Merge pull request #774 from 4144/mapchecks

Add missing checks to some files in map server

9 files changed, 239 insertions, 23 deletions

diff --git a/src/map/elemental.c b/src/map/elemental.c
index 1ab93f6c5..226b6e443 100644
--- a/src/map/elemental.c
+++ b/src/map/elemental.c
@@ -159,6 +159,7 @@ int elemental_get_lifetime(struct elemental_data *ed) {
 }
 
 int elemental_save(struct elemental_data *ed) {
+	nullpo_retr(1, ed);
 	ed->elemental.mode = ed->battle_status.mode;
 	ed->elemental.hp = ed->battle_status.hp;
 	ed->elemental.sp = ed->battle_status.sp;
@@ -226,7 +227,8 @@ int elemental_delete(struct elemental_data *ed, int reply) {
 }
 
 void elemental_summon_init(struct elemental_data *ed) {
-	if( ed->summon_timer == INVALID_TIMER )
+	nullpo_retv(ed);
+	if (ed->summon_timer == INVALID_TIMER)
 		ed->summon_timer = timer->add(timer->gettick() + ed->elemental.life_time, elemental->summon_end_timer, ed->master->bl.id, 0);
 
 	ed->regen.state.block = 0;
@@ -236,8 +238,10 @@ int elemental_data_received(struct s_elemental *ele, bool flag) {
 	struct map_session_data *sd;
 	struct elemental_data *ed;
 	struct s_elemental_db *db;
-	int i = elemental->search_index(ele->class_);
+	int i;
 
+	nullpo_ret(ele);
+	i = elemental->search_index(ele->class_);
 	if( (sd = map->charid2sd(ele->char_id)) == NULL )
 		return 0;
 
@@ -545,6 +549,7 @@ int elemental_change_mode(struct elemental_data *ed, int mode) {
 }
 
 void elemental_heal(struct elemental_data *ed, int hp, int sp) {
+	nullpo_retv(ed);
 	if( hp )
 		clif->elemental_updatestatus(ed->master, SP_HP);
 	if( sp )
@@ -594,8 +599,10 @@ struct skill_condition elemental_skill_get_requirements(uint16 skill_id, uint16
 }
 
 int elemental_set_target( struct map_session_data *sd, struct block_list *bl ) {
-	struct elemental_data *ed = sd->ed;
+	struct elemental_data *ed;
 
+	nullpo_ret(sd);
+	ed = sd->ed;
 	nullpo_ret(ed);
 	nullpo_ret(bl);
 
@@ -619,7 +626,9 @@ int elemental_ai_sub_timer_activesearch(struct block_list *bl, va_list ap) {
 	nullpo_ret(bl);
 
 	ed = va_arg(ap,struct elemental_data *);
+	nullpo_ret(ed);
 	target = va_arg(ap,struct block_list**);
+	nullpo_ret(target);
 
 	//If can't seek yet, not an enemy, or you can't attack it, skip.
 	if( (*target) == bl || !status->check_skilluse(&ed->bl, bl, 0, 0) )
@@ -765,6 +774,7 @@ int elemental_ai_sub_timer(struct elemental_data *ed, struct map_session_data *s
 
 int elemental_ai_sub_foreachclient(struct map_session_data *sd, va_list ap) {
 	int64 tick = va_arg(ap,int64);
+	nullpo_ret(sd);
 	if(sd->status.ele_id && sd->ed)
 		elemental->ai_sub_timer(sd->ed,sd,tick);
 
diff --git a/src/map/guild.c b/src/map/guild.c
index 6360e3e1f..5776db4bc 100644
--- a/src/map/guild.c
+++ b/src/map/guild.c
@@ -66,6 +66,7 @@ int guild_skill_get_max (int id) {
 // Retrieve skill_lv learned by guild
 int guild_checkskill(struct guild *g, int id) {
 	int idx = id - GD_SKILLBASE;
+	nullpo_ret(g);
 	if (idx < 0 || idx >= MAX_GUILDSKILL)
 		return 0;
 	return g->skill[idx].lv;
@@ -130,8 +131,10 @@ int guild_check_skill_require(struct guild *g,int id)
 bool guild_read_castledb(char* str[], int columns, int current)
 {// <castle id>,<map name>,<castle name>,<castle event>[,<reserved/unused switch flag>]
 	struct guild_castle *gc;
-	int index = mapindex->name2id(str[1]);
+	int index;
 
+	nullpo_retr(false, str);
+	index = mapindex->name2id(str[1]);
 	if (map->mapindex2mapid(index) < 0) // Map not found or on another map-server
 		return false;
 
@@ -160,6 +163,7 @@ struct guild* guild_searchname(char* str)
 	struct guild* g;
 	DBIterator *iter = db_iterator(guild->db);
 
+	nullpo_retr(NULL, str);
 	for( g = dbi_first(iter); dbi_exists(iter); g = dbi_next(iter) )
 	{
 		if( strcmpi(g->name, str) == 0 )
@@ -236,6 +240,7 @@ int guild_getposition(struct guild* g, struct map_session_data* sd)
 void guild_makemember(struct guild_member *m,struct map_session_data *sd)
 {
 	nullpo_retv(sd);
+	nullpo_retv(m);
 
 	memset(m,0,sizeof(struct guild_member));
 	m->account_id = sd->status.account_id;
@@ -326,6 +331,7 @@ int guild_send_xy_timer(int tid, int64 tick, int id, intptr_t data) {
 
 int guild_send_dot_remove(struct map_session_data *sd)
 {
+	nullpo_ret(sd);
 	if (sd->status.guild_id)
 		clif->guild_xy_remove(sd);
 	return 0;
@@ -337,6 +343,7 @@ int guild_create(struct map_session_data *sd, const char *name)
 	char tname[NAME_LENGTH];
 	struct guild_member m;
 	nullpo_ret(sd);
+	nullpo_ret(name);
 
 	safestrncpy(tname, name, NAME_LENGTH);
 	trim(tname);
@@ -716,6 +723,7 @@ void guild_member_joined(struct map_session_data *sd)
 {
 	struct guild* g;
 	int i;
+	nullpo_retv(sd);
 	g=guild->search(sd->status.guild_id);
 	if (!g) {
 		guild->request_info(sd->status.guild_id);
@@ -791,6 +799,7 @@ int guild_member_added(int guild_id,int account_id,int char_id,int flag) {
 
 /*==========================================
  * Player request leaving a given guild_id
+ * mes - non null terminated string
  *----------------------------------------*/
 int guild_leave(struct map_session_data* sd, int guild_id, int account_id, int char_id, const char* mes)
 {
@@ -819,6 +828,7 @@ int guild_leave(struct map_session_data* sd, int guild_id, int account_id, int c
 
 /*==========================================
  * Request remove a player to a given guild_id
+ * mes - non null terminated string
  *----------------------------------------*/
 int guild_expulsion(struct map_session_data* sd, int guild_id, int account_id, int char_id, const char* mes) {
 	struct map_session_data *tsd;
@@ -1071,6 +1081,7 @@ int guild_change_memberposition(int guild_id,int account_id,int char_id,short id
 int guild_memberposition_changed(struct guild *g,int idx,int pos)
 {
 	nullpo_ret(g);
+	Assert_ret(idx > 0 && idx < MAX_GUILD);
 
 	g->member[idx].position=pos;
 	clif->guild_memberpositionchanged(g,idx);
@@ -1087,6 +1098,7 @@ int guild_memberposition_changed(struct guild *g,int idx,int pos)
 int guild_change_position(int guild_id,int idx,int mode,int exp_mode,const char *name)
 {
 	struct guild_position p;
+	nullpo_ret(name);
 
 	exp_mode = cap_value(exp_mode, 0, battle_config.guild_exp_limit);
 	p.mode=mode&GPERM_BOTH; // Invite and Expel
@@ -1102,6 +1114,8 @@ int guild_position_changed(int guild_id,int idx,struct guild_position *p)
 {
 	struct guild *g=guild->search(guild_id);
 	int i;
+	nullpo_ret(p);
+	Assert_ret(idx > 0 && idx < MAX_GUILD);
 	if(g==NULL)
 		return 0;
 	memcpy(&g->position[idx],p,sizeof(struct guild_position));
@@ -1133,6 +1147,8 @@ int guild_notice_changed(int guild_id,const char *mes1,const char *mes2)
 {
 	int i;
 	struct guild *g=guild->search(guild_id);
+	nullpo_ret(mes1);
+	nullpo_ret(mes2);
 	if(g==NULL)
 		return 0;
 
@@ -1172,6 +1188,7 @@ int guild_emblem_changed(int len,int guild_id,int emblem_id,const char *data)
 	int i;
 	struct map_session_data *sd;
 	struct guild *g=guild->search(guild_id);
+	nullpo_ret(data);
 	if(g==NULL)
 		return 0;
 
