diff --git a/src/libomemo.c b/src/libomemo.c
index 6ad472c..dc2421f 100644
--- a/src/libomemo.c
+++ b/src/libomemo.c
@@ -720,6 +720,11 @@ int omemo_devicelist_import(char * received_devicelist, const char * from, omemo
     goto cleanup;
   }
 
+  if (mxmlGetType(item_node_p) != MXML_ELEMENT) {
+    ret_val = OMEMO_ERR_MALFORMED_DEVICELIST_NO_ITEM_ELEM;
+    goto cleanup;
+  }
+
   ret_val = strncmp(mxmlGetElement(item_node_p), ITEM_NODE_NAME, strlen(ITEM_NODE_NAME));
   if (ret_val) {
     // child of <items> element is not an <item> element
@@ -803,6 +808,7 @@ int omemo_devicelist_add(omemo_devicelist * dl_p, uint32_t device_id) {
   mxmlAdd(dl_p->list_node_p, MXML_ADD_AFTER, MXML_ADD_TO_PARENT, device_node_p);
   dl_p->id_list_p = g_list_append(dl_p->id_list_p, id_p);
 
+  free(id_string);
   return 0;
 }
 
@@ -850,6 +856,7 @@ int omemo_devicelist_remove(omemo_devicelist * dl_p, uint32_t device_id) {
   for (curr_p = dl_p->id_list_p; curr_p; curr_p = curr_p->next) {
     if (omemo_devicelist_list_data(curr_p) == device_id) {
       remove_id_p = curr_p->data;
+      free(curr_p->data);
       break;
     }
   }
@@ -1423,7 +1430,7 @@ static int omemo_message_find_key_element(omemo_message * msg_p, uint32_t rid, m
     }
   }
 
-  
+
 cleanup:
   free(rid_string);
 
@@ -1459,7 +1466,7 @@ int omemo_message_get_encrypted_key(omemo_message * msg_p, uint32_t own_device_i
 cleanup:
   *key_pp = key_p;
   *key_len_p = key_len;
-  
+
   return ret_val;
 }
 
@@ -1605,5 +1612,6 @@ void omemo_message_destroy(omemo_message * msg_p) {
       memset(msg_p->iv_p, 0, msg_p->iv_len);
       free(msg_p->iv_p);
     }
+    free(msg_p);
   }
 }
diff --git a/test/test_libomemo.c b/test/test_libomemo.c
index 72cd832..ff20d0f 100644
--- a/test/test_libomemo.c
+++ b/test/test_libomemo.c
@@ -322,6 +322,8 @@ void test_bundle_set_device_id(void ** state) {
 
   assert_int_equal(omemo_bundle_set_device_id(bundle_p, 1337), 0);
   assert_string_equal(bundle_p->device_id, "1337");
+
+  omemo_bundle_destroy(bundle_p);
 }
 
 void test_bundle_set_signed_pre_key(void ** state) {
@@ -479,7 +481,9 @@ void test_bundle_export(void ** state) {
   assert_string_equal(mxmlGetElement(pre_key_node_p), "preKeyPublic");
   assert_string_equal(mxmlElementGetAttr(pre_key_node_p, "preKeyId"), "20");
 
-   mxmlDelete(publish_node_p);
+  free(publish);
+  mxmlDelete(publish_node_p);
+  omemo_bundle_destroy(bundle_p);
 }
 
 void test_bundle_get_pep_node_name(void ** state) {
@@ -840,6 +844,8 @@ void test_message_is_encrypted_key_prekey(void ** state) {
 
   assert_int_equal(omemo_message_is_encrypted_key_prekey(msg_p, 9999, &is_prekey), 0);
   assert_int_equal(is_prekey, false);
+
+  omemo_message_destroy(msg_p);
 }
 
 void test_message_get_encrypted_key_after_iv(void ** state) {
diff --git a/test/test_storage.c b/test/test_storage.c
index d49504c..95039e7 100644
--- a/test/test_storage.c
+++ b/test/test_storage.c
@@ -64,6 +64,7 @@ void test_devicelist_retrieve(void ** state) {
   (void) state;
 
   omemo_devicelist * dl_p;
+  GList * id_list_p;
 
   assert_int_equal(omemo_storage_user_devicelist_retrieve("alice", TEST_DB_PATH, &dl_p), 0);
   assert_ptr_not_equal(dl_p, (void *) 0);
@@ -74,16 +75,20 @@ void test_devicelist_retrieve(void ** state) {
   assert_int_equal(omemo_storage_user_devicelist_retrieve("alice", TEST_DB_PATH, &dl_p), 0);
 
   assert_ptr_not_equal(dl_p, (void *) 0);
-  assert_int_equal(omemo_devicelist_list_data(omemo_devicelist_get_id_list(dl_p)), 1337);
-  assert_ptr_equal((omemo_devicelist_get_id_list(dl_p))->next, (void *) 0);
+  id_list_p = omemo_devicelist_get_id_list(dl_p);
+  assert_int_equal(omemo_devicelist_list_data(id_list_p), 1337);
+  assert_ptr_equal(id_list_p->next, (void *) 0);
+  g_list_free_full(id_list_p, free);
   omemo_devicelist_destroy(dl_p);
 
   assert_int_equal(omemo_storage_user_device_id_save("alice", 1338, TEST_DB_PATH), 0);
   assert_int_equal(omemo_storage_user_devicelist_retrieve("alice", TEST_DB_PATH, &dl_p), 0);
   assert_ptr_not_equal(dl_p, (void *) 0);
-  assert_int_equal(omemo_devicelist_list_data(omemo_devicelist_get_id_list(dl_p)), 1337);
-  assert_int_equal(omemo_devicelist_list_data(omemo_devicelist_get_id_list(dl_p)), 1337);
-  assert_int_equal(omemo_devicelist_list_data(omemo_devicelist_get_id_list(dl_p)->next), 1338);
+  id_list_p = omemo_devicelist_get_id_list(dl_p);
+  assert_int_equal(omemo_devicelist_list_data(id_list_p), 1337);
+  assert_int_equal(omemo_devicelist_list_data(id_list_p), 1337);
+  assert_int_equal(omemo_devicelist_list_data(id_list_p->next), 1338);
+  g_list_free_full(id_list_p, free);
 
   omemo_devicelist_destroy(dl_p);
 }