diff --git a/libckteec/src/invoke_ta.c b/libckteec/src/invoke_ta.c
index 07b110ea..6d9742da 100644
--- a/libckteec/src/invoke_ta.c
+++ b/libckteec/src/invoke_ta.c
@@ -15,6 +15,8 @@
 #include <pthread.h>
 #include <stdlib.h>
 #include <string.h>
+
+#define STRERROR_BUF_SIZE 128
 #include <sys/types.h>
 #include <tee_client_api.h>
 #include <teec_trace.h>
@@ -319,7 +321,11 @@ CK_RV ckteec_invoke_init(void)
 out:
 	e = pthread_mutex_unlock(&ta_ctx.init_mutex);
 	if (e) {
-		EMSG("pthread_mutex_unlock: %s", strerror(e));
+		char errbuf[STRERROR_BUF_SIZE];
+
+		if (strerror_r(e, errbuf, sizeof(errbuf)))
+			errbuf[0] = '\0';
+		EMSG("pthread_mutex_unlock: %s", errbuf);
 		EMSG("terminating...");
 		exit(EXIT_FAILURE);
 	}
@@ -334,7 +340,11 @@ CK_RV ckteec_invoke_terminate(void)
 
 	e = pthread_mutex_lock(&ta_ctx.init_mutex);
 	if (e) {
-		EMSG("pthread_mutex_lock: %s", strerror(e));
+		char errbuf[STRERROR_BUF_SIZE];
+
+		if (strerror_r(e, errbuf, sizeof(errbuf)))
+			errbuf[0] = '\0';
+		EMSG("pthread_mutex_lock: %s", errbuf);
 		EMSG("terminating...");
 		exit(EXIT_FAILURE);
 	}
@@ -351,7 +361,11 @@ CK_RV ckteec_invoke_terminate(void)
 out:
 	e = pthread_mutex_unlock(&ta_ctx.init_mutex);
 	if (e) {
-		EMSG("pthread_mutex_unlock: %s", strerror(e));
+		char errbuf[STRERROR_BUF_SIZE];
+
+		if (strerror_r(e, errbuf, sizeof(errbuf)))
+			errbuf[0] = '\0';
+		EMSG("pthread_mutex_unlock: %s", errbuf);
 		EMSG("terminating...");
 		exit(EXIT_FAILURE);
 	}
diff --git a/libckteec/src/serialize_ck.c b/libckteec/src/serialize_ck.c
index f8b5bf91..adb2b84d 100644
--- a/libckteec/src/serialize_ck.c
+++ b/libckteec/src/serialize_ck.c
@@ -393,6 +393,9 @@ static CK_RV serialize_mecha_aes_ctr(struct serializer *obj,
 	CK_RV rv = CKR_GENERAL_ERROR;
 	uint32_t size = 0;
 
+	if (!param)
+		return CKR_MECHANISM_PARAM_INVALID;
+
 	rv = serialize_32b(obj, obj->type);
 	if (rv)
 		return rv;
@@ -420,6 +423,9 @@ static CK_RV serialize_mecha_aes_gcm(struct serializer *obj,
 	CK_RV rv = CKR_GENERAL_ERROR;
 	CK_ULONG aad_len = 0;
 
+	if (!param)
+		return CKR_MECHANISM_PARAM_INVALID;
+
 	/* AAD is not manadatory */
 	if (param->pAAD)
 		aad_len = param->ulAADLen;
@@ -461,6 +467,9 @@ static CK_RV serialize_mecha_aes_iv(struct serializer *obj,
 	uint32_t iv_size = mecha->ulParameterLen;
 	CK_RV rv = CKR_GENERAL_ERROR;
 
+	if (iv_size && !mecha->pParameter)
+		return CKR_MECHANISM_PARAM_INVALID;
+
 	rv = serialize_32b(obj, obj->type);
 	if (rv)
 		return rv;
@@ -479,6 +488,9 @@ static CK_RV serialize_mecha_key_deriv_str(struct serializer *obj,
 	CK_RV rv = CKR_GENERAL_ERROR;
 	uint32_t size = 0;
 
+	if (!param)
+		return CKR_MECHANISM_PARAM_INVALID;
+
 	rv = serialize_32b(obj, obj->type);
 	if (rv)
 		return rv;
@@ -500,8 +512,13 @@ static CK_RV serialize_mecha_ecdh1_derive_param(struct serializer *obj,
 {
 	CK_ECDH1_DERIVE_PARAMS *params = mecha->pParameter;
 	CK_RV rv = CKR_GENERAL_ERROR;
-	size_t params_size = 3 * sizeof(uint32_t) + params->ulSharedDataLen +
-			     params->ulPublicDataLen;
+	size_t params_size = 0;
+
+	if (!params)
+		return CKR_MECHANISM_PARAM_INVALID;
+
+	params_size = 3 * sizeof(uint32_t) + params->ulSharedDataLen +
+		      params->ulPublicDataLen;
 
 	rv = serialize_32b(obj, obj->type);
 	if (rv)
@@ -539,6 +556,12 @@ static CK_RV serialize_mecha_aes_cbc_encrypt_data(struct serializer *obj,
 	CK_RV rv = CKR_GENERAL_ERROR;
 	uint32_t size = 0;
 