@@ -1232,6 +1249,7 @@ DBData create_expcache(DBKey key, va_list args)
 	struct map_session_data *sd = va_arg(args, struct map_session_data*);
 
 	c = ers_alloc(guild->expcache_ers, struct guild_expcache);
+	nullpo_retr(DB->ptr2data(c), sd);
 	c->guild_id = sd->status.guild_id;
 	c->account_id = sd->status.account_id;
 	c->char_id = sd->status.char_id;
@@ -1324,6 +1342,7 @@ int guild_skillupack(int guild_id,uint16 skill_id,int account_id) {
 	int i;
 	if(g==NULL)
 		return 0;
+	Assert_ret(skill_id >= GD_SKILLBASE && skill_id - GD_SKILLBASE < MAX_GUILDSKILL);
 	if( sd != NULL ) {
 		clif->skillup(sd,skill_id,g->skill[skill_id-GD_SKILLBASE].lv, 0);
 
@@ -1349,6 +1368,7 @@ int guild_skillupack(int guild_id,uint16 skill_id,int account_id) {
 void guild_guildaura_refresh(struct map_session_data *sd, uint16 skill_id, uint16 skill_lv) {
 	struct skill_unit_group* group = NULL;
 	int type = status->skill2sc(skill_id);
+	nullpo_retv(sd);
 	if( !(battle_config.guild_aura&((map->agit_flag || map->agit2_flag)?2:1))
 	 && !(battle_config.guild_aura&(map_flag_gvg2(sd->bl.m)?8:4)) )
 		return;
@@ -1598,6 +1618,8 @@ int guild_allianceack(int guild_id1,int guild_id2,int account_id1,int account_id
 	struct map_session_data *sd[2] = { NULL };
 	int j,i;
 
+	nullpo_ret(name1);
+	nullpo_ret(name2);
 	guild_id[0] = guild_id1;
 	guild_id[1] = guild_id2;
 	guild_name[0] = name1;
@@ -1851,6 +1873,7 @@ int guild_break(struct map_session_data *sd,char *name) {
 	int i;
 
 	nullpo_ret(sd);
+	nullpo_ret(name);
 
 	if( (g=sd->guild)==NULL )
 		return 0;
@@ -2135,6 +2158,7 @@ bool guild_isallied(int guild_id, int guild_id2)
 void guild_flag_add(struct npc_data *nd) {
 	int i;
 
+	nullpo_retv(nd);
 	/* check */
 	for( i = 0; i < guild->flags_count; i++ ) {
 		if( guild->flags[i] && guild->flags[i]->bl.id == nd->bl.id ) {
@@ -2151,6 +2175,7 @@ void guild_flag_add(struct npc_data *nd) {
 
 void guild_flag_remove(struct npc_data *nd) {
 	int i, cursor;
+	nullpo_retv(nd);
 	if( guild->flags_count == 0 )
 		return;
 	/* find it */
diff --git a/src/map/homunculus.c b/src/map/homunculus.c
index 874d26fdb..2490bc659 100644
--- a/src/map/homunculus.c
+++ b/src/map/homunculus.c
@@ -49,6 +49,7 @@ struct homunculus_interface *homun;
 
 //Returns the viewdata for homunculus
 struct view_data* homunculus_get_viewdata(int class_) {
+	Assert_retr(NULL, class_ >= HM_CLASS_BASE && class_ - HM_CLASS_BASE < MAX_HOMUNCULUS_CLASS);
 	if (homdb_checkid(class_))
 		return &homun->dbs->viewdb[class_-HM_CLASS_BASE];
 	return NULL;
@@ -122,8 +123,11 @@ void homunculus_damaged(struct homun_data *hd) {
 
 int homunculus_dead(struct homun_data *hd) {
 	//There's no intimacy penalties on death (from Tharis)
-	struct map_session_data *sd = hd->master;
+	struct map_session_data *sd;
 
+	nullpo_retr(3, hd);
+	sd = hd->master;
+	nullpo_retr(3, sd);
 	clif->emotion(&hd->bl, E_WAH);
 
 	//Delete timers when dead.
@@ -195,6 +199,7 @@ int homunculus_calc_skilltree(struct homun_data *hd, int flag_evolve) {
 	/* load previous homunculus form skills first. */
 	if( hd->homunculus.prev_class != 0 ) {
 		c = hd->homunculus.prev_class - HM_CLASS_BASE;
+		Assert_ret(c >= 0 && c < MAX_HOMUNCULUS_CLASS);
 
 		for( i = 0; i < MAX_SKILL_TREE && ( id = homun->dbs->skill_tree[c][i].id ) > 0; i++ ) {
 			if( hd->homunculus.hskill[ id - HM_SKILLBASE ].id )
@@ -216,6 +221,7 @@ int homunculus_calc_skilltree(struct homun_data *hd, int flag_evolve) {
 	}
 
 	c = hd->homunculus.class_ - HM_CLASS_BASE;
+	Assert_ret(c >= 0 && c < MAX_HOMUNCULUS_CLASS);
 
 	for( i = 0; i < MAX_SKILL_TREE && ( id = homun->dbs->skill_tree[c][i].id ) > 0; i++ ) {
 		if( hd->homunculus.hskill[ id - HM_SKILLBASE ].id )
@@ -246,6 +252,7 @@ int homunculus_checkskill(struct homun_data *hd,uint16 skill_id) {
 	if(!hd)
 		return 0;
 
+	Assert_ret(i >= 0 && i < MAX_HOMUNSKILL);
 	if(hd->homunculus.hskill[i].id == skill_id)
 		return (hd->homunculus.hskill[i].lv);
 
@@ -255,6 +262,7 @@ int homunculus_checkskill(struct homun_data *hd,uint16 skill_id) {
 int homunculus_skill_tree_get_max(int id, int b_class) {
 	int i, skill_id;
 	b_class -= HM_CLASS_BASE;
+	Assert_ret(b_class >= 0 && b_class < MAX_HOMUNCULUS_CLASS);
 	for(i=0;(skill_id=homun->dbs->skill_tree[b_class][i].id)>0;i++)
 		if (id == skill_id)
 			return homun->dbs->skill_tree[b_class][i].max;
@@ -269,6 +277,7 @@ void homunculus_skillup(struct homun_data *hd,uint16 skill_id) {
 		return;
 
 	i = skill_id - HM_SKILLBASE;
+	Assert_retv(i >= 0 && i < MAX_HOMUNSKILL);
 	if(hd->homunculus.skillpts > 0 &&
 		hd->homunculus.hskill[i].id &&
 		hd->homunculus.hskill[i].flag == SKILL_FLAG_PERMANENT && //Don't allow raising while you have granted skills. [Skotlex]
@@ -293,6 +302,7 @@ bool homunculus_levelup(struct homun_data *hd) {
 	int growth_max_hp, growth_max_sp;
 	enum homun_type htype;
 
+	nullpo_retr(false, hd);
 	if( (htype = homun->class2type(hd->homunculus.class_)) == HT_INVALID ) {
 		ShowError("homunculus_levelup: Invalid class %d. \n", hd->homunculus.class_);
 		return false;
@@ -365,8 +375,8 @@ bool homunculus_levelup(struct homun_data *hd) {
 }
 
 int homunculus_change_class(struct homun_data *hd, short class_) {
-	int i;
-	i = homun->db_search(class_,HOMUNCULUS_CLASS);
+	int i = homun->db_search(class_,HOMUNCULUS_CLASS);
+	nullpo_retr(0, hd);
 	if(i < 0)
 		return 0;
 	hd->homunculusDB = &homun->dbs->db[i];
@@ -477,6 +487,7 @@ bool homunculus_mutate(struct homun_data *hd, int homun_id) {
 int homunculus_gainexp(struct homun_data *hd,unsigned int exp) {
 	enum homun_type htype;
 
+	nullpo_ret(hd);
 	if(hd->homunculus.vaporize != HOM_ST_ACTIVE)
 		return 1;
 
@@ -518,6 +529,7 @@ int homunculus_gainexp(struct homun_data *hd,unsigned int exp) {
 
 // Return the new value
 unsigned int homunculus_add_intimacy(struct homun_data *hd, unsigned int value) {
+	nullpo_ret(hd);
 	if (battle_config.homunculus_friendly_rate != 100)
 		value = (value * battle_config.homunculus_friendly_rate) / 100;
 
@@ -530,6 +542,7 @@ unsigned int homunculus_add_intimacy(struct homun_data *hd, unsigned int value)
 
 // Return 0 if decrease fails or intimacy became 0 else the new value
 unsigned int homunculus_consume_intimacy(struct homun_data *hd, unsigned int value) {
+	nullpo_ret(hd);
 	if (hd->homunculus.intimacy >= value)
 		hd->homunculus.intimacy -= value;
 	else
@@ -539,15 +552,19 @@ unsigned int homunculus_consume_intimacy(struct homun_data *hd, unsigned int val
 }
 
 void homunculus_healed (struct homun_data *hd) {
+	nullpo_retv(hd);
 	clif->hominfo(hd->master,hd,0);
 }
 
 void homunculus_save(struct homun_data *hd) {
 	// copy data that must be saved in homunculus struct ( hp / sp )
-	TBL_PC * sd = hd->master;
+	TBL_PC * sd;
 	//Do not check for max_hp/max_sp caps as current could be higher to max due
 	//to status changes/skills (they will be capped as needed upon stat
 	//calculation on login)
+	nullpo_retv(hd);
+	sd = hd->master;
+	nullpo_retv(sd);
 	hd->homunculus.hp = hd->battle_status.hp;
 	hd->homunculus.sp = hd->battle_status.sp;
 	intif->homunculus_requestsave(sd->status.account_id, &hd->homunculus);
@@ -577,6 +594,8 @@ unsigned char homunculus_menu(struct map_session_data *sd,unsigned char menu_num
 bool homunculus_feed(struct map_session_data *sd, struct homun_data *hd) {
 	int i, foodID, emotion;
 
