diff --git a/src/common/crypto.c b/src/common/crypto.c
index b4659078bc..4fe2ae0e85 100644
--- a/src/common/crypto.c
+++ b/src/common/crypto.c
@@ -127,7 +127,7 @@ static int _crypto_global_initialized = 0;
 static void
 crypto_log_errors(int severity, const char *doing)
 {
-  int err;
+  unsigned int err;
   const char *msg, *lib, *func;
   while ((err = ERR_get_error()) != 0) {
     msg = (const char*)ERR_reason_error_string(err);
@@ -1398,7 +1398,7 @@ int crypto_seed_rng(void)
   RAND_screen();
   return 0;
 #else
-  static char *filenames[] = {
+  static const char *filenames[] = {
     "/dev/srandom", "/dev/urandom", "/dev/random", NULL
   };
   int fd;
diff --git a/src/common/log.c b/src/common/log.c
index 7073df18ad..8fbb343a91 100644
--- a/src/common/log.c
+++ b/src/common/log.c
@@ -124,11 +124,13 @@ static INLINE char *format_msg(char *buf, size_t buf_len,
       n += r;
   }
   
-  n += tor_vsnprintf(buf+n,buf_len-n,format,ap);
-  if(n < 0) {
+  r = tor_vsnprintf(buf+n,buf_len-n,format,ap);
+  if(r < 0) {
     n = buf_len-2;
     strlcpy(buf+buf_len-TRUNCATED_STR_LEN-1, TRUNCATED_STR,
             buf_len-(buf_len-TRUNCATED_STR_LEN-1));
+  } else {
+    n += r;
   }
   buf[n]='\n';
   buf[n+1]='\0';
diff --git a/src/common/tortls.c b/src/common/tortls.c
index eaef6468bf..051b9887df 100644
--- a/src/common/tortls.c
+++ b/src/common/tortls.c
@@ -210,7 +210,7 @@ tor_tls_create_certificate(crypto_pk_env_t *rsa,
     goto error;
   if ((nid = OBJ_txt2nid("organizationName")) == NID_undef) goto error;
   if (!(X509_NAME_add_entry_by_NID(name, nid, MBSTRING_ASC,
-                                   "TOR", -1, -1, 0))) goto error;
+                                   (char*)"TOR", -1, -1, 0))) goto error;
   if ((nid = OBJ_txt2nid("commonName")) == NID_undef) goto error;
   if (!(X509_NAME_add_entry_by_NID(name, nid, MBSTRING_ASC,
                                    (char*)cname, -1, -1, 0))) goto error;
@@ -221,7 +221,7 @@ tor_tls_create_certificate(crypto_pk_env_t *rsa,
     goto error;
   if ((nid = OBJ_txt2nid("organizationName")) == NID_undef) goto error;
   if (!(X509_NAME_add_entry_by_NID(name_issuer, nid, MBSTRING_ASC,
-                                   "TOR", -1, -1, 0))) goto error;
+                                   (char*)"TOR", -1, -1, 0))) goto error;
   if ((nid = OBJ_txt2nid("commonName")) == NID_undef) goto error;
   if (!(X509_NAME_add_entry_by_NID(name_issuer, nid, MBSTRING_ASC,
                                 (char*)cname_sign, -1, -1, 0))) goto error;
diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c
index 91213b72d9..4c7536da53 100644
--- a/src/or/circuitbuild.c
+++ b/src/or/circuitbuild.c
@@ -71,7 +71,7 @@ void circuit_log_path(int severity, circuit_t *circ) {
   char buf[1024];
   char *s = buf;
   struct crypt_path_t *hop;
-  char *states[] = {"closed", "waiting for keys", "open"};
+  const char *states[] = {"closed", "waiting for keys", "open"};
   routerinfo_t *router;
   tor_assert(CIRCUIT_IS_ORIGIN(circ));
   tor_assert(circ->cpath);
@@ -144,7 +144,7 @@ void circuit_rep_hist_note_result(circuit_t *circ) {
  */
 static void
 circuit_dump_details(int severity, circuit_t *circ, int poll_index,
-                     char *type, int this_circid, int other_circid) {
+                     const char *type, int this_circid, int other_circid) {
   struct crypt_path_t *hop;
   log(severity,"Conn %d has %s circuit: circID %d (other side %d), state %d (%s), born %d",
       poll_index, type, this_circid, other_circid, circ->state,
diff --git a/src/or/circuitlist.c b/src/or/circuitlist.c
index 5611a7eb09..dc90b9bc99 100644
--- a/src/or/circuitlist.c
+++ b/src/or/circuitlist.c
@@ -17,7 +17,7 @@ extern or_options_t options; /* command-line and config-file options */
 circuit_t *global_circuitlist=NULL;
 
