diff --git a/channels/client/CMakeLists.txt b/channels/client/CMakeLists.txt
index b337cf604..96714f701 100644
--- a/channels/client/CMakeLists.txt
+++ b/channels/client/CMakeLists.txt
@@ -46,11 +46,11 @@ foreach(STATIC_ENTRY ${CHANNEL_STATIC_CLIENT_ENTRIES})
 	set(CLIENT_STATIC_ENTRY_IMPORTS "${CLIENT_STATIC_ENTRY_IMPORTS}\n${${STATIC_ENTRY}_IMPORTS}")
 	set(CLIENT_STATIC_ENTRY_TABLES "${CLIENT_STATIC_ENTRY_TABLES}\nconst STATIC_ENTRY CLIENT_${STATIC_ENTRY}_TABLE[] =\n{")
 	set(CLIENT_STATIC_ENTRY_TABLES "${CLIENT_STATIC_ENTRY_TABLES}\n${${STATIC_ENTRY}_TABLE}")
-	set(CLIENT_STATIC_ENTRY_TABLES "${CLIENT_STATIC_ENTRY_TABLES}\n\t{ \"\", NULL }\n};")
+	set(CLIENT_STATIC_ENTRY_TABLES "${CLIENT_STATIC_ENTRY_TABLES}\n\t{ NULL, NULL }\n};")
 	set(CLIENT_STATIC_ENTRY_TABLES_LIST "${CLIENT_STATIC_ENTRY_TABLES_LIST}\n\t{ \"${STATIC_ENTRY}\", CLIENT_${STATIC_ENTRY}_TABLE },")
 endforeach()
 
-set(CLIENT_STATIC_ENTRY_TABLES_LIST "${CLIENT_STATIC_ENTRY_TABLES_LIST}\n\t{ \"\", NULL }\n};")
+set(CLIENT_STATIC_ENTRY_TABLES_LIST "${CLIENT_STATIC_ENTRY_TABLES_LIST}\n\t{ NULL, NULL }\n};")
 
 set(CLIENT_STATIC_ADDIN_TABLE "const STATIC_ADDIN_TABLE CLIENT_STATIC_ADDIN_TABLE[] =\n{")
 foreach(STATIC_MODULE ${CHANNEL_STATIC_CLIENT_MODULES})
diff --git a/channels/client/channels.c b/channels/client/channels.c
index 55cba8b1c..87fc6c47d 100644
--- a/channels/client/channels.c
+++ b/channels/client/channels.c
@@ -358,7 +358,9 @@ void* freerdp_channels_load_static_addin_entry(LPCSTR pszName, LPSTR pszSubsyste
 				}
 			}
 			else
+			{
 				return (void*) CLIENT_STATIC_ADDIN_TABLE[i].entry;
+			}
 		}
 	}
 
diff --git a/include/freerdp/gdi/gdi.h b/include/freerdp/gdi/gdi.h
index 77da30dfb..e44ae525e 100644
--- a/include/freerdp/gdi/gdi.h
+++ b/include/freerdp/gdi/gdi.h
@@ -69,6 +69,12 @@
 #define GDI_DPa				0x00A000C9 /* D = D & P */
 #define GDI_PDxn			0x00A50065 /* D = D ^ ~P */
 
+#define GDI_DSxn			0x00990066
+#define GDI_PSDnox			0x002D060A
+#define GDI_PDSona			0x00100C85
+#define GDI_DSPDxox			0x00740646
+#define GDI_DPSDonox			0x005B18A9
+
 #define GDI_DPon			0x000500A9
 #define GDI_DPna			0x000A0329
 #define GDI_Pn				0x000F0001
diff --git a/include/freerdp/secondary.h b/include/freerdp/secondary.h
index dfd7d338b..bb5e68f2b 100644
--- a/include/freerdp/secondary.h
+++ b/include/freerdp/secondary.h
@@ -147,7 +147,7 @@ struct _CACHE_GLYPH_ORDER
 {
 	UINT32 cacheId;
 	UINT32 cGlyphs;
-	GLYPH_DATA* glyphData[255];
+	GLYPH_DATA glyphData[255];
 	BYTE* unicodeCharacters;
 };
 typedef struct _CACHE_GLYPH_ORDER CACHE_GLYPH_ORDER;
@@ -169,7 +169,7 @@ struct _CACHE_GLYPH_V2_ORDER
 	UINT32 cacheId;
 	UINT32 flags;
 	UINT32 cGlyphs;
-	GLYPH_DATA_V2* glyphData[255];
+	GLYPH_DATA_V2 glyphData[255];
 	BYTE* unicodeCharacters;
 };
 typedef struct _CACHE_GLYPH_V2_ORDER CACHE_GLYPH_V2_ORDER;
@@ -182,7 +182,7 @@ struct _CACHE_BRUSH_ORDER
 	UINT32 cy;
 	UINT32 style;
 	UINT32 length;
-	BYTE* data;
+	BYTE data[256];
 };
 typedef struct _CACHE_BRUSH_ORDER CACHE_BRUSH_ORDER;
 