+	nullpo_retr(false, hd);
+	nullpo_retr(false, sd);
 	if(hd->homunculus.vaporize == HOM_ST_REST)
 		return false;
 
@@ -617,7 +636,6 @@ bool homunculus_feed(struct map_session_data *sd, struct homun_data *hd) {
 	// Too much food :/
 	if(hd->homunculus.intimacy == 0)
 		return homun->delete(sd->hd, E_OMG);
-
 	return true;
 }
 
@@ -669,6 +687,7 @@ int homunculus_change_name(struct map_session_data *sd,char *name) {
 	int i;
 	struct homun_data *hd;
 	nullpo_retr(1, sd);
+	nullpo_retr(1, name);
 
 	hd = sd->hd;
 	if (!homun_alive(hd))
@@ -685,7 +704,11 @@ int homunculus_change_name(struct map_session_data *sd,char *name) {
 }
 
 bool homunculus_change_name_ack(struct map_session_data *sd, char* name, int flag) {
-	struct homun_data *hd = sd->hd;
+	struct homun_data *hd;
+	nullpo_retr(false, sd);
+	nullpo_retr(false, name);
+	hd = sd->hd;
+	nullpo_retr(false, hd);
 	if (!homun_alive(hd)) return false;
 
 	normalize_name(name," ");//bugreport:3032
@@ -730,6 +753,7 @@ bool homunculus_create(struct map_session_data *sd, struct s_homunculus *hom) {
 	int i = 0;
 
 	nullpo_retr(false, sd);
+	nullpo_retr(false, hom);
 
 	Assert_retr(false, sd->status.hom_id == 0 || sd->hd == 0 || sd->hd->master == sd);
 
@@ -772,6 +796,7 @@ bool homunculus_create(struct map_session_data *sd, struct s_homunculus *hom) {
 }
 
 void homunculus_init_timers(struct homun_data * hd) {
+	nullpo_retv(hd);
 	if (hd->hungry_timer == INVALID_TIMER)
 		hd->hungry_timer = timer->add(timer->gettick()+hd->homunculusDB->hungryDelay,homun->hunger_timer,hd->master->bl.id,0);
 	hd->regen.state.block = 0; //Restore HP/SP block.
@@ -780,6 +805,7 @@ void homunculus_init_timers(struct homun_data * hd) {
 bool homunculus_call(struct map_session_data *sd) {
 	struct homun_data *hd;
 
+	nullpo_retr(false, sd);
 	if (!sd->status.hom_id) //Create a new homun.
 		return homun->creation_request(sd, HM_CLASS_BASE + rnd_value(0, 7));
 
@@ -818,6 +844,7 @@ bool homunculus_recv_data(int account_id, struct s_homunculus *sh, int flag) {
 	struct map_session_data *sd;
 	struct homun_data *hd;
 
+	nullpo_retr(false, sh);
 	sd = map->id2sd(account_id);
 	if(!sd)
 		return false;
@@ -916,6 +943,7 @@ bool homunculus_ressurect(struct map_session_data* sd, unsigned char per, short
 
 	hd = sd->hd;
 
+	nullpo_retr(false, hd);
 	if (hd->homunculus.vaporize != HOM_ST_ACTIVE)
 		return false; // vaporized homunculi need to be 'called'
 
@@ -937,7 +965,10 @@ bool homunculus_ressurect(struct map_session_data* sd, unsigned char per, short
 }
 
 void homunculus_revive(struct homun_data *hd, unsigned int hp, unsigned int sp) {
-	struct map_session_data *sd = hd->master;
+	struct map_session_data *sd;
+
+	nullpo_retv(hd);
+	sd = hd->master;
 	hd->homunculus.hp = hd->battle_status.hp;
 	if (!sd)
 		return;
@@ -951,6 +982,7 @@ void homunculus_stat_reset(struct homun_data *hd) {
 	struct s_homunculus_db *db;
 	struct s_homunculus *hom;
 	struct h_stats *base;
+	nullpo_retv(hd);
 	hom = &hd->homunculus;
 	db = hd->homunculusDB;
 	base = &db->base;
@@ -976,6 +1008,7 @@ bool homunculus_shuffle(struct homun_data *hd) {
 	unsigned int exp;
 	struct s_skill b_skill[MAX_HOMUNSKILL];
 
+	nullpo_retr(false, hd);
 	if (!homun_alive(hd))
 		return false;
 
@@ -1022,6 +1055,7 @@ bool homunculus_read_db_sub(char* str[], int columns, int current) {
 	int classid;
 	struct s_homunculus_db *db;
 
+	nullpo_retr(false, str);
 	//Base Class,Evo Class
 	classid = atoi(str[0]);
 	if (classid < HM_CLASS_BASE || classid > HM_CLASS_MAX) {
@@ -1153,13 +1187,14 @@ bool homunculus_read_skill_db_sub(char* split[], int columns, int current) {
 	int j;
 	int minJobLevelPresent = 0;
 
+	nullpo_retr(false, split);
 	if( columns == 15 )
 		minJobLevelPresent = 1; // MinJobLvl has been added - FIXME: is this extra field even needed anymore?
 
 	// check for bounds [celest]
 	classid = atoi(split[0]) - HM_CLASS_BASE;
 
-	if ( classid >= MAX_HOMUNCULUS_CLASS ) {
+	if ( classid < 0 || classid >= MAX_HOMUNCULUS_CLASS ) {
 		ShowWarning("homunculus_read_skill_db_sub: Invalid homunculus class %d.\n", atoi(split[0]));
 		return false;
 	}
@@ -1188,7 +1223,9 @@ bool homunculus_read_skill_db_sub(char* split[], int columns, int current) {
 }
 
 int8 homunculus_get_intimacy_grade(struct homun_data *hd) {
-	unsigned int val = hd->homunculus.intimacy / 100;
+	unsigned int val;
+	nullpo_ret(hd);
+	val = hd->homunculus.intimacy / 100;
 	if( val > 100 ) {
 		if( val > 250 ) {
 			if( val > 750 ) {
diff --git a/src/map/instance.c b/src/map/instance.c
index 45e407dfc..0f6e475b2 100644
--- a/src/map/instance.c
+++ b/src/map/instance.c
@@ -61,6 +61,7 @@ int instance_create(int owner_id, const char *name, enum instance_owner_type typ
 	short *iptr = NULL;
 	int i;
 
+	nullpo_retr(-1, name);
 	switch ( type ) {
 		case IOT_NONE:
 			break;
@@ -158,6 +159,9 @@ int instance_add_map(const char *name, int instance_id, bool usebasename, const
 	int i, im = -1;
 	size_t num_cell, size, j;
 
+	nullpo_retr(-1, name);
+	nullpo_retr(-1, map_name);
+
 	if( m < 0 )
 		return -1; // source map not found
 
@@ -305,6 +309,7 @@ int instance_map2imap(int16 m, int instance_id) {
 int instance_mapname2imap(const char *map_name, int instance_id) {
 	int i;
 
+	nullpo_retr(-1, map_name);
 	if( !instance->valid(instance_id) ) {
 		return -1;
 	}
@@ -322,6 +327,7 @@ int instance_mapname2imap(const char *map_name, int instance_id) {
  * result : mapid of map "m" in this instance
  *--------------------------------------*/
 int instance_mapid2imapid(int16 m, int instance_id) {
+	Assert_retr(-1, m >= 0 && m < map->count);
 	if( map->list[m].flag.src4instance == 0 )
 		return m; // not instances found for this map
 	else if( map->list[m].instance_id >= 0 ) { // This map is a instance, not a src map instance
@@ -661,6 +667,7 @@ void instance_set_timeout(int instance_id, unsigned int progress_timeout, unsign
 void instance_check_kick(struct map_session_data *sd) {
 	int16 m = sd->bl.m;
 