 /** Array of strings to make circ-\>state human-readable */
-char *circuit_state_to_string[] = {
+const char *circuit_state_to_string[] = {
   "doing handshakes",        /* 0 */
   "processing the onion",    /* 1 */
   "connecting to firsthop",  /* 2 */
diff --git a/src/or/config.c b/src/or/config.c
index eb363f3eed..7b366f5593 100644
--- a/src/or/config.c
+++ b/src/or/config.c
@@ -28,8 +28,8 @@ typedef enum config_type_t {
 
 /* An abbreviation for a configuration option allowed on the command line */
 typedef struct config_abbrev_t {
-  char *abbreviated;
-  char *full;
+  const char *abbreviated;
+  const char *full;
   int commandline_only;
 } config_abbrev_t;
 
@@ -48,13 +48,13 @@ static config_abbrev_t config_abbrevs[] = {
   PLURAL(RendNode),
   PLURAL(RendExcludeNode),
   { "l",        "LogLevel" , 1},
-  { NULL, NULL },
+  { NULL, NULL , 0},
 };
 #undef PLURAL
 
 /* A variable allowed in the configuration file or on the command line */
 typedef struct config_var_t {
-  char *name; /**< The full keyword (case insensitive) */
+  const char *name; /**< The full keyword (case insensitive) */
   config_type_t type; /**< How to interpret the type and turn it into a value */
   off_t var_offset; /**< Offset of the corresponding member of or_options_t */
 } config_var_t;
@@ -411,8 +411,8 @@ config_assign_defaults(or_options_t *options)
   options->SocksPort = 9050;
 
   options->AllowUnverifiedNodes = smartlist_create();
-  smartlist_add(options->AllowUnverifiedNodes, "middle");
-  smartlist_add(options->AllowUnverifiedNodes, "rendezvous");
+  smartlist_add(options->AllowUnverifiedNodes, tor_strdup("middle"));
+  smartlist_add(options->AllowUnverifiedNodes, tor_strdup("rendezvous"));
 
   config_free_lines(options->ExitPolicy);
   options->ExitPolicy = NULL;
@@ -572,6 +572,11 @@ free_options(or_options_t *options)
     smartlist_free(options->FirewallPorts);
     options->FirewallPorts = NULL;
   }
+  if (options->AllowUnverifiedNodes) {
+    SMARTLIST_FOREACH(options->AllowUnverifiedNodes, char *, cp, tor_free(cp));
+    smartlist_free(options->AllowUnverifiedNodes);
+    options->AllowUnverifiedNodes = NULL;
+  }
 }
 
 /** Set <b>options</b> to hold reasonable defaults for most options.
diff --git a/src/or/connection.c b/src/or/connection.c
index 0c3908ff04..5a7f2588ad 100644
--- a/src/or/connection.c
+++ b/src/or/connection.c
@@ -16,7 +16,7 @@ extern or_options_t options; /* command-line and config-file options */
 extern int shutting_down; /* whether we should refuse new connections */
 
 /** Array of strings to make conn-\>type human-readable. */
-char *conn_type_to_string[] = {
+const char *conn_type_to_string[] = {
   "",            /* 0 */
   "OP listener", /* 1 */
   "OP",          /* 2 */
@@ -32,7 +32,7 @@ char *conn_type_to_string[] = {
 };
 
