Index: src/cgi.c
==================================================================
--- src/cgi.c
+++ src/cgi.c
@@ -1596,15 +1596,14 @@
 void cgi_handle_scgi_request(void){
   char *zHdr;
   char *zToFree;
   int nHdr = 0;
   int nRead;
-  int n, m;
-  char c;
+  int c, n, m;
 
-  while( (c = fgetc(g.httpIn))!=EOF && fossil_isdigit(c) ){
-    nHdr = nHdr*10 + c - '0';
+  while( (c = fgetc(g.httpIn))!=EOF && fossil_isdigit((char)c) ){
+    nHdr = nHdr*10 + (char)c - '0';
   }
   if( nHdr<16 ) malformed_request("SCGI header too short");
   zToFree = zHdr = fossil_malloc(nHdr);
   nRead = (int)fread(zHdr, 1, nHdr, g.httpIn);
   if( nRead<nHdr ) malformed_request("cannot read entire SCGI header");

Index: src/diff.c
==================================================================
--- src/diff.c
+++ src/diff.c
@@ -594,11 +594,11 @@
     "<td><div class=\"diff%scol\">\n"
     "<pre>\n"
     "%s"
     "</pre>\n"
     "</div></td>\n",
-    col % 3 ? (col == SBS_MKR ? "mkr" : "txt") : "ln",
+    (col % 3) ? (col == SBS_MKR ? "mkr" : "txt") : "ln",
     blob_str(pCol)
   );
 }
 
 /*

Index: src/diffcmd.c
==================================================================
--- src/diffcmd.c
+++ src/diffcmd.c
@@ -28,10 +28,15 @@
 #  define NULL_DEVICE "NUL"
 #else
 #  define NULL_DEVICE "/dev/null"
 #endif
 
+/*
+** Used when the name for the diff is unknown.
+*/
+#define DIFF_NO_NAME  "(unknown)"
+
 /*
 ** Print the "Index:" message that patches wants to see at the top of a diff.
 */
 void diff_print_index(const char *zFile, u64 diffFlags){
   if( (diffFlags & (DIFF_SIDEBYSIDE|DIFF_BRIEF))==0 ){
@@ -489,11 +494,18 @@
   u64 diffFlags
 ){
   Blob f1, f2;
   int isBin1, isBin2;
   int rid;
-  const char *zName =  pFrom ? pFrom->zName : pTo->zName;
+  const char *zName;
+  if( pFrom ){
+    zName = pFrom->zName;
+  }else if( pTo ){
+    zName = pTo->zName;
+  }else{
+    zName = DIFF_NO_NAME;
+  }
   if( diffFlags & DIFF_BRIEF ) return;
   diff_print_index(zName, diffFlags);
   if( pFrom ){
     rid = uuid_to_rid(pFrom->zUuid, 0);
     content_get(rid, &f1);

Index: src/markdown.c
==================================================================
--- src/markdown.c
+++ src/markdown.c
@@ -390,11 +390,11 @@
      && data[i]!='>'
      && data[i]!='\''
      && data[i]!='"'
      && data[i]!=' '
      && data[i]!='\t'
-     && data[i]!='\t'
+     && data[i]!='\n'
     ){
       i++;
     }
     if( i>=size ) return 0;
     if( i>j && data[i]=='>' ) return i+1;

Index: src/url.c
==================================================================
--- src/url.c
+++ src/url.c
@@ -238,10 +238,11 @@
     zFile = mprintf("%s/FOSSIL", zUrl);
     if( file_isfile(zFile) ){
       pUrlData->isFile = 1;
     }else{
       free(zFile);
+      zFile = 0;
       fossil_fatal("unknown repository: %s", zUrl);
     }
   }else{
     fossil_fatal("unknown repository: %s", zUrl);
   }
@@ -249,10 +250,11 @@
   if( pUrlData->isFile ){
     Blob cfile;
     dehttpize(zFile);
     file_canonical_name(zFile, &cfile, 0);
     free(zFile);
+    zFile = 0;
     pUrlData->protocol = "file";
     pUrlData->path = "";
     pUrlData->name = mprintf("%b", &cfile);
     pUrlData->canonical = mprintf("file://%T", pUrlData->name);
     blob_reset(&cfile);