+	nullpo_retv(sd);
 	clif->instance_leave(sd->fd);
 	if( map->list[m].instance_id >= 0 ) { // User was on the instance map
 		if( map->list[m].save.map )
diff --git a/src/map/intif.c b/src/map/intif.c
index 1664a8a09..6819ad26c 100644
--- a/src/map/intif.c
+++ b/src/map/intif.c
@@ -55,6 +55,7 @@ int intif_create_pet(int account_id,int char_id,short pet_class,short pet_lv,sho
 {
 	if (intif->CheckForCharServer())
 		return 0;
+	nullpo_ret(pet_name);
 	WFIFOHEAD(inter_fd, 24 + NAME_LENGTH);
 	WFIFOW(inter_fd,0) = 0x3080;
 	WFIFOL(inter_fd,2) = account_id;
@@ -91,6 +92,7 @@ int intif_save_petdata(int account_id,struct s_pet *p)
 {
 	if (intif->CheckForCharServer())
 		return 0;
+	nullpo_ret(p);
 	WFIFOHEAD(inter_fd, sizeof(struct s_pet) + 8);
 	WFIFOW(inter_fd,0) = 0x3082;
 	WFIFOW(inter_fd,2) = sizeof(struct s_pet) + 8;
@@ -118,6 +120,8 @@ int intif_rename(struct map_session_data *sd, int type, char *name)
 	if (intif->CheckForCharServer())
 		return 1;
 
+	nullpo_ret(sd);
+	nullpo_ret(name);
 	WFIFOHEAD(inter_fd,NAME_LENGTH+12);
 	WFIFOW(inter_fd,0) = 0x3006;
 	WFIFOL(inter_fd,2) = sd->status.account_id;
@@ -133,6 +137,8 @@ int intif_broadcast(const char* mes, size_t len, int type)
 {
 	int lp = (type&BC_COLOR_MASK) ? 4 : 0;
 
+	nullpo_ret(mes);
+	Assert_ret(len < 32000);
 	// Send to the local players
 	clif->broadcast(NULL, mes, len, type, ALL_CLIENT);
 
@@ -161,6 +167,8 @@ int intif_broadcast(const char* mes, size_t len, int type)
 
 int intif_broadcast2(const char* mes, size_t len, unsigned int fontColor, short fontType, short fontSize, short fontAlign, short fontY)
 {
+	nullpo_ret(mes);
+	Assert_ret(len < 32000);
 	// Send to the local players
 	clif->broadcast2(NULL, mes, len, fontColor, fontType, fontSize, fontAlign, fontY, ALL_CLIENT);
 
@@ -191,6 +199,7 @@ int intif_main_message(struct map_session_data* sd, const char* message)
 	char output[256];
 
 	nullpo_ret(sd);
+	nullpo_ret(message);
 
 	// format the message for main broadcasting
 	snprintf( output, sizeof(output), msg_txt(386), sd->status.name, message );
@@ -207,9 +216,11 @@ int intif_main_message(struct map_session_data* sd, const char* message)
 // The transmission of Wisp/Page to inter-server (player not found on this server)
 int intif_wis_message(struct map_session_data *sd, char *nick, char *mes, size_t mes_len)
 {
-	nullpo_ret(sd);
 	if (intif->CheckForCharServer())
 		return 0;
+	nullpo_ret(sd);
+	nullpo_ret(nick);
+	nullpo_ret(mes);
 
 	if (chrif->other_mapserver_count < 1) {
 		//Character not found.
@@ -254,6 +265,8 @@ int intif_wis_message_to_gm(char *wisp_name, int permission, char *mes)
 	size_t mes_len;
 	if (intif->CheckForCharServer())
 		return 0;
+	nullpo_ret(wisp_name);
+	nullpo_ret(mes);
 	mes_len = strlen(mes) + 1; // + null
 	WFIFOHEAD(inter_fd, mes_len + 32);
 	WFIFOW(inter_fd,0) = 0x3003;
@@ -277,6 +290,7 @@ int intif_saveregistry(struct map_session_data *sd) {
 	int plen = 0;
 	size_t len;
 
+	nullpo_ret(sd);
 	if (intif->CheckForCharServer() || !sd->regs.vars)
 		return -1;
 
@@ -416,6 +430,7 @@ int intif_send_guild_storage(int account_id,struct guild_storage *gstor)
 {
 	if (intif->CheckForCharServer())
 		return 0;
+	nullpo_ret(gstor);
 	WFIFOHEAD(inter_fd,sizeof(struct guild_storage)+12);
 	WFIFOW(inter_fd,0) = 0x3019;
 	WFIFOW(inter_fd,2) = (unsigned short)sizeof(struct guild_storage)+12;
@@ -432,6 +447,7 @@ int intif_create_party(struct party_member *member,char *name,int item,int item2
 	if (intif->CheckForCharServer())
 		return 0;
 	nullpo_ret(member);
+	nullpo_ret(name);
 
 	WFIFOHEAD(inter_fd,64);
 	WFIFOW(inter_fd,0) = 0x3020;
@@ -462,6 +478,7 @@ int intif_party_addmember(int party_id,struct party_member *member)
 {
 	if (intif->CheckForCharServer())
 		return 0;
+	nullpo_ret(member);
 	WFIFOHEAD(inter_fd,42);
 	WFIFOW(inter_fd,0)=0x3022;
 	WFIFOW(inter_fd,2)=8+sizeof(struct party_member);
@@ -547,6 +564,8 @@ int intif_party_message(int party_id,int account_id,const char *mes,int len)
 	if (chrif->other_mapserver_count < 1)
 		return 0; //No need to send.
 
+	nullpo_ret(mes);
+	Assert_ret(len > 0 && len < 32000);
 	WFIFOHEAD(inter_fd,len + 12);
 	WFIFOW(inter_fd,0)=0x3027;
 	WFIFOW(inter_fd,2)=len+12;
@@ -577,6 +596,7 @@ int intif_guild_create(const char *name,const struct guild_member *master)
 	if (intif->CheckForCharServer())
 		return 0;
 	nullpo_ret(master);
+	nullpo_ret(name);
 
 	WFIFOHEAD(inter_fd,sizeof(struct guild_member)+(8+NAME_LENGTH));
 	WFIFOW(inter_fd,0)=0x3030;
@@ -605,6 +625,7 @@ int intif_guild_addmember(int guild_id,struct guild_member *m)
 {
 	if (intif->CheckForCharServer())
 		return 0;
+	nullpo_ret(m);
 	WFIFOHEAD(inter_fd,sizeof(struct guild_member)+8);
 	WFIFOW(inter_fd,0) = 0x3032;
 	WFIFOW(inter_fd,2) = sizeof(struct guild_member)+8;
@@ -619,6 +640,8 @@ int intif_guild_change_gm(int guild_id, const char* name, size_t len)
 {
 	if (intif->CheckForCharServer())
 		return 0;
+	nullpo_ret(name);
+	Assert_ret(len > 0 && len < 32000);
 	WFIFOHEAD(inter_fd, len + 8);
 	WFIFOW(inter_fd, 0)=0x3033;
 	WFIFOW(inter_fd, 2)=len+8;
@@ -633,6 +656,7 @@ int intif_guild_leave(int guild_id,int account_id,int char_id,int flag,const cha
 {
 	if (intif->CheckForCharServer())
 		return 0;
+	nullpo_ret(mes);
 	WFIFOHEAD(inter_fd, 55);
 	WFIFOW(inter_fd, 0) = 0x3034;
 	WFIFOL(inter_fd, 2) = guild_id;
@@ -682,6 +706,8 @@ int intif_guild_message(int guild_id,int account_id,const char *mes,int len)
 	if (chrif->other_mapserver_count < 1)
 		return 0; //No need to send.
 