 /** Array of string arrays to make {conn-\>type,conn-\>state} human-readable. */
-char *conn_state_to_string[][_CONN_TYPE_MAX+1] = {
+const char *conn_state_to_string[][_CONN_TYPE_MAX+1] = {
   { NULL }, /* no type associated with 0 */
   { NULL }, /* op listener, obsolete */
   { NULL }, /* op, obsolete */
diff --git a/src/or/connection_edge.c b/src/or/connection_edge.c
index 6db4b5237a..bb2ca80af8 100644
--- a/src/or/connection_edge.c
+++ b/src/or/connection_edge.c
@@ -11,7 +11,6 @@
 #include "tree.h"
 
 extern or_options_t options; /* command-line and config-file options */
-extern char *conn_state_to_string[][_CONN_TYPE_MAX+1]; /* from connection.c */
 
 static struct exit_policy_t *socks_policy = NULL;
 
diff --git a/src/or/directory.c b/src/or/directory.c
index 7b5b7fafd7..038e4865bb 100644
--- a/src/or/directory.c
+++ b/src/or/directory.c
@@ -314,7 +314,7 @@ directory_send_command(connection_t *conn, const char *platform,
   char hoststring[128];
   char url[128];
   int use_newer = 0;
-  char *httpcommand = NULL;
+  const char *httpcommand = NULL;
 
   tor_assert(conn);
   tor_assert(conn->type == CONN_TYPE_DIR);
diff --git a/src/or/main.c b/src/or/main.c
index b665b506ac..09836af4c2 100644
--- a/src/or/main.c
+++ b/src/or/main.c
@@ -16,9 +16,6 @@ static int init_from_config(int argc, char **argv);
 
 /********* START VARIABLES **********/
 
-/* declared in connection.c */
-extern char *conn_state_to_string[][_CONN_TYPE_MAX+1];
-
 or_options_t options; /**< Command-line and config-file options. */
 int global_read_bucket; /**< Max number of bytes I can read this second. */
 int global_write_bucket; /**< Max number of bytes I can write this second. */
diff --git a/src/or/or.h b/src/or/or.h
index 92bf66e97b..38f0e553ec 100644
--- a/src/or/or.h
+++ b/src/or/or.h
@@ -478,8 +478,8 @@ struct connection_t {
   int marked_for_close; /**< Boolean: should we close this conn on the next
                          * iteration of the main loop?
                          */
-  char *marked_for_close_file; /**< For debugging: in which file were we marked
-                                * for close? */
+  const char *marked_for_close_file; /**< For debugging: in which file were
+                                      * we marked for close? */
   int hold_open_until_flushed; /**< Despite this connection's being marked
                                 * for close, do we flush it before closing it?
                                 */
@@ -708,8 +708,8 @@ struct circuit_t {
 
   int marked_for_close; /**< Should we close this circuit at the end of the
                          * main loop? */
-  char *marked_for_close_file; /**< For debugging: in which file was this
-                                * circuit marked for close? */
+  const char *marked_for_close_file; /**< For debugging: in which file was this
+                                      * circuit marked for close? */
 
   /** The IPv4 address of the OR that is next in this circuit. */
   uint32_t n_addr;
@@ -990,7 +990,7 @@ void onion_append_to_cpath(crypt_path_t **head_ptr, crypt_path_t *new_hop);
 
 /********************************* circuitlist.c ***********************/
 
-extern char *circuit_state_to_string[];
+extern const char *circuit_state_to_string[];
 void circuit_close_all_marked(void);
 circuit_t *circuit_new(uint16_t p_circ_id, connection_t *p_conn);
 void circuit_free_cpath_node(crypt_path_t *victim);
@@ -1071,8 +1071,8 @@ const char *get_data_directory(or_options_t *options);
 #define CONN_TYPE_TO_STRING(t) (((t) < _CONN_TYPE_MIN || (t) > _CONN_TYPE_MAX) ? \
   "Unknown" : conn_type_to_string[(t)])
 
