diff --git a/cmdline.c b/cmdline.c
index b9d068f6..8f656e53 100644
--- a/cmdline.c
+++ b/cmdline.c
@@ -858,9 +858,8 @@ int cmdline_process_param(const char *p, char *value,
 
 void cmdline_run_saved(Conf *conf)
 {
-    int pri, i;
-    for (pri = 0; pri < NPRIORITIES; pri++) {
-        for (i = 0; i < saves[pri].nsaved; i++) {
+    for (size_t pri = 0; pri < NPRIORITIES; pri++) {
+        for (size_t i = 0; i < saves[pri].nsaved; i++) {
             cmdline_process_param(saves[pri].params[i].p,
                                   saves[pri].params[i].value, 0, conf);
             sfree(saves[pri].params[i].p);
diff --git a/logging.c b/logging.c
index a12caa5a..31cbccfb 100644
--- a/logging.c
+++ b/logging.c
@@ -364,7 +364,7 @@ void log_packet(LogContext *ctx, int direction, int type,
                 c = 'X';
                 sprintf(smalldata, "XX");
             } else {  /* PKTLOG_EMIT */
-                c = ((unsigned char *)data)[p];
+                c = ((const unsigned char *)data)[p];
                 sprintf(smalldata, "%02x", c);
             }
             dumpdata[10+2+3*(p%16)] = smalldata[0];
diff --git a/mainchan.c b/mainchan.c
index 7722d4e8..3aad40d6 100644
--- a/mainchan.c
+++ b/mainchan.c
@@ -142,7 +142,7 @@ static void mainchan_open_confirmation(Channel *chan)
         struct X11FakeAuth *x11auth;
         bool retry_cmd_now = false;
 
-        if (conf_get_bool(mc->conf, CONF_x11_forward)) {;
+        if (conf_get_bool(mc->conf, CONF_x11_forward)) {
             char *x11_setup_err;
             if ((x11disp = x11_setup_display(
                      conf_get_str(mc->conf, CONF_x11_display),
diff --git a/mpint.c b/mpint.c
index cfd011be..34805d81 100644
--- a/mpint.c
+++ b/mpint.c
@@ -187,7 +187,7 @@ mp_int *mp_from_decimal_pl(ptrlen decimal)
 
     mp_int *x = mp_make_sized(words);
     for (size_t i = 0; i < decimal.len; i++) {
-        mp_add_integer_into(x, x, ((char *)decimal.ptr)[i] - '0');
+        mp_add_integer_into(x, x, ((const char *)decimal.ptr)[i] - '0');
 
         if (i+1 == decimal.len)
             break;
@@ -216,7 +216,7 @@ mp_int *mp_from_hex_pl(ptrlen hex)
     words = size_t_max(words, 1);
     mp_int *x = mp_make_sized(words);
     for (size_t nibble = 0; nibble < hex.len; nibble++) {
-        BignumInt digit = ((char *)hex.ptr)[hex.len-1 - nibble];
+        BignumInt digit = ((const char *)hex.ptr)[hex.len-1 - nibble];
 
         BignumInt lmask = ~-((BignumInt)((digit-'a')|('f'-digit))
                              >> (BIGNUM_INT_BITS-1));
diff --git a/pageant.c b/pageant.c
index 7cf9fdfc..ee386c7a 100644
--- a/pageant.c
+++ b/pageant.c
@@ -283,8 +283,8 @@ static void list_keys(BinarySink *bs, int ssh_version)
     }
 }
 
-void pageant_make_keylist1(BinarySink *bs) { return list_keys(bs, 1); }
-void pageant_make_keylist2(BinarySink *bs) { return list_keys(bs, 2); }
+void pageant_make_keylist1(BinarySink *bs) { list_keys(bs, 1); }
+void pageant_make_keylist2(BinarySink *bs) { list_keys(bs, 2); }
 
 void pageant_register_client(PageantClient *pc)
 {
diff --git a/putty.h b/putty.h
index 52cd90df..202fc022 100644
--- a/putty.h
+++ b/putty.h
@@ -1790,7 +1790,7 @@ void random_unref(void);
 void random_clear(void);
 /* random_setup_special is used by PuTTYgen. It makes an extra-big
  * random number generator. */
-void random_setup_special();
+void random_setup_special(void);
 /* Manually drop a random seed into the random number generator, e.g.
  * just before generating a key. */
 void random_reseed(ptrlen seed);
diff --git a/ssh.c b/ssh.c
index 69590d5c..cd33c7f4 100644
--- a/ssh.c
+++ b/ssh.c
@@ -457,7 +457,8 @@ static void ssh_initiate_connection_close(Ssh *ssh)
     va_list ap;                                 \
     va_start(ap, fmt);                          \
     msg = dupvprintf(fmt, ap);                  \
-    va_end(ap);
+    va_end(ap);                                 \
+    ((void)0) /* eat trailing semicolon */
 
