diff --git a/src/common/container.c b/src/common/container.c
index e1ed67856b..b138c9273c 100644
--- a/src/common/container.c
+++ b/src/common/container.c
@@ -90,6 +90,7 @@ void
 smartlist_add_all(smartlist_t *s1, const smartlist_t *s2)
 {
   smartlist_ensure_capacity(s1, s1->num_used + s2->num_used);
+  tor_assert(s1->capacity >= s1->num_used+s2->num_used);
   memcpy(s1->list + s1->num_used, s2->list, s2->num_used*sizeof(void*));
   s1->num_used += s2->num_used;
 }
diff --git a/src/or/config.c b/src/or/config.c
index 36dc9dfeda..5781682c12 100644
--- a/src/or/config.c
+++ b/src/or/config.c
@@ -4753,7 +4753,10 @@ or_state_load(void)
       log_warn(LD_BUG, "Unable to parse state in \"%s\". Moving it aside "
                "to \"%s\".  This could be a bug in Tor; please tell "
                "the developers.", fname, fname2);
-      (int)rename(fname, fname2);
+      if (rename(fname, fname2) < 0) {
+        log_warn(LD_BUG, "Weirdly, I couldn't even mode the state aside. The "
+                 "OS gave an error of %s", strerror(errno));
+      }
     }
     tor_free(fname2);
     tor_free(contents);
diff --git a/src/or/routerparse.c b/src/or/routerparse.c
index d4ce7bf7f9..9a22a0ed61 100644
--- a/src/or/routerparse.c
+++ b/src/or/routerparse.c
@@ -1126,13 +1126,15 @@ router_parse_entry_from_string(const char *s, const char *end,
   router->cache_info.signed_descriptor_len = end-s;
   if (cache_copy) {
     size_t len = router->cache_info.signed_descriptor_len +
-                router->cache_info.annotations_len;
+                 router->cache_info.annotations_len;
     char *cp =
       router->cache_info.signed_descriptor_body = tor_malloc(len+1);
     if (prepend_annotations) {
       memcpy(cp, prepend_annotations, prepend_len);
       cp += prepend_len;
     }
+    tor_assert(cp+(end-start_of_annotations) ==
+               router->cache_info.signed_descriptor_body+len);
     memcpy(cp, start_of_annotations, end-start_of_annotations);
     router->cache_info.signed_descriptor_body[len] = '\0';
     tor_assert(strlen(router->cache_info.signed_descriptor_body) == len);