diff --git a/src/aead.c b/src/aead.c
index 832a840e..881d24de 100644
--- a/src/aead.c
+++ b/src/aead.c
@@ -335,7 +335,7 @@ aead_cipher_ctx_set_key(cipher_ctx_t *cipher_ctx, int enc)
         return;
     }
     if (mbedtls_cipher_setkey(cipher_ctx->evp, cipher_ctx->skey,
-                              cipher_ctx->cipher->key_len * 8, enc) != 0) {
+                              cipher_ctx->cipher->key_len * 8, (mbedtls_operation_t)enc) != 0) {
         FATAL("Cannot set mbed TLS cipher key");
     }
     if (mbedtls_cipher_reset(cipher_ctx->evp) != 0) {
@@ -360,11 +360,11 @@ aead_cipher_ctx_init(cipher_ctx_t *cipher_ctx, int method, int enc)
     const cipher_kt_t *cipher = aead_get_cipher_type(method);
 
     if (method == AES256GCM && crypto_aead_aes256gcm_is_available()) {
-        cipher_ctx->aes256gcm_ctx = ss_aligned_malloc(sizeof(aes256gcm_ctx));
+        cipher_ctx->aes256gcm_ctx = (aes256gcm_ctx *)ss_aligned_malloc(sizeof(aes256gcm_ctx));
         memset(cipher_ctx->aes256gcm_ctx, 0, sizeof(aes256gcm_ctx));
     } else {
         cipher_ctx->aes256gcm_ctx = NULL;
-        cipher_ctx->evp           = ss_malloc(sizeof(cipher_evp_t));
+        cipher_ctx->evp           = (cipher_evp_t *)ss_malloc(sizeof(cipher_evp_t));
         memset(cipher_ctx->evp, 0, sizeof(cipher_evp_t));
         cipher_evp_t *evp = cipher_ctx->evp;
         mbedtls_cipher_init(evp);
diff --git a/src/aead2022.c b/src/aead2022.c
index a28be2d7..5d7381c3 100644
--- a/src/aead2022.c
+++ b/src/aead2022.c
@@ -246,7 +246,7 @@ ss2022_build_req_varhdr(const uint8_t *first, size_t first_len,
     }
 
     size_t total = addr_len + 2 + pad_len + payload_len;
-    uint8_t *buf = ss_malloc(total);
+    uint8_t *buf = (uint8_t *)ss_malloc(total);
 
     memcpy(buf, first, addr_len);
     store16_be(buf + addr_len, pad_len);
@@ -277,6 +277,8 @@ ss2022_emit_header(cipher_ctx_t *ctx, buffer_t *out, size_t *out_len,
     size_t body_len   = 0;
     int body_owned    = 0;
     int rc            = CRYPTO_ERROR;
+    size_t o;
+    int n;
 
     if (ctx->role == CRYPTO_ROLE_CLIENT) {
         if (ss2022_build_req_varhdr(first, first_len, &body, &body_len)
@@ -322,9 +324,9 @@ ss2022_emit_header(cipher_ctx_t *ctx, buffer_t *out, size_t *out_len,
              + body_len + SS2022_TAG_LEN, capacity);
 
     memcpy(out->data, ctx->salt, salt_len);
-    size_t o = salt_len;
+    o = salt_len;
 
-    int n = ss2022_seal(ctx, (uint8_t *)out->data + o, fixed, fixed_len);
+    n = ss2022_seal(ctx, (uint8_t *)out->data + o, fixed, fixed_len);
     if (n < 0)
         goto done;
     o += n;
@@ -595,7 +597,7 @@ ss2022_tcp_decrypt(buffer_t *ciphertext, cipher_ctx_t *ctx, size_t capacity)
             return CRYPTO_NEED_MORE;
         }
 
-        uint8_t *body = ss_malloc(want);
+        uint8_t *body = (uint8_t *)ss_malloc(want);
         int n = ss2022_open(ctx, body,
                             (uint8_t *)chunk->data + chunk->idx, need);
         if (n < 0) {
diff --git a/src/aead2022_udp.c b/src/aead2022_udp.c
index 394f510e..71a76b4f 100644
--- a/src/aead2022_udp.c
+++ b/src/aead2022_udp.c
@@ -179,7 +179,7 @@ window_update(ss2022_udp_session_t *s, uint64_t id)
 static ss2022_udp_session_t *
 session_new(cipher_t *cipher)
 {
-    ss2022_udp_session_t *s = ss_malloc(sizeof(ss2022_udp_session_t));
+    ss2022_udp_session_t *s = (ss2022_udp_session_t *)ss_malloc(sizeof(ss2022_udp_session_t));
     memset(s, 0, sizeof(ss2022_udp_session_t));
     s->cipher = cipher;
     return s;
@@ -285,7 +285,7 @@ body_seal(const cipher_t *cipher, const uint8_t *key,
     tmp_ctx.cipher = &tmp_cipher;
 
