diff --git a/plugins/sudoers/getdate.c b/plugins/sudoers/getdate.c
index 961744517..f03d1b1bf 100644
--- a/plugins/sudoers/getdate.c
+++ b/plugins/sudoers/getdate.c
@@ -743,7 +743,7 @@ LookupWord(buff)
 
     /* Make it lowercase. */
     for (p = buff; *p; p++)
-	if (isupper(*p))
+	if (isupper((unsigned char)*p))
 	    *p = tolower(*p);
 
     if (strcmp(buff, "am") == 0 || strcmp(buff, "a.m.") == 0) {
@@ -812,7 +812,7 @@ LookupWord(buff)
 	}
 
     /* Military timezones. */
-    if (buff[1] == '\0' && isalpha(*buff)) {
+    if (buff[1] == '\0' && isalpha((unsigned char)*buff)) {
 	for (tp = MilitaryTable; tp->name; tp++)
 	    if (strcmp(buff, tp->name) == 0) {
 		yylval.Number = tp->value;
@@ -848,27 +848,27 @@ yylex()
     int			sign;
 
     for ( ; ; ) {
-	while (isspace(*yyInput))
+	while (isspace((unsigned char)*yyInput))
 	    yyInput++;
 
-	if (isdigit(c = *yyInput) || c == '-' || c == '+') {
+	if (isdigit((unsigned char)(c = *yyInput)) || c == '-' || c == '+') {
 	    if (c == '-' || c == '+') {
 		sign = c == '-' ? -1 : 1;
-		if (!isdigit(*++yyInput))
+		if (!isdigit((unsigned char)*++yyInput))
 		    /* skip the '-' sign */
 		    continue;
 	    }
 	    else
 		sign = 0;
-	    for (yylval.Number = 0; isdigit(c = *yyInput++); )
+	    for (yylval.Number = 0; isdigit((unsigned char)(c = *yyInput++)); )
 		yylval.Number = 10 * yylval.Number + c - '0';
 	    yyInput--;
 	    if (sign < 0)
 		yylval.Number = -yylval.Number;
 	    return sign ? tSNUMBER : tUNUMBER;
 	}
-	if (isalpha(c)) {
-	    for (p = buff; isalpha(c = *yyInput++) || c == '.'; )
+	if (isalpha((unsigned char)c)) {
+	    for (p = buff; isalpha((unsigned char)(c = *yyInput++)) || c == '.'; )
 		if (p < &buff[sizeof buff - 1])
 		    *p++ = c;
 	    *p = '\0';
diff --git a/plugins/sudoers/getdate.y b/plugins/sudoers/getdate.y
index 5740206b3..4a32a86d5 100644
--- a/plugins/sudoers/getdate.y
+++ b/plugins/sudoers/getdate.y
@@ -40,7 +40,7 @@
 #endif
 #include <ctype.h>
 
-#include "compat.h"
+#include <compat.h>
 
 
 #define EPOCH		1970
@@ -676,7 +676,7 @@ LookupWord(buff)
 
     /* Make it lowercase. */
     for (p = buff; *p; p++)
-	if (isupper(*p))
+	if (isupper((unsigned char)*p))
 	    *p = tolower(*p);
 
     if (strcmp(buff, "am") == 0 || strcmp(buff, "a.m.") == 0) {
@@ -745,7 +745,7 @@ LookupWord(buff)
 	}
 
     /* Military timezones. */
-    if (buff[1] == '\0' && isalpha(*buff)) {
+    if (buff[1] == '\0' && isalpha((unsigned char)*buff)) {
 	for (tp = MilitaryTable; tp->name; tp++)
 	    if (strcmp(buff, tp->name) == 0) {
 		yylval.Number = tp->value;
@@ -781,27 +781,27 @@ yylex()
     int			sign;
 
     for ( ; ; ) {
-	while (isspace(*yyInput))
+	while (isspace((unsigned char)*yyInput))
 	    yyInput++;
 