diff --git a/libfreerdp/cache/brush.c b/libfreerdp/cache/brush.c
index 68f364c2d..fa8464af7 100644
--- a/libfreerdp/cache/brush.c
+++ b/libfreerdp/cache/brush.c
@@ -75,8 +75,16 @@ void update_gdi_polygon_cb(rdpContext* context, POLYGON_CB_ORDER* polygon_cb)
 
 void update_gdi_cache_brush(rdpContext* context, CACHE_BRUSH_ORDER* cache_brush)
 {
+	int length;
+	void* data = NULL;
 	rdpCache* cache = context->cache;
-	brush_cache_put(cache->brush, cache_brush->index, cache_brush->data, cache_brush->bpp);
+
+	length = cache_brush->bpp * 64 / 8;
+
+	data = malloc(length);
+	CopyMemory(data, cache_brush->data, length);
+
+	brush_cache_put(cache->brush, cache_brush->index, data, cache_brush->bpp);
 }
 
 void* brush_cache_get(rdpBrushCache* brush, UINT32 index, UINT32* bpp)
diff --git a/libfreerdp/cache/glyph.c b/libfreerdp/cache/glyph.c
index d0f57d0f4..59336e607 100644
--- a/libfreerdp/cache/glyph.c
+++ b/libfreerdp/cache/glyph.c
@@ -312,7 +312,7 @@ void update_gdi_cache_glyph(rdpContext* context, CACHE_GLYPH_ORDER* cache_glyph)
 
 	for (i = 0; i < (int) cache_glyph->cGlyphs; i++)
 	{
-		glyph_data = cache_glyph->glyphData[i];
+		glyph_data = &cache_glyph->glyphData[i];
 
 		glyph = Glyph_Alloc(context);
 
@@ -325,9 +325,6 @@ void update_gdi_cache_glyph(rdpContext* context, CACHE_GLYPH_ORDER* cache_glyph)
 		Glyph_New(context, glyph);
 
 		glyph_cache_put(cache->glyph, cache_glyph->cacheId, glyph_data->cacheIndex, glyph);
-
-		cache_glyph->glyphData[i] = NULL;
-		free(glyph_data);
 	}
 }
 
@@ -340,7 +337,7 @@ void update_gdi_cache_glyph_v2(rdpContext* context, CACHE_GLYPH_V2_ORDER* cache_
 
 	for (i = 0; i < (int) cache_glyph_v2->cGlyphs; i++)
 	{
-		glyph_data = cache_glyph_v2->glyphData[i];
+		glyph_data = &cache_glyph_v2->glyphData[i];
 
 		glyph = Glyph_Alloc(context);
 
@@ -353,9 +350,6 @@ void update_gdi_cache_glyph_v2(rdpContext* context, CACHE_GLYPH_V2_ORDER* cache_
 		Glyph_New(context, glyph);
 
 		glyph_cache_put(cache->glyph, cache_glyph_v2->cacheId, glyph_data->cacheIndex, glyph);
-
-		cache_glyph_v2->glyphData[i] = NULL;
-		free(glyph_data);
 	}
 }
 
diff --git a/libfreerdp/cache/pointer.c b/libfreerdp/cache/pointer.c
index 3d4267361..c0765be5e 100644
--- a/libfreerdp/cache/pointer.c
+++ b/libfreerdp/cache/pointer.c
@@ -48,6 +48,7 @@ void update_pointer_system(rdpContext* context, POINTER_SYSTEM_UPDATE* pointer_s
 
 		default:
 			printf("Unknown system pointer type (0x%08X)\n", pointer_system->type);
+			break;
 	}
 }
 
