diff --git a/src/utils/Makefile b/src/utils/Makefile
index 52efc53..1ee2bee 100644
--- a/src/utils/Makefile
+++ b/src/utils/Makefile
@@ -19,6 +19,7 @@
 	common.o \
 	crc32.o \
 	ip_addr.o \
+	json.o \
 	radiotap.o \
 	trace.o \
 	uuid.o \
diff --git a/src/utils/browser.c b/src/utils/browser.c
index 9cf6152..ad0b382 100644
--- a/src/utils/browser.c
+++ b/src/utils/browser.c
@@ -166,8 +166,7 @@
 	g_object_set(G_OBJECT(s), "ssl-strict", FALSE, NULL);
 
 	ctx.win = gtk_window_new(GTK_WINDOW_TOPLEVEL);
-	gtk_window_set_wmclass(GTK_WINDOW(ctx.win), "Hotspot 2.0 client",
-			       "Hotspot 2.0 client");
+	gtk_window_set_role(GTK_WINDOW(ctx.win), "Hotspot 2.0 client");
 	gtk_window_set_default_size(GTK_WINDOW(ctx.win), 800, 600);
 
 	scroll = gtk_scrolled_window_new(NULL, NULL);
diff --git a/src/utils/eloop.c b/src/utils/eloop.c
index 436bc8c..bb375be 100644
--- a/src/utils/eloop.c
+++ b/src/utils/eloop.c
@@ -224,22 +224,25 @@
 
 
 #ifdef CONFIG_ELOOP_KQUEUE
-static int eloop_sock_queue(int sock, eloop_event_type type)
-{
-	int filter;
-	struct kevent ke;
 
+static short event_type_kevent_filter(eloop_event_type type)
+{
 	switch (type) {
 	case EVENT_TYPE_READ:
-		filter = EVFILT_READ;
-		break;
+		return EVFILT_READ;
 	case EVENT_TYPE_WRITE:
-		filter = EVFILT_WRITE;
-		break;
+		return EVFILT_WRITE;
 	default:
-		filter = 0;
+		return 0;
 	}
-	EV_SET(&ke, sock, filter, EV_ADD, 0, 0, 0);
+}
+
+
+static int eloop_sock_queue(int sock, eloop_event_type type)
+{
+	struct kevent ke;
+
+	EV_SET(&ke, sock, event_type_kevent_filter(type), EV_ADD, 0, 0, 0);
 	if (kevent(eloop.kqueuefd, &ke, 1, NULL, 0, NULL) == -1) {
 		wpa_printf(MSG_ERROR, "%s: kevent(ADD) for fd=%d failed: %s",
 			   __func__, sock, strerror(errno));
@@ -247,6 +250,7 @@
 	}
 	return 0;
 }
+
 #endif /* CONFIG_ELOOP_KQUEUE */
 
 
@@ -301,7 +305,7 @@
 #endif /* CONFIG_ELOOP_POLL */
 #if defined(CONFIG_ELOOP_EPOLL) || defined(CONFIG_ELOOP_KQUEUE)
 	if (new_max_sock >= eloop.max_fd) {
-		next = eloop.max_fd == 0 ? 16 : eloop.max_fd * 2;
+		next = new_max_sock + 16;
 		temp_table = os_realloc_array(eloop.fd_table, next,
 					      sizeof(struct eloop_sock));
 		if (temp_table == NULL)
@@ -411,7 +415,8 @@
 	os_memset(&eloop.fd_table[sock], 0, sizeof(struct eloop_sock));
 #endif /* CONFIG_ELOOP_EPOLL */
 #ifdef CONFIG_ELOOP_KQUEUE
-	EV_SET(&ke, sock, 0, EV_DELETE, 0, 0, 0);
+	EV_SET(&ke, sock, event_type_kevent_filter(table->type), EV_DELETE, 0,
+	       0, 0);
 	if (kevent(eloop.kqueuefd, &ke, 1, NULL, 0, NULL) < 0) {
 		wpa_printf(MSG_ERROR, "%s: kevent(DEL) for fd=%d failed: %s",
 			   __func__, sock, strerror(errno));
diff --git a/src/utils/http_curl.c b/src/utils/http_curl.c
index 58519ea..e62fbf9 100644
--- a/src/utils/http_curl.c
+++ b/src/utils/http_curl.c
@@ -31,6 +31,14 @@
 #endif /* EAP_TLS_OPENSSL */
 
