diff --git a/library/pkcs11_client.c b/library/pkcs11_client.c
index 2e97d0e..82cc0e1 100644
--- a/library/pkcs11_client.c
+++ b/library/pkcs11_client.c
@@ -111,7 +111,7 @@
 static int pkcs11_pk_can_do( const void *ctx_arg, mbedtls_pk_type_t type )
 {
     const mbedtls_pk_pkcs11_context_t *ctx = ctx_arg;
-    return ctx->key_type == mbedtls_pk_representation_type( type );
+    return( ctx->key_type == mbedtls_pk_representation_type( type ) );
 }
 
 static void *pkcs11_pk_alloc( )
@@ -138,6 +138,7 @@
     }
 }
 
+#if defined(MBEDTLS_RSA_C)
 static int pkcs11_sign_core( mbedtls_pk_pkcs11_context_t *ctx,
                              CK_MECHANISM_TYPE mechanism_type,
                              const unsigned char *payload, size_t payload_len,
@@ -145,7 +146,7 @@
                              size_t sig_size )
 {
     CK_ULONG ck_sig_len = sig_size;
-    CK_MECHANISM mechanism = {mechanism_type, NULL_PTR, 0};
+    CK_MECHANISM mechanism = { mechanism_type, NULL_PTR, 0 };
     CK_RV rv;
     rv = C_SignInit( ctx->hSession, &mechanism, ctx->hPrivateKey );
     if( rv != CKR_OK )
@@ -158,6 +159,7 @@
 exit:
     return( pkcs11_err_to_mbedtls_pk_err( rv ) );
 }
+#endif /* MBEDTLS_RSA_C */
 
 #if defined(MBEDTLS_RSA_C)
 static int pkcs11_sign_rsa( mbedtls_pk_pkcs11_context_t *ctx,
@@ -234,7 +236,7 @@
                                const unsigned char *payload, size_t payload_len,
                                const unsigned char *sig, size_t sig_len )
 {
-    CK_MECHANISM mechanism = {mechanism_type, NULL_PTR, 0};
+    CK_MECHANISM mechanism = { mechanism_type, NULL_PTR, 0 };
     CK_RV rv;
 
     rv = C_VerifyInit( ctx->hSession, &mechanism, ctx->hPublicKey );
diff --git a/library/rsa.c b/library/rsa.c
index 7f1a745..5268013 100644
--- a/library/rsa.c
+++ b/library/rsa.c
@@ -1538,7 +1538,7 @@
 
     if( md_alg == MBEDTLS_MD_NONE )
     {
-        if( *p < start + hashlen )
+        if( *p - start < (ptrdiff_t) hashlen )
             return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
         *p -= hashlen;
         memcpy( *p, hash, hashlen );
@@ -1550,7 +1550,7 @@
         return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
     if( hashlen == 0 )
         hashlen = mbedtls_md_get_size( md_info );
-    else if ( hashlen != mbedtls_md_get_size( md_info ) )
+    else if( hashlen != mbedtls_md_get_size( md_info ) )
         return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
     if( mbedtls_oid_get_oid_by_md( md_alg, &oid, &oid_size ) != 0 )
         return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
@@ -1570,7 +1570,7 @@
      * - Need hashlen bytes for hash
      * - Need oid_size bytes for hash alg OID.
      */
-    if( *p < start + 10 + oid_size + hashlen )
+    if( *p - start < (ptrdiff_t) ( 10 + oid_size + hashlen) )
         return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
     *p -= 10 + oid_size + hashlen;
     start = *p;
@@ -1657,7 +1657,7 @@
     unsigned char *p = dst + dst_len;
 
     /* Ignore hashlen if a hash algorithm is specified. This is
-     * fragile, but documented, bhavior. */
+     * fragile, but documented, behavior. */
     if( md_alg != MBEDTLS_MD_NONE )
         hashlen = 0;