@@ -92,8 +93,20 @@ void update_pointer_new(rdpContext* context, POINTER_NEW_UPDATE* pointer_new)
 		pointer->height = pointer_new->colorPtrAttr.height;
 		pointer->lengthAndMask = pointer_new->colorPtrAttr.lengthAndMask;
 		pointer->lengthXorMask = pointer_new->colorPtrAttr.lengthXorMask;
-		pointer->xorMaskData = pointer_new->colorPtrAttr.xorMaskData;
-		pointer->andMaskData = pointer_new->colorPtrAttr.andMaskData;
+
+		pointer->andMaskData = pointer->xorMaskData = NULL;
+
+		if (pointer->lengthAndMask)
+		{
+			pointer->andMaskData = (BYTE*) malloc(pointer->lengthAndMask);
+			CopyMemory(pointer->andMaskData, pointer_new->colorPtrAttr.andMaskData, pointer->lengthAndMask);
+		}
+
+		if (pointer->lengthXorMask)
+		{
+			pointer->xorMaskData = (BYTE*) malloc(pointer->lengthXorMask);
+			CopyMemory(pointer->xorMaskData, pointer_new->colorPtrAttr.xorMaskData, pointer->lengthXorMask);
+		}
 
 		pointer->New(context, pointer);
 		pointer_cache_put(cache->pointer, pointer_new->colorPtrAttr.cacheIndex, pointer);
diff --git a/libfreerdp/common/settings.c b/libfreerdp/common/settings.c
index e54215b30..4a8a8ee8f 100644
--- a/libfreerdp/common/settings.c
+++ b/libfreerdp/common/settings.c
@@ -215,11 +215,15 @@ ADDIN_ARGV* freerdp_static_channel_collection_find(rdpSettings* settings, const
 
 void freerdp_static_channel_collection_free(rdpSettings* settings)
 {
-	int index;
+	int i, j;
 
-	for (index = 0; index < settings->StaticChannelCount; index++)
+	for (i = 0; i < settings->StaticChannelCount; i++)
 	{
-		free(settings->StaticChannelArray[index]);
+		for (j = 0; j < settings->StaticChannelArray[i]->argc; j++)
+			free(settings->StaticChannelArray[i]->argv[j]);
+
+		free(settings->StaticChannelArray[i]->argv);
+		free(settings->StaticChannelArray[i]);
 	}
 
 	free(settings->StaticChannelArray);
diff --git a/libfreerdp/core/message.c b/libfreerdp/core/message.c
index bf2ccf355..f988ee32c 100644
--- a/libfreerdp/core/message.c
+++ b/libfreerdp/core/message.c
@@ -460,7 +460,7 @@ static void message_CacheBitmapV2(rdpContext* context, CACHE_BITMAP_V2_ORDER* ca
 	CopyMemory(wParam, cacheBitmapV2Order, sizeof(CACHE_BITMAP_V2_ORDER));
 
 	wParam->bitmapDataStream = (BYTE*) malloc(wParam->bitmapLength);
-	CopyMemory(wParam->bitmapDataStream, cacheBitmapV2Order, wParam->bitmapLength);
+	CopyMemory(wParam->bitmapDataStream, cacheBitmapV2Order->bitmapDataStream, wParam->bitmapLength);
 
 	MessageQueue_Post(context->update->queue, (void*) context,
 			MakeMessageId(SecondaryUpdate, CacheBitmapV2), (void*) wParam, NULL);
@@ -496,36 +496,22 @@ static void message_CacheColorTable(rdpContext* context, CACHE_COLOR_TABLE_ORDER
 
 static void message_CacheGlyph(rdpContext* context, CACHE_GLYPH_ORDER* cacheGlyphOrder)
 {
-	int index;
 	CACHE_GLYPH_ORDER* wParam;
 
 	wParam = (CACHE_GLYPH_ORDER*) malloc(sizeof(CACHE_GLYPH_ORDER));
 	CopyMemory(wParam, cacheGlyphOrder, sizeof(CACHE_GLYPH_ORDER));
 