-extern char *conn_type_to_string[];
-extern char *conn_state_to_string[][_CONN_TYPE_MAX+1];
+extern const char *conn_type_to_string[];
+extern const char *conn_state_to_string[][_CONN_TYPE_MAX+1];
 
 connection_t *connection_new(int type);
 void connection_free(connection_t *conn);
@@ -1443,7 +1443,8 @@ routerinfo_t *routerlist_find_my_routerinfo(void);
 int router_nickname_matches(routerinfo_t *router, const char *nickname);
 int router_is_unreliable_router(routerinfo_t *router, int need_uptime, int need_bw);
 routerinfo_t *routerlist_sl_choose_by_bandwidth(smartlist_t *sl);
-routerinfo_t *router_choose_random_node(char *preferred, char *excluded,
+routerinfo_t *router_choose_random_node(const char *preferred,
+                                        const char *excluded,
                                         struct smartlist_t *excludedsmartlist,
                                         int preferuptime, int preferbandwidth,
                                         int allow_unverified, int strict);
diff --git a/src/or/router.c b/src/or/router.c
index c0d6947e99..3dc145bd9b 100644
--- a/src/or/router.c
+++ b/src/or/router.c
@@ -449,7 +449,7 @@ static void router_add_exit_policy_from_config(routerinfo_t *router) {
 
   /* Else, append the default exitpolicy. */
   default_policy.key = NULL;
-  default_policy.value = DEFAULT_EXIT_POLICY;
+  default_policy.value = (char*)DEFAULT_EXIT_POLICY;
   default_policy.next = NULL;
   config_parse_exit_policy(&default_policy, &router->exit_policy);
 }
diff --git a/src/or/routerlist.c b/src/or/routerlist.c
index 37c6cb7e51..93f8e1652e 100644
--- a/src/or/routerlist.c
+++ b/src/or/routerlist.c
@@ -458,7 +458,8 @@ routerlist_sl_choose_by_bandwidth(smartlist_t *sl)
  * available.  If <b>strict</b> is true, never pick any node besides
  * those in <b>preferred</b>.
  */
-routerinfo_t *router_choose_random_node(char *preferred, char *excluded,
+routerinfo_t *router_choose_random_node(const char *preferred,
+                                        const char *excluded,
                                         smartlist_t *excludedsmartlist,
                                         int preferuptime, int preferbandwidth,
                                         int allow_unverified, int strict)
@@ -1112,7 +1113,7 @@ int routers_update_status_from_entry(smartlist_t *routers,
     ++cp;
     if (strlen(cp) != HEX_DIGEST_LEN) {
       log_fn(LOG_WARN, "Bad length (%d) on digest in router status entry (%s)",
-             strlen(cp), s);
+             (int)strlen(cp), s);
       return -1;
     }
     strlcpy(hexdigest, cp, sizeof(hexdigest));
diff --git a/src/or/routerparse.c b/src/or/routerparse.c
index 31f308d2ae..71bd0f421b 100644
--- a/src/or/routerparse.c
+++ b/src/or/routerparse.c
@@ -64,7 +64,7 @@ typedef struct directory_token_t {
   size_t object_size;             /**< Bytes in object_body */
   char *object_body;           /**< Contents of object, base64-decoded. */
   crypto_pk_env_t *key;        /**< For public keys only. */
-  char *error;                 /**< For _ERR tokens only. */
+  const char *error;           /**< For _ERR tokens only. */
 } directory_token_t;
 
 /* ********************************************************************** */
@@ -95,7 +95,7 @@ typedef enum {
 
 /** Table mapping keywords to token value and to argument rules. */
 static struct {
-  char *t; int v; arg_syntax s; obj_syntax os; where_syntax ws;
+  const char *t; int v; arg_syntax s; obj_syntax os; where_syntax ws;
 } token_table[] = {
   { "accept",              K_ACCEPT,              ARGS,    NO_OBJ,  RTR_ONLY },
   { "directory-signature", K_DIRECTORY_SIGNATURE, ARGS,    NEED_OBJ,DIR_ONLY},