+	if (!param)
+		return CKR_MECHANISM_PARAM_INVALID;
+
+	if (param->length > UINT32_MAX - sizeof(param->iv) - sizeof(uint32_t))
+		return CKR_MECHANISM_PARAM_INVALID;
+
 	rv = serialize_32b(obj, obj->type);
 	if (rv)
 		return rv;
@@ -566,6 +589,9 @@ static CK_RV serialize_mecha_rsa_pss_param(struct serializer *obj,
 	CK_RV rv = CKR_GENERAL_ERROR;
 	uint32_t params_size = 3 * sizeof(uint32_t);
 
+	if (!params)
+		return CKR_MECHANISM_PARAM_INVALID;
+
 	if (mecha->ulParameterLen != sizeof(*params))
 		return CKR_ARGUMENTS_BAD;
 
@@ -593,11 +619,16 @@ static CK_RV serialize_mecha_rsa_oaep_param(struct serializer *obj,
 {
 	CK_RSA_PKCS_OAEP_PARAMS *params = mecha->pParameter;
 	CK_RV rv = CKR_GENERAL_ERROR;
-	size_t params_size = 4 * sizeof(uint32_t) + params->ulSourceDataLen;
+	size_t params_size = 0;
+
+	if (!params)
+		return CKR_MECHANISM_PARAM_INVALID;
 
 	if (mecha->ulParameterLen != sizeof(*params))
 		return CKR_ARGUMENTS_BAD;
 
+	params_size = 4 * sizeof(uint32_t) + params->ulSourceDataLen;
+
 	rv = serialize_32b(obj, obj->type);
 	if (rv)
 		return rv;
@@ -630,13 +661,19 @@ static CK_RV serialize_mecha_rsa_aes_key_wrap(struct serializer *obj,
 					      CK_MECHANISM_PTR mecha)
 {
 	CK_RSA_AES_KEY_WRAP_PARAMS *params = mecha->pParameter;
-	CK_RSA_PKCS_OAEP_PARAMS *aes_params = params->pOAEPParams;
+	CK_RSA_PKCS_OAEP_PARAMS *aes_params = NULL;
 	CK_RV rv = CKR_GENERAL_ERROR;
-	size_t params_size = 5 * sizeof(uint32_t) + aes_params->ulSourceDataLen;
+	size_t params_size = 0;
+
+	if (!params || !params->pOAEPParams)
+		return CKR_MECHANISM_PARAM_INVALID;
 
 	if (mecha->ulParameterLen != sizeof(*params))
 		return CKR_ARGUMENTS_BAD;
 
+	aes_params = params->pOAEPParams;
+	params_size = 5 * sizeof(uint32_t) + aes_params->ulSourceDataLen;
+
 	rv = serialize_32b(obj, obj->type);
 	if (rv)
 		return rv;
@@ -689,6 +726,9 @@ static CK_RV serialize_mecha_eddsa(struct serializer *obj,
 		params_len = sizeof(*params);
 	}
 
+	if (!params)
+		return CKR_MECHANISM_PARAM_INVALID;
+
 	if (params_len != sizeof(*params))
 		return CKR_ARGUMENTS_BAD;
 
@@ -717,6 +757,9 @@ static CK_RV serialize_mecha_mac_general_param(struct serializer *obj,
 	CK_RV rv = CKR_GENERAL_ERROR;
 	CK_ULONG ck_data = 0;
 
+	if (!mecha->pParameter)
+		return CKR_MECHANISM_PARAM_INVALID;
+
 	if (mecha->ulParameterLen != sizeof(ck_data))
 		return CKR_ARGUMENTS_BAD;
 
diff --git a/libckteec/src/serializer.c b/libckteec/src/serializer.c
index d94932ba..cfccba67 100644
--- a/libckteec/src/serializer.c
+++ b/libckteec/src/serializer.c
@@ -5,6 +5,7 @@
 
 #include <pkcs11_ta.h>
 #include <stddef.h>
+#include <stdint.h>
 #include <stdlib.h>
 #include <string.h>
 
@@ -44,8 +45,20 @@ void release_serial_object(struct serializer *obj)
  */
 static CK_RV serialize(char **bstart, size_t *blen, void *data, size_t len)
 {
-	size_t nlen = *blen + len;
-	char *buf = realloc(*bstart, nlen);
+	size_t nlen = 0;
+	char *buf = NULL;
+
+	if (len && !data)
+		return CKR_ARGUMENTS_BAD;
+
+	if (!len)
+		return CKR_OK;
+
+	if (len > SIZE_MAX - *blen)
+		return CKR_DEVICE_MEMORY;
+
+	nlen = *blen + len;
+	buf = realloc(*bstart, nlen);
 
 	if (!buf)
 		return CKR_HOST_MEMORY;