-	for (index = 0; index < wParam->cGlyphs; index++)
-	{
-		wParam->glyphData[index] = (GLYPH_DATA*) malloc(sizeof(GLYPH_DATA));
-		CopyMemory(wParam->glyphData[index], cacheGlyphOrder->glyphData[index], sizeof(GLYPH_DATA));
-	}
-
 	MessageQueue_Post(context->update->queue, (void*) context,
 			MakeMessageId(SecondaryUpdate, CacheGlyph), (void*) wParam, NULL);
 }
 
 static void message_CacheGlyphV2(rdpContext* context, CACHE_GLYPH_V2_ORDER* cacheGlyphV2Order)
 {
-	int index;
 	CACHE_GLYPH_V2_ORDER* wParam;
 
 	wParam = (CACHE_GLYPH_V2_ORDER*) malloc(sizeof(CACHE_GLYPH_V2_ORDER));
 	CopyMemory(wParam, cacheGlyphV2Order, sizeof(CACHE_GLYPH_V2_ORDER));
 
-	for (index = 0; index < wParam->cGlyphs; index++)
-	{
-		wParam->glyphData[index] = (GLYPH_DATA_V2*) malloc(sizeof(GLYPH_DATA_V2));
-		CopyMemory(wParam->glyphData[index], cacheGlyphV2Order->glyphData[index], sizeof(GLYPH_DATA_V2));
-	}
-
 	MessageQueue_Post(context->update->queue, (void*) context,
 			MakeMessageId(SecondaryUpdate, CacheGlyphV2), (void*) wParam, NULL);
 }
@@ -537,9 +523,6 @@ static void message_CacheBrush(rdpContext* context, CACHE_BRUSH_ORDER* cacheBrus
 	wParam = (CACHE_BRUSH_ORDER*) malloc(sizeof(CACHE_BRUSH_ORDER));
 	CopyMemory(wParam, cacheBrushOrder, sizeof(CACHE_BRUSH_ORDER));
 
-	//wParam->data = (BYTE*) malloc(wParam->length);
-	//CopyMemory(wParam->data, cacheBrushOrder->data, wParam->length);
-
 	MessageQueue_Post(context->update->queue, (void*) context,
 			MakeMessageId(SecondaryUpdate, CacheBrush), (void*) wParam, NULL);
 }
@@ -1192,7 +1175,7 @@ int message_process_secondary_update_class(rdpMessage* update, wMessage* msg, in
 			{
 				CACHE_BITMAP_V2_ORDER* wParam = (CACHE_BITMAP_V2_ORDER*) msg->wParam;
 
-				//free(wParam->bitmapDataStream);
+				free(wParam->bitmapDataStream);
 				free(wParam);
 			}
 			break;
@@ -1220,12 +1203,7 @@ int message_process_secondary_update_class(rdpMessage* update, wMessage* msg, in
 		case SecondaryUpdate_CacheGlyph:
 			IFCALL(update->CacheGlyph, msg->context, (CACHE_GLYPH_ORDER*) msg->wParam);
 			{
-				int index;
 				CACHE_GLYPH_ORDER* wParam = (CACHE_GLYPH_ORDER*) msg->wParam;
-
-				for (index = 0; index < wParam->cGlyphs; index++)
-					free(wParam->glyphData[index]);
-
 				free(wParam);
 			}
 			break;
@@ -1233,12 +1211,7 @@ int message_process_secondary_update_class(rdpMessage* update, wMessage* msg, in
 		case SecondaryUpdate_CacheGlyphV2:
 			IFCALL(update->CacheGlyphV2, msg->context, (CACHE_GLYPH_V2_ORDER*) msg->wParam);
 			{
-				int index;
 				CACHE_GLYPH_V2_ORDER* wParam = (CACHE_GLYPH_V2_ORDER*) msg->wParam;
-
-				for (index = 0; index < wParam->cGlyphs; index++)
-					free(wParam->glyphData[index]);
-
 				free(wParam);
 			}
 			break;
@@ -1247,8 +1220,6 @@ int message_process_secondary_update_class(rdpMessage* update, wMessage* msg, in
 			IFCALL(update->CacheBrush, msg->context, (CACHE_BRUSH_ORDER*) msg->wParam);
 			{
 				CACHE_BRUSH_ORDER* wParam = (CACHE_BRUSH_ORDER*) msg->wParam;
-
-				//free(wParam->data);
 				free(wParam);
 			}
 			break;
@@ -1445,8 +1416,8 @@ int message_process_pointer_update_class(rdpMessage* update, wMessage* msg, int
 			{
 				POINTER_COLOR_UPDATE* wParam = (POINTER_COLOR_UPDATE*) msg->wParam;
 