     /* Reuse the shared one-shot helper with an mbedTLS GCM context. */
-    tmp_ctx.evp = ss_malloc(sizeof(cipher_evp_t));
+    tmp_ctx.evp = (cipher_evp_t *)ss_malloc(sizeof(cipher_evp_t));
     memset(tmp_ctx.evp, 0, sizeof(cipher_evp_t));
     mbedtls_cipher_init(tmp_ctx.evp);
     const cipher_kt_t *kt = mbedtls_cipher_info_from_string(
@@ -327,7 +327,7 @@ body_open(const cipher_t *cipher, const uint8_t *key,
     memset(&tmp_ctx, 0, sizeof(tmp_ctx));
     tmp_ctx.cipher = &tmp_cipher;
 
-    tmp_ctx.evp = ss_malloc(sizeof(cipher_evp_t));
+    tmp_ctx.evp = (cipher_evp_t *)ss_malloc(sizeof(cipher_evp_t));
     memset(tmp_ctx.evp, 0, sizeof(cipher_evp_t));
     mbedtls_cipher_init(tmp_ctx.evp);
     const cipher_kt_t *kt = mbedtls_cipher_info_from_string(
@@ -377,7 +377,7 @@ aead_2022_encrypt_udp(buffer_t *plaintext, cipher_t *cipher, size_t capacity,
     size_t hdr_len = SS2022_UDP_MIN_HDR + extra;
     size_t body_len = hdr_len + plaintext->len;
 
-    uint8_t *body = ss_malloc(body_len);
+    uint8_t *body = (uint8_t *)ss_malloc(body_len);
     size_t o      = 0;
 
     body[o++] = is_server ? SS2022_UDP_TYPE_SERVER : SS2022_UDP_TYPE_CLIENT;
@@ -407,7 +407,7 @@ aead_2022_encrypt_udp(buffer_t *plaintext, cipher_t *cipher, size_t capacity,
          * main header || payload)
          */
         size_t merged_len = SS2022_UDP_SEP_HDR_LEN + body_len;
-        uint8_t *merged   = ss_malloc(merged_len);
+        uint8_t *merged   = (uint8_t *)ss_malloc(merged_len);
         memcpy(merged, s->tx_session_id, SS2022_SESSION_ID_LEN);
         store64_be(merged + SS2022_SESSION_ID_LEN, s->tx_packet_id);
         memcpy(merged + SS2022_UDP_SEP_HDR_LEN, body, body_len);
diff --git a/src/crypto.c b/src/crypto.c
index 523faca9..70111ce1 100644
--- a/src/crypto.c
+++ b/src/crypto.c
@@ -47,7 +47,7 @@ int
 balloc(buffer_t *ptr, size_t capacity)
 {
     sodium_memzero(ptr, sizeof(buffer_t));
-    ptr->data     = ss_malloc(capacity);
+    ptr->data     = (char *)ss_malloc(capacity);
     ptr->capacity = capacity;
     return capacity;
 }
@@ -59,7 +59,7 @@ brealloc(buffer_t *ptr, size_t len, size_t capacity)
         return -1;
     size_t real_capacity = max(len, capacity);
     if (ptr->capacity < real_capacity) {
-        ptr->data     = ss_realloc(ptr->data, real_capacity);
+        ptr->data     = (char *)ss_realloc(ptr->data, real_capacity);
         ptr->capacity = real_capacity;
     }
     return real_capacity;
diff --git a/src/jconf.c b/src/jconf.c
index 0a5d6fbc..b7bf0392 100644
--- a/src/jconf.c
+++ b/src/jconf.c
@@ -283,7 +283,7 @@ read_jconf(const char *file)
         FATAL("Too large config file.");
     }
 
-    buf = ss_malloc(pos + 1);
+    buf = (char *)ss_malloc(pos + 1);
     if (buf == NULL) {
         FATAL("No enough memory.");
     }
diff --git a/src/netutils.c b/src/netutils.c
index 4b75b58c..afb4c903 100644
--- a/src/netutils.c
+++ b/src/netutils.c
@@ -312,7 +312,7 @@ validate_hostname(const char *hostname, const int hostname_len)
     const char *label = hostname;
     while (label < hostname_end) {
         size_t label_len = hostname_end - label;
-        const char *next_dot = memchr(label, '.', label_len);
+        const char *next_dot = (const char *)memchr(label, '.', label_len);
         if (next_dot != NULL)
             label_len = next_dot - label;
 
diff --git a/src/plugin.c b/src/plugin.c
index d1aaacb7..0080ccbe 100644
--- a/src/plugin.c
+++ b/src/plugin.c
@@ -137,7 +137,7 @@ start_obfsproxy(const char *plugin,
     ss_process_arg(sub, "--data-dir");
     buf_size = 20 + strlen(plugin) + strlen(remote_host)
                + strlen(remote_port) + strlen(local_host) + strlen(local_port);
-    buf = ss_malloc(buf_size);
+    buf = (char *)ss_malloc(buf_size);
     snprintf(buf, buf_size, TEMPDIR "%s_%s:%s_%s:%s", plugin,
              remote_host, remote_port, local_host, local_port);
     ss_process_arg(sub, buf);
diff --git a/src/resolv.c b/src/resolv.c
index 5c6a7bf8..cc6350a6 100644
--- a/src/resolv.c
+++ b/src/resolv.c
@@ -94,7 +94,7 @@ static struct ss_loop *default_loop;
 enum {
     MODE_IPV4_FIRST = 0,
     MODE_IPV6_FIRST = 1
-} RESOLV_MODE;
+};
 
 static int resolv_mode = MODE_IPV4_FIRST;
 