 
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
+static const unsigned char * ASN1_STRING_get0_data(const ASN1_STRING *x)
+{
+	return ASN1_STRING_data((ASN1_STRING *) x);
+}
+#endif /* OpenSSL < 1.1.0 */
+
+
 struct http_ctx {
 	void *ctx;
 	struct xml_node_ctx *xml;
@@ -446,6 +454,7 @@
 #define sk_ASN1_IA5STRING_value(st, i) (ASN1_IA5STRING *) \
 sk_value(CHECKED_CAST(_STACK *, const STACK_OF(ASN1_IA5STRING) *, (st)), (i))
 #else /* OPENSSL_IS_BORINGSSL */
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
 #define sk_LogotypeInfo_num(st) SKM_sk_num(LogotypeInfo, (st))
 #define sk_LogotypeInfo_value(st, i) SKM_sk_value(LogotypeInfo, (st), (i))
 #define sk_LogotypeImage_num(st) SKM_sk_num(LogotypeImage, (st))
@@ -456,6 +465,13 @@
 #define sk_HashAlgAndValue_value(st, i) SKM_sk_value(HashAlgAndValue, (st), (i))
 #define sk_ASN1_IA5STRING_num(st) SKM_sk_num(ASN1_IA5STRING, (st))
 #define sk_ASN1_IA5STRING_value(st, i) SKM_sk_value(ASN1_IA5STRING, (st), (i))
+#else
+DEFINE_STACK_OF(LogotypeInfo)
+DEFINE_STACK_OF(LogotypeImage)
+DEFINE_STACK_OF(LogotypeAudio)
+DEFINE_STACK_OF(HashAlgAndValue)
+DEFINE_STACK_OF(ASN1_IA5STRING)
+#endif
 #endif /* OPENSSL_IS_BORINGSSL */
 
 
@@ -486,7 +502,8 @@
 		return;
 
 	n->hash_len = ASN1_STRING_length(hash->hashValue);
-	n->hash = os_memdup(ASN1_STRING_data(hash->hashValue), n->hash_len);
+	n->hash = os_memdup(ASN1_STRING_get0_data(hash->hashValue),
+			    n->hash_len);
 	if (n->hash == NULL) {
 		os_free(n->alg_oid);
 		return;
@@ -499,7 +516,7 @@
 		os_free(n->hash);
 		return;
 	}
-	os_memcpy(n->uri, ASN1_STRING_data(uri), len);
+	os_memcpy(n->uri, ASN1_STRING_get0_data(uri), len);
 	n->uri[len] = '\0';
 
 	hcert->num_logo++;
@@ -814,9 +831,9 @@
 	}
 
 	wpa_hexdump(MSG_DEBUG, "logotypeExtn",
-		    ASN1_STRING_data(os), ASN1_STRING_length(os));
+		    ASN1_STRING_get0_data(os), ASN1_STRING_length(os));
 
-	data = ASN1_STRING_data(os);
+	data = ASN1_STRING_get0_data(os);
 	logo = d2i_LogotypeExtn(NULL, &data, ASN1_STRING_length(os));
 	if (logo == NULL) {
 		wpa_printf(MSG_INFO, "Failed to parse logotypeExtn");
@@ -1136,7 +1153,7 @@
 		return 0;
 	}
 
-	store = SSL_CTX_get_cert_store(s->ctx);
+	store = SSL_CTX_get_cert_store(SSL_get_SSL_CTX(s));
 	if (ctx->peer_issuer) {
 		wpa_printf(MSG_DEBUG, "OpenSSL: Add issuer");
 		debug_dump_cert("OpenSSL: Issuer certificate",
@@ -1272,12 +1289,13 @@
 }
 