 void ssh_remote_error(Ssh *ssh, const char *fmt, ...)
 {
diff --git a/ssh.h b/ssh.h
index 193116cb..d0be17e5 100644
--- a/ssh.h
+++ b/ssh.h
@@ -720,8 +720,8 @@ struct ssh_hashalg {
     void (*copyfrom)(ssh_hash *dest, ssh_hash *src);
     void (*digest)(ssh_hash *, unsigned char *);
     void (*free)(ssh_hash *);
-    int hlen; /* output length in bytes */
-    int blocklen; /* length of the hash's input block, or 0 for N/A */
+    size_t hlen; /* output length in bytes */
+    size_t blocklen; /* length of the hash's input block, or 0 for N/A */
     const char *text_basename;     /* the semantic name of the hash */
     const char *annotation;   /* extra info, e.g. which of multiple impls */
     const char *text_name;    /* both combined, e.g. "SHA-n (unaccelerated)" */
diff --git a/sshcr.h b/sshcr.h
index e4a3b310..e87ce864 100644
--- a/sshcr.h
+++ b/sshcr.h
@@ -25,19 +25,19 @@
  *    Database for Edit and Continue'.
  */
 
-#define crBegin(v)      { int *crLine = &v; switch(v) { case 0:;
+#define crBegin(v)      do { int *crLine = &v; switch(v) { case 0:
 #define crBeginState    crBegin(s->crLine)
 #define crStateP(t, v)                          \
     struct t *s;                                \
     if (!(v)) { s = (v) = snew(struct t); s->crLine = 0; }      \
     s = (v);
 #define crState(t)      crStateP(t, ssh->t)
-#define crFinish(z)     } *crLine = 0; return (z); }
-#define crFinishV       } *crLine = 0; return; }
-#define crFinishFreed(z) } return (z); }
-#define crFinishFreedV   } return; }
-#define crFinishFree(z) } sfree(s); return (z); }
-#define crFinishFreeV   } sfree(s); return; }
+#define crFinish(z)     } *crLine = 0; return (z); } while (0)
+#define crFinishV       } *crLine = 0; return; } while (0)
+#define crFinishFreed(z) } return (z); } while (0)
+#define crFinishFreedV   } return; } while (0)
+#define crFinishFree(z) } sfree(s); return (z); } while (0)
+#define crFinishFreeV   } sfree(s); return; } while (0)
 #define crReturn(z)     \
         do {\
             *crLine =__LINE__; return (z); case __LINE__:;\
diff --git a/sshpubk.c b/sshpubk.c
index 614324d1..87f86de2 100644
--- a/sshpubk.c
+++ b/sshpubk.c
@@ -1664,23 +1664,36 @@ int key_type(const Filename *filename)
 const char *key_type_to_str(int type)
 {
     switch (type) {
-      case SSH_KEYTYPE_UNOPENABLE: return "unable to open file"; break;
-      case SSH_KEYTYPE_UNKNOWN: return "not a recognised key file format"; break;
-      case SSH_KEYTYPE_SSH1_PUBLIC: return "SSH-1 public key"; break;
-      case SSH_KEYTYPE_SSH2_PUBLIC_RFC4716: return "SSH-2 public key (RFC 4716 format)"; break;
-      case SSH_KEYTYPE_SSH2_PUBLIC_OPENSSH: return "SSH-2 public key (OpenSSH format)"; break;
-      case SSH_KEYTYPE_SSH1: return "SSH-1 private key"; break;
-      case SSH_KEYTYPE_SSH2: return "PuTTY SSH-2 private key"; break;
-      case SSH_KEYTYPE_OPENSSH_PEM: return "OpenSSH SSH-2 private key (old PEM format)"; break;
-      case SSH_KEYTYPE_OPENSSH_NEW: return "OpenSSH SSH-2 private key (new format)"; break;
-      case SSH_KEYTYPE_SSHCOM: return "ssh.com SSH-2 private key"; break;
+      case SSH_KEYTYPE_UNOPENABLE:
+        return "unable to open file";
+      case SSH_KEYTYPE_UNKNOWN:
+        return "not a recognised key file format";
+      case SSH_KEYTYPE_SSH1_PUBLIC:
+        return "SSH-1 public key";
+      case SSH_KEYTYPE_SSH2_PUBLIC_RFC4716:
+        return "SSH-2 public key (RFC 4716 format)";
+      case SSH_KEYTYPE_SSH2_PUBLIC_OPENSSH:
+        return "SSH-2 public key (OpenSSH format)";
+      case SSH_KEYTYPE_SSH1:
+        return "SSH-1 private key";
+      case SSH_KEYTYPE_SSH2:
+        return "PuTTY SSH-2 private key";
+      case SSH_KEYTYPE_OPENSSH_PEM:
+        return "OpenSSH SSH-2 private key (old PEM format)";
+      case SSH_KEYTYPE_OPENSSH_NEW:
+        return "OpenSSH SSH-2 private key (new format)";
+      case SSH_KEYTYPE_SSHCOM:
+        return "ssh.com SSH-2 private key";
+
         /*
          * This function is called with a key type derived from
          * looking at an actual key file, so the output-only type
          * OPENSSH_AUTO should never get here, and is much an INTERNAL
          * ERROR as a code we don't even understand.
          */
-      case SSH_KEYTYPE_OPENSSH_AUTO: return "INTERNAL ERROR (OPENSSH_AUTO)"; break;
-      default: return "INTERNAL ERROR"; break;
+      case SSH_KEYTYPE_OPENSSH_AUTO:
+        unreachable("OPENSSH_AUTO should never reach key_type_to_str");
+      default:
+        unreachable("bad key type in key_type_to_str");
     }
 }
diff --git a/sshsh512.c b/sshsh512.c
index 3ea54a35..7a0eb918 100644
--- a/sshsh512.c
+++ b/sshsh512.c
@@ -150,19 +150,20 @@ static void SHA512_Block(SHA512_State *s, uint64_t *block) {
     for (t = 0; t < 80; t+=8) {
         uint64_t tmp, p, q, r;
 