-				//free(wParam->andMaskData);
-				//free(wParam->xorMaskData);
+				free(wParam->andMaskData);
+				free(wParam->xorMaskData);
 				free(wParam);
 			}
 			break;
@@ -1456,8 +1427,8 @@ int message_process_pointer_update_class(rdpMessage* update, wMessage* msg, int
 			{
 				POINTER_NEW_UPDATE* wParam = (POINTER_NEW_UPDATE*) msg->wParam;
 
-				//free(wParam->colorPtrAttr.andMaskData);
-				//free(wParam->colorPtrAttr.xorMaskData);
+				free(wParam->colorPtrAttr.andMaskData);
+				free(wParam->colorPtrAttr.xorMaskData);
 				free(wParam);
 			}
 			break;
diff --git a/libfreerdp/core/orders.c b/libfreerdp/core/orders.c
index bf458bbea..5cc4df7c9 100644
--- a/libfreerdp/core/orders.c
+++ b/libfreerdp/core/orders.c
@@ -1269,19 +1269,17 @@ BOOL update_read_cache_glyph_order(STREAM* s, CACHE_GLYPH_ORDER* cache_glyph_ord
 
 	if (stream_get_left(s) < 2)
 		return FALSE;
+
 	stream_read_BYTE(s, cache_glyph_order->cacheId); /* cacheId (1 byte) */
 	stream_read_BYTE(s, cache_glyph_order->cGlyphs); /* cGlyphs (1 byte) */
 
 	for (i = 0; i < (int) cache_glyph_order->cGlyphs; i++)
 	{
-		if (cache_glyph_order->glyphData[i] == NULL)
-		{
-			cache_glyph_order->glyphData[i] = (GLYPH_DATA*) malloc(sizeof(GLYPH_DATA));
-		}
-		glyph = cache_glyph_order->glyphData[i];
+		glyph = &cache_glyph_order->glyphData[i];
 
 		if (stream_get_left(s) < 10)
 			return FALSE;
+
 		stream_read_UINT16(s, glyph->cacheIndex);
 		stream_read_UINT16(s, lsi16);
 		glyph->x = lsi16;
@@ -1295,13 +1293,16 @@ BOOL update_read_cache_glyph_order(STREAM* s, CACHE_GLYPH_ORDER* cache_glyph_ord
 
 		if (stream_get_left(s) < glyph->cb)
 			return FALSE;
+
 		glyph->aj = (BYTE*) malloc(glyph->cb);
 		stream_read(s, glyph->aj, glyph->cb);
 	}
 
-	if (flags & CG_GLYPH_UNICODE_PRESENT) {
+	if (flags & CG_GLYPH_UNICODE_PRESENT)
+	{
 		return stream_skip(s, cache_glyph_order->cGlyphs * 2);
 	}
+
 	return TRUE;
 }
 
@@ -1316,14 +1317,11 @@ BOOL update_read_cache_glyph_v2_order(STREAM* s, CACHE_GLYPH_V2_ORDER* cache_gly
 
 	for (i = 0; i < (int) cache_glyph_v2_order->cGlyphs; i++)
 	{
-		if (cache_glyph_v2_order->glyphData[i] == NULL)
-		{
-			cache_glyph_v2_order->glyphData[i] = (GLYPH_DATA_V2*) malloc(sizeof(GLYPH_DATA_V2));
-		}
-		glyph = cache_glyph_v2_order->glyphData[i];
+		glyph = &cache_glyph_v2_order->glyphData[i];
 
 		if (stream_get_left(s) < 1)
 			return FALSE;
+
 		stream_read_BYTE(s, glyph->cacheIndex);
 
 		if (!update_read_2byte_signed(s, &glyph->x) ||
@@ -1339,13 +1337,16 @@ BOOL update_read_cache_glyph_v2_order(STREAM* s, CACHE_GLYPH_V2_ORDER* cache_gly
 
 		if (stream_get_left(s) < glyph->cb)
 			return FALSE;
+
 		glyph->aj = (BYTE*) malloc(glyph->cb);
 		stream_read(s, glyph->aj, glyph->cb);
 	}
 
