diff --git a/Android.mk b/Android.mk
index 0484065..3bcbeab 100644
--- a/Android.mk
+++ b/Android.mk
@@ -76,7 +76,6 @@
     libcutils \
     liblog \
     libselinux \
-    libstdc++ \
     libm \
     libc
 
@@ -119,7 +118,6 @@
     libminui \
     libminzip \
     libcutils \
-    libstdc++ \
     libc
 include $(BUILD_EXECUTABLE)
 
diff --git a/applypatch/Android.mk b/applypatch/Android.mk
index 4984093..861edd2 100644
--- a/applypatch/Android.mk
+++ b/applypatch/Android.mk
@@ -29,7 +29,7 @@
 LOCAL_MODULE := applypatch
 LOCAL_C_INCLUDES += bootable/recovery
 LOCAL_STATIC_LIBRARIES += libapplypatch libmtdutils libmincrypt libbz
-LOCAL_SHARED_LIBRARIES += libz libcutils libstdc++ libc
+LOCAL_SHARED_LIBRARIES += libz libcutils libc
 
 include $(BUILD_EXECUTABLE)
 
@@ -41,7 +41,7 @@
 LOCAL_MODULE_TAGS := eng
 LOCAL_C_INCLUDES += bootable/recovery
 LOCAL_STATIC_LIBRARIES += libapplypatch libmtdutils libmincrypt libbz
-LOCAL_STATIC_LIBRARIES += libz libcutils libstdc++ libc
+LOCAL_STATIC_LIBRARIES += libz libcutils libc
 
 include $(BUILD_EXECUTABLE)
 
diff --git a/applypatch/applypatch.c b/applypatch/applypatch.c
index 6f02a38..2358d42 100644
--- a/applypatch/applypatch.c
+++ b/applypatch/applypatch.c
@@ -662,7 +662,7 @@
         printf("failed to statfs %s: %s\n", filename, strerror(errno));
         return -1;
     }
-    return sf.f_bsize * sf.f_bfree;
+    return sf.f_bsize * sf.f_bavail;
 }
 
 int CacheSizeCheck(size_t bytes) {
diff --git a/etc/init.rc b/etc/init.rc
index 6c07c60..0a4c6e9 100644
--- a/etc/init.rc
+++ b/etc/init.rc
@@ -5,7 +5,6 @@
     start healthd
 
 on init
-    export PATH /sbin:/system/bin
     export ANDROID_ROOT /system
     export ANDROID_DATA /data
     export EXTERNAL_STORAGE /sdcard
diff --git a/minadbd/adb_main.cpp b/minadbd/adb_main.cpp
index f6e2401..0e65386 100644
--- a/minadbd/adb_main.cpp
+++ b/minadbd/adb_main.cpp
@@ -26,13 +26,9 @@
 #include "adb.h"
 #include "transport.h"
 
-int adb_main(int is_daemon, int server_port)
-{
-    atexit(usb_cleanup);
-
+int adb_main(int is_daemon, int server_port) {
     adb_device_banner = "sideload";
 
-    // No SIGCHLD. Let the service subproc handle its children.
     signal(SIGPIPE, SIG_IGN);
 
     init_transport_registration();
diff --git a/minadbd/services.cpp b/minadbd/services.cpp
index dd1fd7c..859463c 100644
--- a/minadbd/services.cpp
+++ b/minadbd/services.cpp
@@ -61,8 +61,7 @@
     exit(result == 0 ? 0 : 1);
 }
 
-static int create_service_thread(void (*func)(int, void *), void *cookie)
-{
+static int create_service_thread(void (*func)(int, void *), void *cookie) {
     int s[2];
     if(adb_socketpair(s)) {
         printf("cannot create service socket pair\n");
@@ -75,8 +74,7 @@
     sti->cookie = cookie;
     sti->fd = s[1];
 
-    adb_thread_t t;
-    if (adb_thread_create( &t, service_bootstrap_func, sti)){
+    if (!adb_thread_create(service_bootstrap_func, sti)) {
         free(sti);
         adb_close(s[0]);
         adb_close(s[1]);
diff --git a/recovery.cpp b/recovery.cpp
index 80a8c7b..bfc6895 100644
--- a/recovery.cpp
+++ b/recovery.cpp
@@ -31,24 +31,24 @@
 #include <time.h>
 #include <unistd.h>
 
+#include <adb.h>
 #include <base/file.h>
 #include <base/stringprintf.h>
+#include <cutils/android_reboot.h>
+#include <cutils/properties.h>
 
+#include "adb_install.h"
 #include "bootloader.h"
 #include "common.h"
-#include "cutils/properties.h"
-#include "cutils/android_reboot.h"
+#include "device.h"
+#include "fuse_sdcard_provider.h"
+#include "fuse_sideload.h"
 #include "install.h"
 #include "minui/minui.h"
 #include "minzip/DirUtil.h"
 #include "roots.h"
 #include "ui.h"
 #include "screen_ui.h"
-#include "device.h"
-#include "adb_install.h"
-#include "adb.h"
-#include "fuse_sideload.h"
-#include "fuse_sdcard_provider.h"
 
 struct selabel_handle *sehandle;
 