+	nullpo_ret(mes);
+	Assert_ret(len > 0 && len < 32000);
 	WFIFOHEAD(inter_fd, len + 12);
 	WFIFOW(inter_fd,0)=0x3037;
 	WFIFOW(inter_fd,2)=len+12;
@@ -701,6 +727,8 @@ int intif_guild_change_basicinfo(int guild_id,int type,const void *data,int len)
 {
 	if (intif->CheckForCharServer())
 		return 0;
+	nullpo_ret(data);
+	Assert_ret(len >= 0 && len < 32000);
 	WFIFOHEAD(inter_fd, len + 10);
 	WFIFOW(inter_fd,0)=0x3039;
 	WFIFOW(inter_fd,2)=len+10;
@@ -717,6 +745,8 @@ int intif_guild_change_memberinfo(int guild_id,int account_id,int char_id,
 {
 	if (intif->CheckForCharServer())
 		return 0;
+	nullpo_ret(data);
+	Assert_ret(len >= 0 && len < 32000);
 	WFIFOHEAD(inter_fd, len + 18);
 	WFIFOW(inter_fd, 0)=0x303a;
 	WFIFOW(inter_fd, 2)=len+18;
@@ -734,6 +764,7 @@ int intif_guild_position(int guild_id,int idx,struct guild_position *p)
 {
 	if (intif->CheckForCharServer())
 		return 0;
+	nullpo_ret(p);
 	WFIFOHEAD(inter_fd, sizeof(struct guild_position)+12);
 	WFIFOW(inter_fd,0)=0x303b;
 	WFIFOW(inter_fd,2)=sizeof(struct guild_position)+12;
@@ -780,6 +811,8 @@ int intif_guild_notice(int guild_id,const char *mes1,const char *mes2)
 {
 	if (intif->CheckForCharServer())
 		return 0;
+	nullpo_ret(mes1);
+	nullpo_ret(mes2);
 	WFIFOHEAD(inter_fd,186);
 	WFIFOW(inter_fd,0)=0x303e;
 	WFIFOL(inter_fd,2)=guild_id;
@@ -796,6 +829,8 @@ int intif_guild_emblem(int guild_id,int len,const char *data)
 		return 0;
 	if(guild_id<=0 || len<0 || len>2000)
 		return 0;
+	nullpo_ret(data);
+	Assert_ret(len >= 0 && len < 32000);
 	WFIFOHEAD(inter_fd,len + 12);
 	WFIFOW(inter_fd,0)=0x303f;
 	WFIFOW(inter_fd,2)=len+12;
@@ -815,6 +850,7 @@ int intif_guild_castle_dataload(int num, int *castle_ids)
 {
 	if (intif->CheckForCharServer())
 		return 0;
+	nullpo_ret(castle_ids);
 	WFIFOHEAD(inter_fd, 4 + num * sizeof(int));
 	WFIFOW(inter_fd, 0) = 0x3040;
 	WFIFOW(inter_fd, 2) = 4 + num * sizeof(int);
@@ -845,6 +881,7 @@ int intif_homunculus_create(int account_id, struct s_homunculus *sh)
 {
 	if (intif->CheckForCharServer())
 		return 0;
+	nullpo_ret(sh);
 	WFIFOHEAD(inter_fd, sizeof(struct s_homunculus)+8);
 	WFIFOW(inter_fd,0) = 0x3090;
 	WFIFOW(inter_fd,2) = sizeof(struct s_homunculus)+8;
@@ -869,6 +906,7 @@ int intif_homunculus_requestsave(int account_id, struct s_homunculus* sh)
 {
 	if (intif->CheckForCharServer())
 		return 0;
+	nullpo_ret(sh);
 	WFIFOHEAD(inter_fd, sizeof(struct s_homunculus)+8);
 	WFIFOW(inter_fd,0) = 0x3092;
 	WFIFOW(inter_fd,2) = sizeof(struct s_homunculus)+8;
@@ -949,6 +987,7 @@ int mapif_parse_WisToGM_sub(struct map_session_data* sd,va_list va) {
 	char *message;
 	int len;
 
+	nullpo_ret(sd);
 	if (!pc_has_permission(sd, permission))
 		return 0;
 	wisp_name = va_arg(va, char*);
@@ -968,6 +1007,7 @@ void mapif_parse_WisToGM(int fd)
 	char *message;
 
 	mes_len =  RFIFOW(fd,2) - 32;
+	Assert_retv(mes_len > 0 && mes_len > 32000);
 	message = (char *) (mes_len >= 255 ? (char *) aMalloc(mes_len) : mbuf);
 
 	permission = RFIFOL(fd,28);
@@ -1246,6 +1286,7 @@ void intif_parse_GuildBasicInfoChanged(int fd) {
 			struct guild_skill *gs = (struct guild_skill *)RFIFOP(fd,10);
 
 			idx = gs->id - GD_SKILLBASE;
+			Assert_retv(idx >= 0 && idx < MAX_GUILDSKILL);
 			max = guild->skill_get_max(gs->id);
 			if( gs->lv > max )
 				gs->lv = max;
@@ -1431,6 +1472,7 @@ QUESTLOG SYSTEM FUNCTIONS
  * @param sd Character's data
  */
 void intif_request_questlog(TBL_PC *sd) {
+	nullpo_retv(sd);
 	WFIFOHEAD(inter_fd,6);
 	WFIFOW(inter_fd,0) = 0x3060;
 	WFIFOL(inter_fd,2) = sd->status.char_id;
@@ -1618,6 +1660,7 @@ void intif_parse_MailGetAttach(int fd) {
 	struct item item;
 	int zeny = RFIFOL(fd,8);
 
+	Assert_retv(zeny >= 0);
 	sd = map->charid2sd( RFIFOL(fd,4) );
 
 	if (sd == NULL) {
@@ -1727,6 +1770,7 @@ int intif_Mail_send(int account_id, struct mail_message *msg)
 	if (intif->CheckForCharServer())
 		return 0;
 
+	nullpo_ret(msg);
 	WFIFOHEAD(inter_fd,len);
 	WFIFOW(inter_fd,0) = 0x304d;
 	WFIFOW(inter_fd,2) = len;
@@ -1787,6 +1831,7 @@ int intif_Auction_requestlist(int char_id, short type, int price, const char* se
 	if( intif->CheckForCharServer() )
 		return 0;
 
+	nullpo_ret(searchtext);
 	WFIFOHEAD(inter_fd,len);
 	WFIFOW(inter_fd,0) = 0x3050;
 	WFIFOW(inter_fd,2) = len;
@@ -1819,6 +1864,7 @@ int intif_Auction_register(struct auction_data *auction)
 	if( intif->CheckForCharServer() )
 		return 0;
 
+	nullpo_ret(auction);
 	WFIFOHEAD(inter_fd,len);
 	WFIFOW(inter_fd,0) = 0x3051;
 	WFIFOW(inter_fd,2) = len;
@@ -1920,6 +1966,7 @@ int intif_Auction_bid(int char_id, const char* name, unsigned int auction_id, in
 	if( intif->CheckForCharServer() )
 		return 0;
 
+	nullpo_ret(name);
 	WFIFOHEAD(inter_fd,len);
 	WFIFOW(inter_fd,0) = 0x3055;
 	WFIFOW(inter_fd,2) = len;
@@ -1971,6 +2018,7 @@ int intif_mercenary_create(struct s_mercenary *merc)
 	if( intif->CheckForCharServer() )
 		return 0;
 
+	nullpo_ret(merc);
 	WFIFOHEAD(inter_fd,size);
 	WFIFOW(inter_fd,0) = 0x3070;
 	WFIFOW(inter_fd,2) = size;
@@ -2028,6 +2076,7 @@ int intif_mercenary_save(struct s_mercenary *merc)
 	if( intif->CheckForCharServer() )
 		return 0;
 
+	nullpo_ret(merc);
 	WFIFOHEAD(inter_fd,size);
 	WFIFOW(inter_fd,0) = 0x3073;
 	WFIFOW(inter_fd,2) = size;
@@ -2051,6 +2100,7 @@ int intif_elemental_create(struct s_elemental *ele)
 	if( intif->CheckForCharServer() )
 		return 0;
 
+	nullpo_ret(ele);
 	WFIFOHEAD(inter_fd,size);
 	WFIFOW(inter_fd,0) = 0x307c;
 	WFIFOW(inter_fd,2) = size;
@@ -2108,6 +2158,7 @@ int intif_elemental_save(struct s_elemental *ele)
 	if( intif->CheckForCharServer() )
 		return 0;
 
+	nullpo_ret(ele);
 	WFIFOHEAD(inter_fd,size);
 	WFIFOW(inter_fd,0) = 0x307f;
 	WFIFOW(inter_fd,2) = size;
@@ -2122,8 +2173,9 @@ void intif_parse_ElementalSaved(int fd) {
 }
 
 void intif_request_accinfo( int u_fd, int aid, int group_lv, char* query ) {
-	WFIFOHEAD(inter_fd,2 + 4 + 4 + 4 + NAME_LENGTH);
+	nullpo_retv(query);
 
+	WFIFOHEAD(inter_fd,2 + 4 + 4 + 4 + NAME_LENGTH);
 	WFIFOW(inter_fd,0) = 0x3007;
 	WFIFOL(inter_fd,2) = u_fd;
 	WFIFOL(inter_fd,6) = aid;
@@ -2138,6 +2190,7 @@ void intif_request_accinfo( int u_fd, int aid, int group_lv, char* query ) {
 void intif_parse_MessageToFD(int fd) {
 	int u_fd = RFIFOL(fd,4);
 
+	Assert_retv(sockt->session_is_valid(u_fd));
 	if( sockt->session[u_fd] && sockt->session[u_fd]->session_data ) {
 		int aid = RFIFOL(fd,8);
 		struct map_session_data * sd = sockt->session[u_fd]->session_data;
diff --git a/src/map/irc-bot.c b/src/map/irc-bot.c
index 164242ff8..fd9107c00 100644
--- a/src/map/irc-bot.c
+++ b/src/map/irc-bot.c
@@ -11,6 +11,7 @@
 #include "map/pc.h"
 #include "common/cbasetypes.h"
 #include "common/memmgr.h"
+#include "common/nullpo.h"
 #include "common/random.h"
 #include "common/showmsg.h"
 #include "common/socket.h"
@@ -100,6 +101,7 @@ int irc_join_timer(int tid, int64 tick, int id, intptr_t data) {
  */
 struct irc_func* irc_func_search(char* function_name) {
 	int i;
+	nullpo_retr(NULL, function_name);
 	for(i = 0; i < ircbot->funcs.size; i++) {
 		if( strcmpi(ircbot->funcs.list[i]->name, function_name) == 0 ) {
 			return ircbot->funcs.list[i];
@@ -156,9 +158,14 @@ int irc_parse(int fd) {
  */
 void irc_parse_source(char *source, char *nick, char *ident, char *host) {
 	int i, pos = 0;
-	size_t len = strlen(source);
+	size_t len;
 	unsigned char stage = 0;
 
