--- a/macro.c	Sat Mar 30 20:52:59 2013 -0400
+++ b/macro.c	Sat Mar 30 21:02:25 2013 -0400
@@ -110,9 +110,9 @@
 expansionitem_destroy(struct expansionitem *ei)
 {
 	if (ei->isstring) {
-		free(ei->string);
+		dofree(ei->string);
 	}
-	free(ei);
+	dofree(ei);
 }
 
 static
@@ -162,8 +162,8 @@
 {
 	expansionitemarray_destroyall(&m->expansion);
 	expansionitemarray_cleanup(&m->expansion);
-	free(m->name);
-	free(m);
+	dofree(m->name);
+	dofree(m);
 }
 
 static
@@ -634,7 +634,7 @@
 	assert(es->state == ES_NORMAL);
 	stringarray_cleanup(&es->args);
 	if (es->buf) {
-		free(es->buf);
+		dofree(es->buf);
 	}
 }
 
@@ -646,7 +646,7 @@
 
 	num = stringarray_num(&es->args);
 	for (i=0; i<num; i++) {
-		free(stringarray_get(&es->args,  i));
+		dofree(stringarray_get(&es->args,  i));
 	}
 	stringarray_setsize(&es->args, 0);
 }
@@ -656,6 +656,7 @@
 expand_send(struct expstate *es, struct place *p, const char *buf, size_t len)
 {
 	if (es->tobuf) {
+		assert(es->bufpos <= es->bufmax);
 		if (es->bufpos + len > es->bufmax) {
 			if (es->bufmax == 0) {
 				es->bufmax = 64;
@@ -667,6 +668,7 @@
 		}
 		memcpy(es->buf + es->bufpos, buf, len);
 		es->bufpos += len;
+		assert(es->bufpos <= es->bufmax);
 	} else {
 		output(p, buf, len);
 	}
@@ -796,10 +798,10 @@
 
 	newbuf = expand_substitute(p, es);
 	newbuf2 = macroexpand(p, newbuf, strlen(newbuf), false);
-	free(newbuf);
+	dofree(newbuf);
 	expstate_destroyargs(es);
 	doexpand(es, p, newbuf2, strlen(newbuf2));
-	free(newbuf2);
+	dofree(newbuf2);
 
 	es->curmacro->inuse = false;
 }
@@ -849,7 +851,7 @@
 			newbuf = macroexpand(p, ei->string,
 					     strlen(ei->string), false);
 			doexpand(es, p, newbuf, strlen(newbuf));
-			free(newbuf);
+			dofree(newbuf);
 			m->inuse = false;
 		} else {
 			es->curmacro = m;