@@ -1119,6 +1119,9 @@
             property_set(ANDROID_RB_PROPERTY, "reboot,");
             break;
     }
-    sleep(5); // should reboot before this finishes
+    while (true) {
+      pause();
+    }
+    // Should be unreachable.
     return EXIT_SUCCESS;
 }
diff --git a/ui.cpp b/ui.cpp
index 1a0b079..2efb759 100644
--- a/ui.cpp
+++ b/ui.cpp
@@ -28,6 +28,7 @@
 #include <time.h>
 #include <unistd.h>
 
+#include <cutils/properties.h>
 #include <cutils/android_reboot.h>
 
 #include "common.h"
@@ -174,7 +175,8 @@
 
           case RecoveryUI::REBOOT:
             if (reboot_enabled) {
-                android_reboot(ANDROID_RB_RESTART, 0, 0);
+                property_set(ANDROID_RB_PROPERTY, "reboot,");
+                while (true) { pause(); }
             }
             break;
 
diff --git a/uncrypt/uncrypt.cpp b/uncrypt/uncrypt.cpp
index 6e670a4..efdbdac 100644
--- a/uncrypt/uncrypt.cpp
+++ b/uncrypt/uncrypt.cpp
@@ -53,8 +53,10 @@
 
 #include <base/file.h>
 #include <base/strings.h>
+#include <cutils/android_reboot.h>
 #include <cutils/properties.h>
 #include <fs_mgr.h>
+
 #define LOG_TAG "uncrypt"
 #include <log/log.h>
 
@@ -358,7 +360,9 @@
 static void reboot_to_recovery() {
     ALOGI("rebooting to recovery");
     property_set("sys.powerctl", "reboot,recovery");
-    sleep(10);
+    while (true) {
+      pause();
+    }
     ALOGE("reboot didn't succeed?");
 }
 
diff --git a/updater/Android.mk b/updater/Android.mk
index ff02a33..57f43da 100644
--- a/updater/Android.mk
+++ b/updater/Android.mk
@@ -32,7 +32,7 @@
 LOCAL_STATIC_LIBRARIES += $(TARGET_RECOVERY_UPDATER_LIBS) $(TARGET_RECOVERY_UPDATER_EXTRA_LIBS)
 LOCAL_STATIC_LIBRARIES += libapplypatch libedify libmtdutils libminzip libz
 LOCAL_STATIC_LIBRARIES += libmincrypt libbz
-LOCAL_STATIC_LIBRARIES += libcutils liblog libstdc++ libc
+LOCAL_STATIC_LIBRARIES += libcutils liblog libc
 LOCAL_STATIC_LIBRARIES += libselinux
 tune2fs_static_libraries := \
  libext2_com_err \
diff --git a/updater/blockimg.c b/updater/blockimg.c
index 7b8721d..5d0f156 100644
--- a/updater/blockimg.c
+++ b/updater/blockimg.c
@@ -60,30 +60,91 @@
     int pos[0];
 } RangeSet;
 
+#define RANGESET_MAX_POINTS \
+    ((int)((INT_MAX / sizeof(int)) - sizeof(RangeSet)))
+
 static RangeSet* parse_range(char* text) {
     char* save;
-    int num;
-    num = strtol(strtok_r(text, ",", &save), NULL, 0);
+    char* token;
+    int i, num;
+    long int val;
+    RangeSet* out = NULL;
+    size_t bufsize;
 
-    RangeSet* out = malloc(sizeof(RangeSet) + num * sizeof(int));
-    if (out == NULL) {
-        fprintf(stderr, "failed to allocate range of %zu bytes\n",
-                sizeof(RangeSet) + num * sizeof(int));
-        exit(1);
+    if (!text) {
+        goto err;
     }
+
+    token = strtok_r(text, ",", &save);
+
+    if (!token) {
+        goto err;
+    }
+
+    val = strtol(token, NULL, 0);
+
+    if (val < 2 || val > RANGESET_MAX_POINTS) {
+        goto err;
+    } else if (val % 2) {
+        goto err; // must be even
+    }
+
+    num = (int) val;
+    bufsize = sizeof(RangeSet) + num * sizeof(int);
+
+    out = malloc(bufsize);
+
+    if (!out) {
+        fprintf(stderr, "failed to allocate range of %zu bytes\n", bufsize);
+        goto err;
+    }
+
     out->count = num / 2;
     out->size = 0;
-    int i;
+
     for (i = 0; i < num; ++i) {
-        out->pos[i] = strtol(strtok_r(NULL, ",", &save), NULL, 0);
-        if (i%2) {
+        token = strtok_r(NULL, ",", &save);
+
+        if (!token) {
+            goto err;
+        }
+
+        val = strtol(token, NULL, 0);
+
+        if (val < 0 || val > INT_MAX) {
+            goto err;
+        }
+
+        out->pos[i] = (int) val;
+
+        if (i % 2) {
+            if (out->pos[i - 1] >= out->pos[i]) {
+                goto err; // empty or negative range
+            }
+
+            if (out->size > INT_MAX - out->pos[i]) {
+                goto err; // overflow
+            }
+
             out->size += out->pos[i];
         } else {
+            if (out->size < 0) {
+                goto err;
+            }
+
             out->size -= out->pos[i];
         }
     }
 
+    if (out->size <= 0) {
+        goto err;
+    }
+
     return out;
+
+err:
+    fprintf(stderr, "failed to parse range '%s'\n", text ? text : "NULL");
+    exit(1);
 }
 
 static int range_overlaps(RangeSet* r1, RangeSet* r2) {