@@ -207,7 +207,7 @@ resolv_start(const char *hostname, uint16_t port,
     /*
      * Wrap c-ares's call back in our own
      */
-    struct resolv_query *query = ss_malloc(sizeof(struct resolv_query));
+    struct resolv_query *query = (struct resolv_query *)ss_malloc(sizeof(struct resolv_query));
 
     memset(query, 0, sizeof(struct resolv_query));
 
@@ -254,7 +254,7 @@ dns_query_v4_cb(void *arg, int status, int timeouts, struct hostent *he)
         n++;
 
     if (n > 0) {
-        struct sockaddr **new_responses = ss_realloc(query->responses,
+        struct sockaddr **new_responses = (struct sockaddr **)ss_realloc(query->responses,
                                                      (query->response_count + n)
                                                      * sizeof(struct sockaddr *));
 
@@ -264,7 +264,7 @@ dns_query_v4_cb(void *arg, int status, int timeouts, struct hostent *he)
             query->responses = new_responses;
 
             for (i = 0; i < n; i++) {
-                struct sockaddr_in *sa = ss_malloc(sizeof(struct sockaddr_in));
+                struct sockaddr_in *sa = (struct sockaddr_in *)ss_malloc(sizeof(struct sockaddr_in));
                 memset(sa, 0, sizeof(struct sockaddr_in));
                 sa->sin_family = AF_INET;
                 sa->sin_port   = query->port;
@@ -316,7 +316,7 @@ dns_query_v6_cb(void *arg, int status, int timeouts, struct hostent *he)
         n++;
 
     if (n > 0) {
-        struct sockaddr **new_responses = ss_realloc(query->responses,
+        struct sockaddr **new_responses = (struct sockaddr **)ss_realloc(query->responses,
                                                      (query->response_count + n)
                                                      * sizeof(struct sockaddr *));
 
@@ -326,7 +326,7 @@ dns_query_v6_cb(void *arg, int status, int timeouts, struct hostent *he)
             query->responses = new_responses;
 
             for (i = 0; i < n; i++) {
-                struct sockaddr_in6 *sa = ss_malloc(sizeof(struct sockaddr_in6));
+                struct sockaddr_in6 *sa = (struct sockaddr_in6 *)ss_malloc(sizeof(struct sockaddr_in6));
                 memset(sa, 0, sizeof(struct sockaddr_in6));
                 sa->sin6_family = AF_INET6;
                 sa->sin6_port   = query->port;
@@ -472,7 +472,7 @@ resolv_sock_state_cb(void *data, ares_socket_t s, int read, int write)
         return;
     }
     if (!node) {
-        node = ss_malloc(sizeof(*node));
+        node = (struct resolv_io *)ss_malloc(sizeof(*node));
         node->next = NULL;
         *entry = node;
         ss_io_init(&node->io, resolv_sock_cb, (int)s, events);
diff --git a/src/stream.c b/src/stream.c
index fda194e2..7e221ba0 100644
--- a/src/stream.c
+++ b/src/stream.c
@@ -211,7 +211,7 @@ stream_cipher_ctx_init(cipher_ctx_t *ctx, int method, int enc)
     const char *ciphername    = supported_stream_ciphers[method];
     const cipher_kt_t *cipher = stream_get_cipher_type(method);
 
-    ctx->evp = ss_malloc(sizeof(cipher_evp_t));
+    ctx->evp = (cipher_evp_t *)ss_malloc(sizeof(cipher_evp_t));
     memset(ctx->evp, 0, sizeof(cipher_evp_t));
     cipher_evp_t *evp = ctx->evp;
 
@@ -274,7 +274,7 @@ cipher_ctx_set_nonce(cipher_ctx_t *cipher_ctx, uint8_t *nonce, size_t nonce_len,
         LOGE("cipher_ctx_set_nonce(): Cipher context is null");
         return;
     }
-    if (mbedtls_cipher_setkey(evp, true_key, cipher->key_len * 8, enc) != 0) {
+    if (mbedtls_cipher_setkey(evp, true_key, cipher->key_len * 8, (mbedtls_operation_t)enc) != 0) {
         mbedtls_cipher_free(evp);
         FATAL("Cannot set mbed TLS cipher key");
     }