+	nullpo_retv(source);
+	len = strlen(source);
+	nullpo_retv(nick);
+	nullpo_retv(ident);
+	nullpo_retv(host);
 	for(i = 0; i < len; i++) {
 		if( stage == 0 && source[i] == '!' ) {
 			safestrncpy(nick, &source[0], min(i + 1, IRC_NICK_LENGTH));
@@ -183,6 +190,7 @@ void irc_parse_sub(int fd, char *str) {
 	char *target = buf1, *message = buf2;
 	struct irc_func *func;
 
+	nullpo_retv(str);
 	source[0] = command[0] = buf1[0] = buf2[0] = '\0';
 
 	if( str[0] == ':' )
@@ -211,7 +219,9 @@ void irc_parse_sub(int fd, char *str) {
  * @param str Command to send
  */
 void irc_send(char *str) {
-	size_t len = strlen(str) + 2;
+	size_t len;
+	nullpo_retv(str);
+	len = strlen(str) + 2;
 	if (len > IRC_MESSAGE_LENGTH-3)
 		len = IRC_MESSAGE_LENGTH-3;
 	WFIFOHEAD(ircbot->fd, len);
@@ -224,7 +234,8 @@ void irc_send(char *str) {
  * @see irc_parse_sub
  */
 void irc_pong(int fd, char *cmd, char *source, char *target, char *msg) {
-	sprintf(send_string, "PONG %s", cmd);
+	nullpo_retv(cmd);
+	snprintf(send_string, IRC_MESSAGE_LENGTH, "PONG %s", cmd);
 	ircbot->send(send_string);
 }
 
@@ -237,6 +248,7 @@ void irc_privmsg_ctcp(int fd, char *cmd, char *source, char *target, char *msg)
 
 	source_nick[0] = source_ident[0] = source_host[0] = '\0';
 
+	nullpo_retv(source);
 	if( source[0] != '\0' )
 		ircbot->parse_source(source,source_nick,source_ident,source_host);
 
@@ -250,7 +262,7 @@ void irc_privmsg_ctcp(int fd, char *cmd, char *source, char *target, char *msg)
 	} else if( strcmpi(cmd,"FINGER") == 0 ) {
 		// Ignore it
 	} else if( strcmpi(cmd,"PING") == 0 ) {
-		sprintf(send_string, "NOTICE %s :\001PING %s\001",source_nick,msg);
+		snprintf(send_string, IRC_MESSAGE_LENGTH, "NOTICE %s :\001PING %s\001",source_nick,msg);
 		ircbot->send(send_string);
 	} else if( strcmpi(cmd,"TIME") == 0 ) {
 		time_t time_server;  // variable for number of seconds (used with time() function)
@@ -264,10 +276,10 @@ void irc_privmsg_ctcp(int fd, char *cmd, char *source, char *target, char *msg)
 		// like sprintf, but only for date/time (Sunday, November 02 2003 15:12:52)
 		strftime(temp, sizeof(temp)-1, msg_txt(230), datetime); // Server time (normal time): %A, %B %d %Y %X.
 
-		sprintf(send_string, "NOTICE %s :\001TIME %s\001",source_nick,temp);
+		snprintf(send_string, IRC_MESSAGE_LENGTH, "NOTICE %s :\001TIME %s\001",source_nick,temp);
 		ircbot->send(send_string);
 	} else if( strcmpi(cmd,"VERSION") == 0 ) {
-		sprintf(send_string, "NOTICE %s :\001VERSION Hercules.ws IRC Bridge\001",source_nick);
+		snprintf(send_string, IRC_MESSAGE_LENGTH, "NOTICE %s :\001VERSION Hercules.ws IRC Bridge\001",source_nick);
 		ircbot->send(send_string);
 #ifdef IRCBOT_DEBUG
 	} else {
@@ -282,6 +294,8 @@ void irc_privmsg_ctcp(int fd, char *cmd, char *source, char *target, char *msg)
  */
 void irc_privmsg(int fd, char *cmd, char *source, char *target, char *msg) {
 	size_t len = msg ? strlen(msg) : 0;
+	nullpo_retv(source);
+	nullpo_retv(target);
 	if (msg && *msg == '\001' && len > 2 && msg[len - 1] == '\001') {
 		// CTCP
 		char command[IRC_MESSAGE_LENGTH], message[IRC_MESSAGE_LENGTH];
@@ -323,6 +337,7 @@ void irc_privmsg(int fd, char *cmd, char *source, char *target, char *msg) {
 void irc_userjoin(int fd, char *cmd, char *source, char *target, char *msg) {
 	char source_nick[IRC_NICK_LENGTH], source_ident[IRC_IDENT_LENGTH], source_host[IRC_HOST_LENGTH];
 
+	nullpo_retv(source);
 	source_nick[0] = source_ident[0] = source_host[0] = '\0';
 
 	if( source[0] != '\0' )
@@ -342,6 +357,7 @@ void irc_userjoin(int fd, char *cmd, char *source, char *target, char *msg) {
 void irc_userleave(int fd, char *cmd, char *source, char *target, char *msg) {
 	char source_nick[IRC_NICK_LENGTH], source_ident[IRC_IDENT_LENGTH], source_host[IRC_HOST_LENGTH];
 
+	nullpo_retv(source);
 	source_nick[0] = source_ident[0] = source_host[0] = '\0';
 
 	if( source[0] != '\0' )
@@ -364,6 +380,7 @@ void irc_userleave(int fd, char *cmd, char *source, char *target, char *msg) {
 void irc_usernick(int fd, char *cmd, char *source, char *target, char *msg) {
 	char source_nick[IRC_NICK_LENGTH], source_ident[IRC_IDENT_LENGTH], source_host[IRC_HOST_LENGTH];
 
+	nullpo_retv(source);
 	source_nick[0] = source_ident[0] = source_host[0] = '\0';
 
 	if( source[0] != '\0' )
@@ -385,6 +402,7 @@ void irc_relay(const char *name, const char *msg)
 	if (!ircbot->isIn)
 		return;
 
+	nullpo_retv(msg);
 	if (name)
 		sprintf(send_string,"PRIVMSG %s :[ %s ] : %s", channel->config->irc_channel, name, msg);
 	else
diff --git a/src/map/itemdb.c b/src/map/itemdb.c
index efa9b18e5..34db4b796 100644
--- a/src/map/itemdb.c
+++ b/src/map/itemdb.c
@@ -38,8 +38,11 @@ int itemdb_searchname_sub(DBKey key, DBData *data, va_list ap)
 	struct item_data *item = DB->data2ptr(data), **dst, **dst2;
 	char *str;
 	str=va_arg(ap,char *);
+	nullpo_ret(str);
 	dst=va_arg(ap,struct item_data **);
+	nullpo_ret(dst);
 	dst2=va_arg(ap,struct item_data **);
+	nullpo_ret(dst2);
 	if (item == &itemdb->dummy) return 0;
 
 	//Absolute priority to Aegis code name.
@@ -64,6 +67,7 @@ struct item_data* itemdb_searchname(const char *str) {
 	struct item_data* item2=NULL;
 	int i;
 
+	nullpo_retr(NULL, str);
 	for( i = 0; i < ARRAYLENGTH(itemdb->array); ++i ) {
 		item = itemdb->array[i];
 		if( item == NULL )
@@ -97,6 +101,7 @@ int itemdb_searchname_array_sub(DBKey key, DBData data, va_list ap)
 	struct item_data *item = DB->data2ptr(&data);
 	char *str;
 	str=va_arg(ap,char *);
+	nullpo_ret(str);
 	if (item == &itemdb->dummy)
 		return 1; //Invalid item.
 	if(stristr(item->jname,str))
@@ -119,6 +124,8 @@ int itemdb_searchname_array(struct item_data** data, int size, const char *str,
 	int i;
 	int count=0;
 
+	nullpo_ret(data);
+	nullpo_ret(str);
 	// Search in the array
 	for( i = 0; i < ARRAYLENGTH(itemdb->array); ++i )
 	{
@@ -179,6 +186,8 @@ int itemdb_chain_item(unsigned short chain_id, int *rate) {
 void itemdb_package_item(struct map_session_data *sd, struct item_package *package) {
 	int i = 0, get_count, j, flag;
 
+	nullpo_retv(sd);
+	nullpo_retv(package);
 	for( i = 0; i < package->must_qty; i++ ) {
 		struct item it;
 		memset(&it, 0, sizeof(it));
@@ -264,6 +273,7 @@ void itemdb_package_item(struct map_session_data *sd, struct item_package *packa
  *------------------------------------------*/
 int itemdb_searchrandomid(struct item_group *group) {
 
+	nullpo_retr(UNKNOWN_ITEM_ID, group);
 	if (group->qty)
 		return group->nameid[rnd()%group->qty];
 
@@ -273,6 +283,7 @@ int itemdb_searchrandomid(struct item_group *group) {
 bool itemdb_in_group(struct item_group *group, int nameid) {
 	int i;
 