 
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
 static SSL_METHOD patch_ssl_method;
 static const SSL_METHOD *real_ssl_method;
 
 static int curl_patch_ssl_new(SSL *s)
 {
-	SSL_CTX *ssl = s->ctx;
+	SSL_CTX *ssl = SSL_get_SSL_CTX(s);
 	int ret;
 
 	ssl->method = real_ssl_method;
@@ -1288,6 +1306,7 @@
 
 	return ret;
 }
+#endif /* OpenSSL < 1.1.0 */
 
 #endif /* HAVE_OCSP */
 
@@ -1306,6 +1325,7 @@
 		SSL_CTX_set_tlsext_status_cb(ssl, ocsp_resp_cb);
 		SSL_CTX_set_tlsext_status_arg(ssl, ctx);
 
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
 		/*
 		 * Use a temporary SSL_METHOD to get a callback on SSL_new()
 		 * from libcurl since there is no proper callback registration
@@ -1315,6 +1335,7 @@
 		patch_ssl_method.ssl_new = curl_patch_ssl_new;
 		real_ssl_method = ssl->method;
 		ssl->method = &patch_ssl_method;
+#endif /* OpenSSL < 1.1.0 */
 	}
 #endif /* HAVE_OCSP */
 
@@ -1351,7 +1372,7 @@
 #ifdef EAP_TLS_OPENSSL
 		curl_easy_setopt(curl, CURLOPT_SSL_CTX_FUNCTION, curl_cb_ssl);
 		curl_easy_setopt(curl, CURLOPT_SSL_CTX_DATA, ctx);
-#ifdef OPENSSL_IS_BORINGSSL
+#if defined(OPENSSL_IS_BORINGSSL) || (OPENSSL_VERSION_NUMBER >= 0x10100000L)
 		/* For now, using the CURLOPT_SSL_VERIFYSTATUS option only
 		 * with BoringSSL since the OpenSSL specific callback hack to
 		 * enable OCSP is not available with BoringSSL. The OCSP
diff --git a/src/utils/json.c b/src/utils/json.c
index b9130d3..b644339 100644
--- a/src/utils/json.c
+++ b/src/utils/json.c
@@ -103,6 +103,11 @@
 			return str;
 		case '\\':
 			pos++;
+			if (pos >= end) {
+				wpa_printf(MSG_DEBUG,
+					   "JSON: Truncated \\ escape");
+				goto fail;
+			}
 			switch (*pos) {
 			case '"':
 			case '\\':
@@ -165,6 +170,8 @@
 			break;
 		}
 	}
+	if (pos == end)
+		pos--;
 	if (pos < *json_pos)
 		return -1;
 	len = pos - *json_pos + 1;
diff --git a/src/utils/os_unix.c b/src/utils/os_unix.c
index 381846a..b79a70d 100644
--- a/src/utils/os_unix.c
+++ b/src/utils/os_unix.c
@@ -252,6 +252,13 @@
 
 int os_get_random(unsigned char *buf, size_t len)
 {
+#ifdef TEST_FUZZ
+	size_t i;
+
+	for (i = 0; i < len; i++)
+		buf[i] = i & 0xff;
+	return 0;
+#else /* TEST_FUZZ */
 	FILE *f;
 	size_t rc;
 
@@ -268,6 +275,7 @@
 	fclose(f);
 
 	return rc != len ? -1 : 0;
+#endif /* TEST_FUZZ */
 }
 
 
diff --git a/src/utils/wpa_debug.c b/src/utils/wpa_debug.c
index a56462b..c437000 100644
--- a/src/utils/wpa_debug.c
+++ b/src/utils/wpa_debug.c
@@ -422,6 +422,12 @@
 #ifdef CONFIG_ANDROID_LOG
 	_wpa_hexdump(level, title, buf, len, show);
 #else /* CONFIG_ANDROID_LOG */
+#ifdef CONFIG_DEBUG_SYSLOG
+	if (wpa_debug_syslog) {
+		_wpa_hexdump(level, title, buf, len, show);
+		return;
+	}
+#endif /* CONFIG_DEBUG_SYSLOG */
 	wpa_debug_print_timestamp();
 #ifdef CONFIG_DEBUG_FILE
 	if (out_file) {