4 files changed, 8 insertions, 1 deletions
diff --git a/src/nvim/api/private/converter.c b/src/nvim/api/private/converter.c
index e370c0d4d4..3d4ff202fe 100644
--- a/src/nvim/api/private/converter.c
+++ b/src/nvim/api/private/converter.c
@@ -233,6 +233,7 @@ Object vim_to_object(typval_T *obj)
 {
   if (obj->v_type == VAR_FUNC) {
     ufunc_T *fp = find_func(obj->vval.v_string);
+    assert(fp != NULL);
     if (fp->uf_cb == nlua_CFunction_func_call) {
       LuaRef ref = api_new_luaref(((LuaCFunctionState *)fp->uf_cb_state)->lua_callable.func_ref);
       return LUAREF_OBJ(ref);
diff --git a/src/nvim/api/vim.c b/src/nvim/api/vim.c
index cc622a00dc..7c194935ce 100644
--- a/src/nvim/api/vim.c
+++ b/src/nvim/api/vim.c
@@ -2283,6 +2283,11 @@ Dictionary nvim_eval_statusline(String str, Dict(eval_statusline) *opts, Error *
     fillchar = ' ';
   } else {
     wp = find_window_by_handle(window, err);
+
+    if (wp == NULL) {
+      api_set_error(err, kErrorTypeException, "unknown winid %d", window);
+      return result;
+    }
     ewp = wp;
 
     if (fillchar == 0) {
diff --git a/src/nvim/buffer.c b/src/nvim/buffer.c
index abd22fba26..0248d42f58 100644
--- a/src/nvim/buffer.c
+++ b/src/nvim/buffer.c
@@ -4351,7 +4351,7 @@ int build_stl_str_hl(win_T *wp, char_u *out, size_t outlen, char_u *fmt, int use
     // Only free the string buffer if we allocated it.
     // Note: This is not needed if `str` is pointing at `tmp`
     if (opt == STL_VIM_EXPR) {
-      xfree(str);
+      XFREE_CLEAR(str);
     }
 
     if (num >= 0 || (!itemisflag && str && *str)) {
diff --git a/src/nvim/lua/converter.c b/src/nvim/lua/converter.c
index f9a2533d4e..0fbd56ed53 100644
--- a/src/nvim/lua/converter.c
+++ b/src/nvim/lua/converter.c
@@ -619,6 +619,7 @@ bool nlua_push_typval(lua_State *lstate, typval_T *const tv, bool special)
   }
   if (tv->v_type == VAR_FUNC) {
     ufunc_T *fp = find_func(tv->vval.v_string);
+    assert(fp != NULL);
     if (fp->uf_cb == nlua_CFunction_func_call) {
       nlua_pushref(lstate, ((LuaCFunctionState *)fp->uf_cb_state)->lua_callable.func_ref);
       return true;