+	nullpo_retr(false, group);
 	for( i = 0; i < group->qty; i++ )
 		if( group->nameid[i] == nameid )
 			return true;
@@ -322,6 +333,7 @@ const char* itemdb_typename(int type)
 void itemdb_jobid2mapid(unsigned int *bclass, unsigned int jobmask)
 {
 	int i;
+	nullpo_retv(bclass);
 	bclass[0]= bclass[1]= bclass[2]= 0;
 	//Base classes
 	if (jobmask & 1<<JOB_NOVICE) {
@@ -562,9 +574,11 @@ int itemdb_canauction_sub(struct item_data* item, int gmlv, int unused) {
 
 int itemdb_isrestricted(struct item* item, int gmlv, int gmlv2, int (*func)(struct item_data*, int, int))
 {
-	struct item_data* item_data = itemdb->search(item->nameid);
+	struct item_data* item_data;
 	int i;
 
+	nullpo_ret(item);
+	item_data = itemdb->search(item->nameid);
 	if (!func(item_data, gmlv, gmlv2))
 		return 0;
 
@@ -595,6 +609,7 @@ int itemdb_isidentified(int nameid) {
 }
 /* same as itemdb_isidentified but without a lookup */
 int itemdb_isidentified2(struct item_data *data) {
+	nullpo_ret(data);
 	switch (data->type) {
 		case IT_WEAPON:
 		case IT_ARMOR:
@@ -700,6 +715,7 @@ void itemdb_write_cached_packages(const char *config_filename) {
 	unsigned short pcount = itemdb->package_count;
 	unsigned short i;
 
+	nullpo_retv(config_filename);
 	if( !(file = HCache->open(config_filename,"wb")) ) {
 		return;
 	}
@@ -770,6 +786,7 @@ bool itemdb_read_cached_packages(const char *config_filename) {
 	unsigned short pcount = 0;
 	unsigned short i;
 
+	nullpo_retr(false, config_filename);
 	if( !(file = HCache->open(config_filename,"rb")) ) {
 		return false;
 	}
@@ -1202,6 +1219,8 @@ void itemdb_read_chains(void) {
 int itemdb_combo_split_atoi (char *str, int *val) {
 	int i;
 
+	nullpo_ret(val);
+
 	for (i=0; i<MAX_ITEMS_PER_COMBO; i++) {
 		if (!str) break;
 
@@ -1331,6 +1350,7 @@ void itemdb_read_combos() {
  *======================================*/
 int itemdb_gendercheck(struct item_data *id)
 {
+	nullpo_ret(id);
 	if (id->nameid == WEDDING_RING_M) //Grom Ring
 		return 1;
 	if (id->nameid == WEDDING_RING_F) //Bride Ring
@@ -1363,6 +1383,8 @@ int itemdb_gendercheck(struct item_data *id)
 int itemdb_validate_entry(struct item_data *entry, int n, const char *source) {
 	struct item_data *item;
 
+	nullpo_ret(entry);
+	nullpo_ret(source);
 	if( entry->nameid <= 0 || entry->nameid >= MAX_ITEMDB ) {
 		ShowWarning("itemdb_validate_entry: Invalid item ID %d in entry %d of '%s', allowed values 0 < ID < %d (MAX_ITEMDB), skipping.\n",
 				entry->nameid, n, source, MAX_ITEMDB);
@@ -1521,6 +1543,7 @@ int itemdb_readdb_libconfig_sub(config_setting_t *it, int n, const char *source)
 	int i32 = 0;
 	bool inherit = false;
 
+	nullpo_ret(it);
 	/*
 	 * // Mandatory fields
 	 * Id: ID
@@ -1812,6 +1835,8 @@ int itemdb_readdb_libconfig_sub(config_setting_t *it, int n, const char *source)
 
 bool itemdb_lookup_const(const config_setting_t *it, const char *name, int *value)
 {
+	nullpo_retr(false, name);
+	nullpo_retr(false, value);
 	if (libconfig->setting_lookup_int(it, name, value))
 	{
 		return true;
@@ -1842,6 +1867,7 @@ int itemdb_readdb_libconfig(const char *filename) {
 	char filepath[256];
 	int i = 0, count = 0;
 
+	nullpo_ret(filename);
 	sprintf(filepath, "%s/%s", map->db_path, filename);
 	memset(&duplicate,0,sizeof(duplicate));
 	if( libconfig->read_file(&item_db_conf, filepath) || !(itdb = libconfig->setting_get_member(item_db_conf.root, "item_db")) ) {
@@ -1852,7 +1878,7 @@ int itemdb_readdb_libconfig(const char *filename) {
 	while( (it = libconfig->setting_get_elem(itdb,i++)) ) {
 		int nameid = itemdb->readdb_libconfig_sub(it, i-1, filename);
 
-		if( !nameid )
+		if (nameid <= 0 || nameid >= MAX_ITEMDB)
 			continue;
 
 		itemdb->readdb_additional_fields(nameid, it, i - 1, filename);
@@ -1876,6 +1902,7 @@ int itemdb_readdb_libconfig(const char *filename) {
 *------------------------------------------*/
 uint64 itemdb_unique_id(struct map_session_data *sd) {
 
+	nullpo_ret(sd);
 	return ((uint64)sd->status.char_id << 32) | sd->status.uniqueitem_counter++;
 }
 
@@ -1926,6 +1953,7 @@ struct item_combo * itemdb_id2combo( unsigned short id ) {
  **/
 bool itemdb_is_item_usable(struct item_data *item)
 {
+	nullpo_retr(false, item);
 	return item->type == IT_HEALING || item->type == IT_USABLE || item->type == IT_CASH;
 }
 
diff --git a/src/map/log.c b/src/map/log.c
index a74cb27c5..c5dd0d044 100644
--- a/src/map/log.c
+++ b/src/map/log.c
@@ -95,6 +95,8 @@ bool should_log_item(int nameid, int amount, int refine, struct item_data *id) {
 }
 void log_branch_sub_sql(struct map_session_data* sd) {
 	SqlStmt* stmt;
+
+	nullpo_retv(sd);
 	stmt = SQL->StmtMalloc(logs->mysql_handle);
 	if( SQL_SUCCESS != SQL->StmtPrepare(stmt, LOG_QUERY " INTO `%s` (`branch_date`, `account_id`, `char_id`, `char_name`, `map`) VALUES (NOW(), '%d', '%d', ?, '%s')", logs->config.log_branch, sd->status.account_id, sd->status.char_id, mapindex_id2name(sd->mapindex) )
 	   ||  SQL_SUCCESS != SQL->StmtBindParam(stmt, 0, SQLDT_STRING, sd->status.name, strnlen(sd->status.name, NAME_LENGTH))
@@ -111,6 +113,7 @@ void log_branch_sub_txt(struct map_session_data* sd) {
 	time_t curtime;
 	FILE* logfp;
 
+	nullpo_retv(sd);
 	if( ( logfp = fopen(logs->config.log_branch, "a") ) == NULL )
 		return;
 	time(&curtime);
@@ -129,6 +132,7 @@ void log_branch(struct map_session_data* sd) {
 	logs->branch_sub(sd);
 }
 void log_pick_sub_sql(int id, int16 m, e_log_pick_type type, int amount, struct item* itm, struct item_data *data) {
+	nullpo_retv(itm);
 	if( SQL_ERROR == SQL->Query(logs->mysql_handle,
 	    LOG_QUERY " INTO `%s` (`time`, `char_id`, `type`, `nameid`, `amount`, `refine`, `card0`, `card1`, `card2`, `card3`, `map`, `unique_id`) "
 	    "VALUES (NOW(), '%d', '%c', '%d', '%d', '%d', '%d', '%d', '%d', '%d', '%s', '%"PRIu64"')",
@@ -144,6 +148,7 @@ void log_pick_sub_txt(int id, int16 m, e_log_pick_type type, int amount, struct
 	time_t curtime;
 	FILE* logfp;
 
+	nullpo_retv(itm);
 	if( ( logfp = fopen(logs->config.log_pick, "a") ) == NULL )
 		return;
 	time(&curtime);
@@ -169,15 +174,19 @@ void log_pick(int id, int16 m, e_log_pick_type type, int amount, struct item* it
 /// logs item transactions (players)
 void log_pick_pc(struct map_session_data* sd, e_log_pick_type type, int amount, struct item* itm, struct item_data *data) {
 	nullpo_retv(sd);
+	nullpo_retv(itm);
 	log_pick(sd->status.char_id, sd->bl.m, type, amount, itm, data ? data : itemdb->exists(itm->nameid));
 }
 
 /// logs item transactions (monsters)
 void log_pick_mob(struct mob_data* md, e_log_pick_type type, int amount, struct item* itm, struct item_data *data) {
 	nullpo_retv(md);
+	nullpo_retv(itm);
 	log_pick(md->class_, md->bl.m, type, amount, itm, data ? data : itemdb->exists(itm->nameid));
 }
 void log_zeny_sub_sql(struct map_session_data* sd, e_log_pick_type type, struct map_session_data* src_sd, int amount) {
+	nullpo_retv(sd);
+	nullpo_retv(src_sd);
 	if( SQL_ERROR == SQL->Query(logs->mysql_handle, LOG_QUERY " INTO `%s` (`time`, `char_id`, `src_id`, `type`, `amount`, `map`) VALUES (NOW(), '%d', '%d', '%c', '%d', '%s')",
 							   logs->config.log_zeny, sd->status.char_id, src_sd->status.char_id, logs->picktype2char(type), amount, mapindex_id2name(sd->mapindex)) )
 	{
@@ -190,6 +199,8 @@ void log_zeny_sub_txt(struct map_session_data* sd, e_log_pick_type type, struct
 	time_t curtime;
 	FILE* logfp;
 