-	if (flags & CG_GLYPH_UNICODE_PRESENT) {
+	if (flags & CG_GLYPH_UNICODE_PRESENT)
+	{
 		return stream_skip(s, cache_glyph_v2_order->cGlyphs * 2);
 	}
+
 	return TRUE;
 }
 
@@ -1390,6 +1391,7 @@ BOOL update_read_cache_brush_order(STREAM* s, CACHE_BRUSH_ORDER* cache_brush_ord
 
 	if (stream_get_left(s) < 6)
 		return FALSE;
+
 	stream_read_BYTE(s, cache_brush_order->index); /* cacheEntry (1 byte) */
 
 	stream_read_BYTE(s, iBitmapFormat); /* iBitmapFormat (1 byte) */
@@ -1404,8 +1406,6 @@ BOOL update_read_cache_brush_order(STREAM* s, CACHE_BRUSH_ORDER* cache_brush_ord
 	{
 		size = (cache_brush_order->bpp == 1) ? 8 : 8 * 8 * cache_brush_order->bpp;
 
-		cache_brush_order->data = (BYTE*) malloc(size);
-
 		if (cache_brush_order->bpp == 1)
 		{
 			if (cache_brush_order->length != 8)
@@ -1442,6 +1442,7 @@ BOOL update_read_cache_brush_order(STREAM* s, CACHE_BRUSH_ORDER* cache_brush_ord
 			{
 				/* uncompressed brush */
 				int scanline = (cache_brush_order->bpp / 8) * 8;
+
 				if (stream_get_left(s) < scanline * 8)
 					return FALSE;
 
@@ -1452,6 +1453,7 @@ BOOL update_read_cache_brush_order(STREAM* s, CACHE_BRUSH_ORDER* cache_brush_ord
 			}
 		}
 	}
+
 	return TRUE;
 }
 
diff --git a/libfreerdp/core/update.c b/libfreerdp/core/update.c
index 8463cae4f..29d621dc8 100644
--- a/libfreerdp/core/update.c
+++ b/libfreerdp/core/update.c
@@ -243,7 +243,12 @@ BOOL update_read_pointer_color(STREAM* s, POINTER_COLOR_UPDATE* pointer_color)
 	{
 		if (stream_get_left(s) < pointer_color->lengthXorMask)
 			return FALSE;
-		pointer_color->xorMaskData = (BYTE*) malloc(pointer_color->lengthXorMask);
+
+		if (!pointer_color->xorMaskData)
+			pointer_color->xorMaskData = malloc(pointer_color->lengthXorMask);
+		else
+			pointer_color->xorMaskData = realloc(pointer_color->xorMaskData, pointer_color->lengthXorMask);
+
 		stream_read(s, pointer_color->xorMaskData, pointer_color->lengthXorMask);
 	}
 
@@ -251,12 +256,18 @@ BOOL update_read_pointer_color(STREAM* s, POINTER_COLOR_UPDATE* pointer_color)
 	{
 		if (stream_get_left(s) < pointer_color->lengthAndMask)
 			return FALSE;
-		pointer_color->andMaskData = (BYTE*) malloc(pointer_color->lengthAndMask);
+
+		if (!pointer_color->andMaskData)
+			pointer_color->andMaskData = malloc(pointer_color->lengthAndMask);
+		else
+			pointer_color->andMaskData = realloc(pointer_color->andMaskData, pointer_color->lengthAndMask);
+
 		stream_read(s, pointer_color->andMaskData, pointer_color->lengthAndMask);
 	}
 
 	if (stream_get_left(s) > 0)
 		stream_seek_BYTE(s); /* pad (1 byte) */
+
 	return TRUE;
 }