stream_Write_INT16_BE(s, (INT16)value);
 			break;
 		case 5:
 			Stream_Write_UINT8(s, 4);
-			Stream_Write_INT32_BE(s, value);
+			Stream_Write_INT32_BE(s, (INT32)value);
 			break;
 		default:
-			break;
+			return 0;
 	}
 	return 1 + len;
 }
@@ -766,7 +766,7 @@ static void write2digit(wStream* s, UINT8 v)
 
 size_t WinPrAsn1EncUtcTime(WinPrAsn1Encoder* enc, const WinPrAsn1_UTCTIME* utc)
 {
-	wStream staticS;
+	wStream staticS = { 0 };
 	wStream* s = &staticS;
 
 	WINPR_ASSERT(enc);
@@ -779,13 +779,13 @@ size_t WinPrAsn1EncUtcTime(WinPrAsn1Encoder* enc, const WinPrAsn1_UTCTIME* utc)
 	Stream_Write_UINT8(s, ER_TAG_UTCTIME);
 	Stream_Write_UINT8(s, 13);
 
-	write2digit(s, utc->year - 2000);
+	write2digit(s, (UINT8)(utc->year - 2000));
 	write2digit(s, utc->month);
 	write2digit(s, utc->day);
 	write2digit(s, utc->hour);
 	write2digit(s, utc->minute);
 	write2digit(s, utc->second);
-	Stream_Write_UINT8(s, utc->tz);
+	Stream_Write_INT8(s, utc->tz);
 	return 15;
 }
 
@@ -799,6 +799,7 @@ size_t WinPrAsn1EncContextualUtcTime(WinPrAsn1Encoder* enc, WinPrAsn1_tagId tagI
 	WINPR_ASSERT_VALID_TAG(tagId);
 	WINPR_ASSERT(utc);
 	WINPR_ASSERT(utc->year >= 2000);
+	WINPR_ASSERT(utc->year < 2256);
 
 	if (!asn1_getWriteStream(enc, 17, s))
 		return 0;
@@ -809,13 +810,13 @@ size_t WinPrAsn1EncContextualUtcTime(WinPrAsn1Encoder* enc, WinPrAsn1_tagId tagI
 	Stream_Write_UINT8(s, ER_TAG_UTCTIME);
 	Stream_Write_UINT8(s, 13);
 
-	write2digit(s, utc->year - 2000);
+	write2digit(s, (UINT8)(utc->year - 2000));
 	write2digit(s, utc->month);
 	write2digit(s, utc->day);
 	write2digit(s, utc->hour);
 	write2digit(s, utc->minute);
 	write2digit(s, utc->second);
-	Stream_Write_UINT8(s, utc->tz);
+	Stream_Write_INT8(s, utc->tz);
 
 	return 17;
 }
diff --git a/winpr/libwinpr/utils/wlog/PacketMessage.c b/winpr/libwinpr/utils/wlog/PacketMessage.c
index 276e4e3a6..ffa9479d8 100644
--- a/winpr/libwinpr/utils/wlog/PacketMessage.c
+++ b/winpr/libwinpr/utils/wlog/PacketMessage.c
@@ -303,11 +303,11 @@ static BOOL WLog_PacketMessage_Write_IPv4Header(wPcap* pcap, wIPv4Header* ipv4)
 	s = Stream_StaticInit(&sbuffer, buffer, sizeof(buffer));
 	if (!s)
 		return FALSE;
-	Stream_Write_UINT8(s, (ipv4->Version << 4) | ipv4->InternetHeaderLength);
+	Stream_Write_UINT8(s, (BYTE)((ipv4->Version << 4) | ipv4->InternetHeaderLength));
 	Stream_Write_UINT8(s, ipv4->TypeOfService);
 	Stream_Write_UINT16_BE(s, ipv4->TotalLength);
 	Stream_Write_UINT16_BE(s, ipv4->Identification);
-	Stream_Write_UINT16_BE(s, (ipv4->InternetProtocolFlags << 13) | ipv4->FragmentOffset);
+	Stream_Write_UINT16_BE(s, (UINT16)((ipv4->InternetProtocolFlags << 13) | ipv4->FragmentOffset));
 	Stream_Write_UINT8(s, ipv4->TimeToLive);
 	Stream_Write_UINT8(s, ipv4->Protocol);
 	Stream_Write_UINT16(s, ipv4->HeaderChecksum);
@@ -340,7 +340,7 @@ static BOOL WLog_PacketMessage_Write_TcpHeader(wPcap* pcap, wTcpHeader* tcp)
 	Stream_Write_UINT16_BE(s, tcp->DestinationPort);
 	Stream_Write_UINT32_BE(s, tcp->SequenceNumber);
 	Stream_Write_UINT32_BE(s, tcp->AcknowledgementNumber);
-	Stream_Write_UINT8(s, (tcp->Offset << 4) | tcp->Reserved);
+	Stream_Write_UINT8(s, (UINT8)((tcp->Offset << 4) | (tcp->Reserved & 0xF)));
 	Stream_Write_UINT8(s, tcp->TcpFlags);
 	Stream_Write_UINT16_BE(s, tcp->Window);
 	Stream_Write_UINT16_BE(s, tcp->Checksum);