+	nullpo_retv(sd);
+	nullpo_retv(src_sd);
 	if( ( logfp = fopen(logs->config.log_zeny, "a") ) == NULL )
 		return;
 	time(&curtime);
@@ -208,6 +219,8 @@ void log_zeny(struct map_session_data* sd, e_log_pick_type type, struct map_sess
 	logs->zeny_sub(sd,type,src_sd,amount);
 }
 void log_mvpdrop_sub_sql(struct map_session_data* sd, int monster_id, int* log_mvp) {
+	nullpo_retv(sd);
+	nullpo_retv(log_mvp);
 	if( SQL_ERROR == SQL->Query(logs->mysql_handle, LOG_QUERY " INTO `%s` (`mvp_date`, `kill_char_id`, `monster_id`, `prize`, `mvpexp`, `map`) VALUES (NOW(), '%d', '%d', '%d', '%d', '%s') ",
 							   logs->config.log_mvpdrop, sd->status.char_id, monster_id, log_mvp[0], log_mvp[1], mapindex_id2name(sd->mapindex)) )
 	{
@@ -220,6 +233,8 @@ void log_mvpdrop_sub_txt(struct map_session_data* sd, int monster_id, int* log_m
 	time_t curtime;
 	FILE* logfp;
 
+	nullpo_retv(sd);
+	nullpo_retv(log_mvp);
 	if( ( logfp = fopen(logs->config.log_mvpdrop,"a") ) == NULL )
 		return;
 	time(&curtime);
@@ -241,6 +256,8 @@ void log_mvpdrop(struct map_session_data* sd, int monster_id, int* log_mvp)
 void log_atcommand_sub_sql(struct map_session_data* sd, const char* message) {
 	SqlStmt* stmt;
 
+	nullpo_retv(sd);
+	nullpo_retv(message);
 	stmt = SQL->StmtMalloc(logs->mysql_handle);
 	if( SQL_SUCCESS != SQL->StmtPrepare(stmt, LOG_QUERY " INTO `%s` (`atcommand_date`, `account_id`, `char_id`, `char_name`, `map`, `command`) VALUES (NOW(), '%d', '%d', ?, '%s', ?)", logs->config.log_gm, sd->status.account_id, sd->status.char_id, mapindex_id2name(sd->mapindex) )
 	   ||  SQL_SUCCESS != SQL->StmtBindParam(stmt, 0, SQLDT_STRING, sd->status.name, strnlen(sd->status.name, NAME_LENGTH))
@@ -258,6 +275,8 @@ void log_atcommand_sub_txt(struct map_session_data* sd, const char* message) {
 	time_t curtime;
 	FILE* logfp;
 
+	nullpo_retv(sd);
+	nullpo_retv(message);
 	if( ( logfp = fopen(logs->config.log_gm, "a") ) == NULL )
 		return;
 	time(&curtime);
@@ -279,6 +298,9 @@ void log_atcommand(struct map_session_data* sd, const char* message)
 
 void log_npc_sub_sql(struct map_session_data *sd, const char *message) {
 	SqlStmt* stmt;
+
+	nullpo_retv(sd);
+	nullpo_retv(message);
 	stmt = SQL->StmtMalloc(logs->mysql_handle);
 	if( SQL_SUCCESS != SQL->StmtPrepare(stmt, LOG_QUERY " INTO `%s` (`npc_date`, `account_id`, `char_id`, `char_name`, `map`, `mes`) VALUES (NOW(), '%d', '%d', ?, '%s', ?)", logs->config.log_npc, sd->status.account_id, sd->status.char_id, mapindex_id2name(sd->mapindex) )
 	   ||  SQL_SUCCESS != SQL->StmtBindParam(stmt, 0, SQLDT_STRING, sd->status.name, strnlen(sd->status.name, NAME_LENGTH))
@@ -296,6 +318,8 @@ void log_npc_sub_txt(struct map_session_data *sd, const char *message) {
 	time_t curtime;
 	FILE* logfp;
 
+	nullpo_retv(sd);
+	nullpo_retv(message);
 	if( ( logfp = fopen(logs->config.log_npc, "a") ) == NULL )
 		return;
 	time(&curtime);
@@ -317,6 +341,8 @@ void log_npc(struct map_session_data* sd, const char* message)
 void log_chat_sub_sql(e_log_chat_type type, int type_id, int src_charid, int src_accid, const char *mapname, int x, int y, const char* dst_charname, const char* message) {
 	SqlStmt* stmt;
 
+	nullpo_retv(dst_charname);
+	nullpo_retv(message);
 	stmt = SQL->StmtMalloc(logs->mysql_handle);
 	if( SQL_SUCCESS != SQL->StmtPrepare(stmt, LOG_QUERY " INTO `%s` (`time`, `type`, `type_id`, `src_charid`, `src_accountid`, `src_map`, `src_map_x`, `src_map_y`, `dst_charname`, `message`) VALUES (NOW(), '%c', '%d', '%d', '%d', '%s', '%d', '%d', ?, ?)", logs->config.log_chat, logs->chattype2char(type), type_id, src_charid, src_accid, mapname, x, y)
 	 || SQL_SUCCESS != SQL->StmtBindParam(stmt, 0, SQLDT_STRING, (char*)dst_charname, safestrnlen(dst_charname, NAME_LENGTH))
@@ -334,6 +360,9 @@ void log_chat_sub_txt(e_log_chat_type type, int type_id, int src_charid, int src
 	time_t curtime;
 	FILE* logfp;
 
+	nullpo_retv(mapname);
+	nullpo_retv(dst_charname);
+	nullpo_retv(message);
 	if( ( logfp = fopen(logs->config.log_chat, "a") ) == NULL )
 		return;
 	time(&curtime);
@@ -391,6 +420,7 @@ int log_config_read(const char* cfgName) {
 	char line[1024], w1[1024], w2[1024];
 	FILE *fp;
 
+	nullpo_retr(1, cfgName);
 	if( count++ == 0 )
 		log_set_defaults();
 
@@ -489,6 +519,7 @@ int log_config_read(const char* cfgName) {
 
 	return 0;
 }
+
 void log_config_complete(void) {
 	if( logs->config.sql_logs ) {
 		logs->pick_sub = log_pick_sub_sql;
@@ -500,6 +531,7 @@ void log_config_complete(void) {
 		logs->mvpdrop_sub = log_mvpdrop_sub_sql;
 	}
 }
+
 void log_defaults(void) {
 	logs = &log_s;
 
diff --git a/src/map/mail.c b/src/map/mail.c
index e952d9b63..8abeed285 100644
--- a/src/map/mail.c
+++ b/src/map/mail.c
@@ -23,6 +23,7 @@ struct mail_interface *mail;
 
 void mail_clear(struct map_session_data *sd)
 {
+	nullpo_retv(sd);
 	sd->mail.nameid = 0;
 	sd->mail.index = 0;
 	sd->mail.amount = 0;
@@ -64,6 +65,7 @@ int mail_removezeny(struct map_session_data *sd, short flag)
 
 unsigned char mail_setitem(struct map_session_data *sd, int idx, int amount) {
 
+	nullpo_retr(1, sd);
 	if( pc_istrading(sd) )
 		return 1;
 
@@ -109,6 +111,7 @@ bool mail_setattachment(struct map_session_data *sd, struct mail_message *msg)
 		return false;
 
 	n = sd->mail.index;
+	Assert_retr(false, n >= 0 && n < MAX_INVENTORY);
 	if( sd->mail.amount )
 	{
 		if( sd->status.inventory[n].nameid != sd->mail.nameid )
@@ -139,6 +142,8 @@ bool mail_setattachment(struct map_session_data *sd, struct mail_message *msg)
 
 void mail_getattachment(struct map_session_data* sd, int zeny, struct item* item)
 {
+	nullpo_retv(sd);
+	nullpo_retv(item);
 	if( item->nameid > 0 && item->amount > 0 )
 	{
 		pc->additem(sd, item, item->amount, LOG_TYPE_MAIL);
@@ -184,6 +189,7 @@ void mail_deliveryfail(struct map_session_data *sd, struct mail_message *msg)
 
 // This function only check if the mail operations are valid
 bool mail_invalid_operation(struct map_session_data *sd) {
+	nullpo_retr(false, sd);
 	if( !map->list[sd->bl.m].flag.town && !pc->can_use_command(sd, "@mail") ) {
 		ShowWarning("clif->parse_Mail: char '%s' trying to do invalid mail operations.\n", sd->status.name);
 		return true;