diff --git a/src/switch_channel.c b/src/switch_channel.c
index 5b4a439b30..7119d0b174 100644
--- a/src/switch_channel.c
+++ b/src/switch_channel.c
@@ -635,9 +635,11 @@ SWITCH_DECLARE(switch_channel_state_t) switch_channel_perform_set_state(switch_c
 
 
 	switch_assert(channel != NULL);
+	switch_assert(state <= CS_DONE);
 	switch_mutex_lock(channel->flag_mutex);
 
 	last_state = channel->state;
+	switch_assert(last_state <= CS_DONE);
 
 	if (last_state == state) {
 		goto done;
@@ -1498,19 +1500,19 @@ SWITCH_DECLARE(char *) switch_channel_expand_variables(switch_channel_t *channel
 					char *expanded = NULL;
 					int offset = 0;
 					int ooffset = 0;
-					char *p;
+					char *ptr;
 
 					if ((expanded = switch_channel_expand_variables(channel, (char *)vname)) == vname) {
 						expanded = NULL;
 					} else {
 						vname = expanded;
 					}
-					if ((p = strchr(vname, ':'))) {
-						*p++ = '\0';
-						offset = atoi(p);
-						if ((p = strchr(p, ':'))) {
-							p++;
-							ooffset = atoi(p);
+					if ((ptr = strchr(vname, ':'))) {
+						*ptr++ = '\0';
+						offset = atoi(ptr);
+						if ((ptr = strchr(ptr, ':'))) {
+							ptr++;
+							ooffset = atoi(ptr);
 						}
 					}
 					
@@ -1528,8 +1530,8 @@ SWITCH_DECLARE(char *) switch_channel_expand_variables(switch_channel_t *channel
 					}
 
 					if (ooffset > 0 && (size_t)ooffset < strlen(sub_val)) {
-						if ((p = (char *)sub_val + ooffset)) {
-							*p = '\0';
+						if ((ptr = (char *)sub_val + ooffset)) {
+							*ptr = '\0';
 						}
 					}
 
diff --git a/src/switch_core_media_bug.c b/src/switch_core_media_bug.c
index ff443ffce4..facb92879e 100644
--- a/src/switch_core_media_bug.c
+++ b/src/switch_core_media_bug.c
@@ -128,9 +128,10 @@ SWITCH_DECLARE(switch_status_t) switch_core_media_bug_read(switch_media_bug_t *b
 
 
 	bytes = (datalen > frame->datalen) ? datalen : frame->datalen;
+	switch_assert( bytes <= maxlen );
 	
 	if (bytes) {
-		int16_t tmp[960], *tp = tmp;
+		int16_t tmp[SWITCH_RECOMMENDED_BUFFER_SIZE], *tp = tmp;
 		
 		dp = (int16_t *) data;
 		fp = (int16_t *) frame->data;
diff --git a/src/switch_ivr_originate.c b/src/switch_ivr_originate.c
index d1076402ce..42f0f21b5e 100644
--- a/src/switch_ivr_originate.c
+++ b/src/switch_ivr_originate.c
@@ -277,6 +277,13 @@ SWITCH_DECLARE(switch_status_t) switch_ivr_originate(switch_core_session_t *sess
 
 	*bleg = NULL;
 	odata = strdup(bridgeto);
+
+	if (!odata) {
+		switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_ERROR, "Memory Error!\n");
+		status = SWITCH_STATUS_MEMERR;
+		goto done;
+	}
+
 	data = odata;
 
 	/* strip leading spaces */