diff --git a/util/ChangeLog b/util/ChangeLog
index 55e584ed5..4b1309879 100644
--- a/util/ChangeLog
+++ b/util/ChangeLog
@@ -1,3 +1,17 @@
+2002-11-06  David Shaw  <dshaw@jabberwocky.com>
+
+	* w32reg.c (read_w32_registry_string): Fixed expanding of the
+	environment buffer; didn't worked at all.  Reported by Thijmen
+	Klok.  From Werner on stable branch.
+
+	* secmem.c (secmem_free, secmem_term): Use wipememory2() instead
+	of memset() to overwrite secure memory
+
+	* iobuf.c (direct_open): Handle mode 'b' if O_BINARY is available.
+	From Werner on stable branch.
+
+	* fileutil.c: Comment from stable branch.
+
 2002-10-31  Stefan Bellon  <sbellon@sbellon.de>
 
 	* riscos.c (riscos_load_module, riscos_check_regexp): New.
diff --git a/util/fileutil.c b/util/fileutil.c
index 92dbc9ef6..14be8b698 100644
--- a/util/fileutil.c
+++ b/util/fileutil.c
@@ -89,10 +89,10 @@ make_dirname(const char *filepath)
 
 
 
-/****************
- * Construct a filename from the NULL terminated list of parts.
- * Tilde expansion is done here.
- */
+/*
+  Construct a filename from the NULL terminated list of parts.  Tilde
+  expansion is done here.  Note that FIRST_PART must never be NULL and
+  that this function is guaranteed to return an allocated string.  */
 char *
 make_filename( const char *first_part, ... )
 {
diff --git a/util/iobuf.c b/util/iobuf.c
index a3e9ad3e6..953d9f3df 100644
--- a/util/iobuf.c
+++ b/util/iobuf.c
@@ -208,6 +208,10 @@ direct_open (const char *fname, const char *mode)
     else {
         oflag = O_RDONLY;
     }
+#ifdef O_BINARY
+    if (strchr (mode, 'b'))
+      oflag |= O_BINARY;
+#endif
 #ifndef __riscos__
     return open (fname, oflag, cflag );
 #else
diff --git a/util/secmem.c b/util/secmem.c
index d077fed17..0a0931afc 100644
--- a/util/secmem.c
+++ b/util/secmem.c
@@ -408,10 +408,10 @@ secmem_free( void *a )
     size = mb->size;
     /* This does not make much sense: probably this memory is held in the
      * cache. We do it anyway: */
-    memset(mb, 0xff, size );
-    memset(mb, 0xaa, size );
-    memset(mb, 0x55, size );
-    memset(mb, 0x00, size );
+    wipememory2(mb, 0xff, size );
+    wipememory2(mb, 0xaa, size );
+    wipememory2(mb, 0x55, size );
+    wipememory2(mb, 0x00, size );
     mb->size = size;
     mb->u.next = unused_blocks;
     unused_blocks = mb;
@@ -441,10 +441,10 @@ secmem_term()
     if( !pool_okay )
 	return;
 
-    memset( pool, 0xff, poolsize);
-    memset( pool, 0xaa, poolsize);
-    memset( pool, 0x55, poolsize);
-    memset( pool, 0x00, poolsize);
+    wipememory2( pool, 0xff, poolsize);
+    wipememory2( pool, 0xaa, poolsize);
+    wipememory2( pool, 0x55, poolsize);
+    wipememory2( pool, 0x00, poolsize);
   #ifdef HAVE_MMAP
     if( pool_is_mmapped )
 	munmap( pool, poolsize );
diff --git a/util/w32reg.c b/util/w32reg.c
index 5391c8027..aa507b2d7 100644
--- a/util/w32reg.c
+++ b/util/w32reg.c
@@ -103,6 +103,7 @@ read_w32_registry_string( const char *root, const char *dir, const char *name )
         nbytes = ExpandEnvironmentStrings (result, tmp, n1);
         if (nbytes && nbytes > n1) {
             free (tmp);
+            n1 = nbytes;
             tmp = malloc (n1 + 1);
             if (!tmp)
                 goto leave;