diff --git a/src/context.c b/src/context.c
index 1515f77b..41e7d3b2 100644
--- a/src/context.c
+++ b/src/context.c
@@ -756,7 +756,7 @@ _getdns_upstream_shutdown(getdns_upstream *upstream)
 	uint16_t conn_retries = upstream->upstreams->tls_connection_retries;
 	/* [TLS1]TODO: This arbitrary logic at the moment - review and improve!*/
 	if (upstream->conn_setup_failed >= conn_retries
-	    || (upstream->conn_shutdowns >= conn_retries*GETDNS_TRANSPORT_FAIL_MULT
+	    || ((int)upstream->conn_shutdowns >= conn_retries*GETDNS_TRANSPORT_FAIL_MULT
 	     && upstream->total_responses == 0)
 	    || (upstream->conn_completed >= conn_retries &&
 	     upstream->total_responses == 0 && 
diff --git a/src/pubkey-pinning.c b/src/pubkey-pinning.c
index 89ba5d86..a960ab66 100644
--- a/src/pubkey-pinning.c
+++ b/src/pubkey-pinning.c
@@ -382,7 +382,7 @@ _getdns_verify_pinset_match(const sha256_pin_t *pinset,
 			    X509_STORE_CTX *store)
 {
 	getdns_return_t ret = GETDNS_RETURN_GENERIC_ERROR;
-	X509 *x, *prev;
+	X509 *x, *prev = NULL;
 	int i, len;
 	unsigned char raw[4096];
 	unsigned char *next;