-#define ROUND(j,a,b,c,d,e,f,g,h) \
-        bigsigma1(p, tmp, e); \
-        Ch(q, tmp, e, f, g); \
-        add(r, p, q); \
-        add(p, r, k[j]) ; \
-        add(q, p, w[j]); \
-        add(r, q, h); \
-        bigsigma0(p, tmp, a); \
-        Maj(tmp, q, a, b, c); \
-        add(q, tmp, p); \
-        add(p, r, d); \
-        d = p; \
-        add(h, q, r);
+#define ROUND(j,a,b,c,d,e,f,g,h) do {           \
+            bigsigma1(p, tmp, e);               \
+            Ch(q, tmp, e, f, g);                \
+            add(r, p, q);                       \
+            add(p, r, k[j]) ;                   \
+            add(q, p, w[j]);                    \
+            add(r, q, h);                       \
+            bigsigma0(p, tmp, a);               \
+            Maj(tmp, q, a, b, c);               \
+            add(q, tmp, p);                     \
+            add(p, r, d);                       \
+            d = p;                              \
+            add(h, q, r);                       \
+        } while (0)
 
         ROUND(t+0, a,b,c,d,e,f,g,h);
         ROUND(t+1, h,a,b,c,d,e,f,g);
diff --git a/windows/winnet.c b/windows/winnet.c
index 6ff0cebb..1f5a8d98 100644
--- a/windows/winnet.c
+++ b/windows/winnet.c
@@ -299,13 +299,12 @@ void sk_init(void)
     GET_WINDOWS_FUNCTION(winsock_module, getservbyname);
     GET_WINDOWS_FUNCTION(winsock_module, inet_addr);
     GET_WINDOWS_FUNCTION(winsock_module, inet_ntoa);
-#if (defined _MSC_VER && _MSC_VER < 1900) || defined __MINGW32__
     /* Older Visual Studio, and MinGW as of Ubuntu 16.04, don't know
-     * about this function at all, so can't type-check it */
+     * about this function at all, so can't type-check it. Also there
+     * seems to be some disagreement in the VS headers about whether
+     * the second argument is void * or const void *, so I omit the
+     * type check. */
     GET_WINDOWS_FUNCTION_NO_TYPECHECK(winsock_module, inet_ntop);
-#else
-    GET_WINDOWS_FUNCTION(winsock_module, inet_ntop);
-#endif
     GET_WINDOWS_FUNCTION(winsock_module, connect);
     GET_WINDOWS_FUNCTION(winsock_module, bind);
     GET_WINDOWS_FUNCTION(winsock_module, setsockopt);