-	if (isdigit(c = *yyInput) || c == '-' || c == '+') {
+	if (isdigit((unsigned char)(c = *yyInput)) || c == '-' || c == '+') {
 	    if (c == '-' || c == '+') {
 		sign = c == '-' ? -1 : 1;
-		if (!isdigit(*++yyInput))
+		if (!isdigit((unsigned char)*++yyInput))
 		    /* skip the '-' sign */
 		    continue;
 	    }
 	    else
 		sign = 0;
-	    for (yylval.Number = 0; isdigit(c = *yyInput++); )
+	    for (yylval.Number = 0; isdigit((unsigned char)(c = *yyInput++)); )
 		yylval.Number = 10 * yylval.Number + c - '0';
 	    yyInput--;
 	    if (sign < 0)
 		yylval.Number = -yylval.Number;
 	    return sign ? tSNUMBER : tUNUMBER;
 	}
-	if (isalpha(c)) {
-	    for (p = buff; isalpha(c = *yyInput++) || c == '.'; )
+	if (isalpha((unsigned char)c)) {
+	    for (p = buff; isalpha((unsigned char)(c = *yyInput++)) || c == '.'; )
 		if (p < &buff[sizeof buff - 1])
 		    *p++ = c;
 	    *p = '\0';
diff --git a/plugins/sudoers/ldap.c b/plugins/sudoers/ldap.c
index 7f364b9ba..2088502c6 100644
--- a/plugins/sudoers/ldap.c
+++ b/plugins/sudoers/ldap.c
@@ -269,7 +269,8 @@ sudo_ldap_conf_add_ports(void)
 	if (strlcat(hostbuf, host, sizeof(hostbuf)) >= sizeof(hostbuf))
 	    goto toobig;
 	/* Append port if there is not one already. */
-	if ((port = strrchr(host, ':')) == NULL || !isdigit(port[1])) {
+	if ((port = strrchr(host, ':')) == NULL ||
+	    !isdigit((unsigned char)port[1])) {
 	    if (strlcat(hostbuf, defport, sizeof(hostbuf)) >= sizeof(hostbuf))
 		goto toobig;
 	}
@@ -330,7 +331,8 @@ sudo_ldap_parse_uri(const char *uri_list)
 
 	/* If using SSL and no port specified, add port 636 */
 	if (nldaps) {
-	    if ((port = strrchr(host, ':')) == NULL || !isdigit(port[1]))
+	    if ((port = strrchr(host, ':')) == NULL ||
+		!isdigit((unsigned char)port[1]))
 		if (strlcat(hostbuf, ":636", sizeof(hostbuf)) >= sizeof(hostbuf))
 		    goto toobig;
 	}
@@ -1514,9 +1516,11 @@ static int
 sudo_ldap_bind_s(LDAP *ld)
 {
     int rc;
+#ifdef HAVE_LDAP_SASL_INTERACTIVE_BIND_S
     const char *old_ccname = user_ccname;
-#ifdef HAVE_GSS_KRB5_CCACHE_NAME
+# ifdef HAVE_GSS_KRB5_CCACHE_NAME
     unsigned int status;
+# endif
 #endif
 
 #ifdef HAVE_LDAP_SASL_INTERACTIVE_BIND_S
@@ -1526,28 +1530,28 @@ sudo_ldap_bind_s(LDAP *ld)
 	    ldap_conf.rootsasl_auth_id : ldap_conf.sasl_auth_id;
 
 	if (ldap_conf.krb5_ccname != NULL) {
-#ifdef HAVE_GSS_KRB5_CCACHE_NAME
+# ifdef HAVE_GSS_KRB5_CCACHE_NAME
 	    if (gss_krb5_ccache_name(&status, ldap_conf.krb5_ccname, &old_ccname)
 		!= GSS_S_COMPLETE) {
 		old_ccname = NULL;
 		DPRINTF(("gss_krb5_ccache_name() failed: %d", status), 1);
 	    }
-#else
+# else
 	    setenv("KRB5CCNAME", ldap_conf.krb5_ccname, TRUE);
-#endif
+# endif
 	}
 	rc = ldap_sasl_interactive_bind_s(ld, ldap_conf.binddn, "GSSAPI",
 	    NULL, NULL, LDAP_SASL_QUIET, sudo_ldap_sasl_interact, auth_id);
 	if (ldap_conf.krb5_ccname != NULL) {
-#ifdef HAVE_GSS_KRB5_CCACHE_NAME
+# ifdef HAVE_GSS_KRB5_CCACHE_NAME
 	    if (gss_krb5_ccache_name(&status, old_ccname, NULL) != GSS_S_COMPLETE)
 		    DPRINTF(("gss_krb5_ccache_name() failed: %d", status), 1);
-#else
+# else
 	    if (old_ccname != NULL)
 		setenv("KRB5CCNAME", old_ccname, TRUE);
 	    else
 		unsetenv("KRB5CCNAME");
-#endif
+# endif
 	}
 	if (rc != LDAP_SUCCESS) {
 	    warningx("ldap_sasl_interactive_bind_s(): %s", ldap_err2string(rc));
diff --git a/plugins/sudoers/sudoreplay.c b/plugins/sudoers/sudoreplay.c
index 866dc241c..bfa76e910 100644
--- a/plugins/sudoers/sudoreplay.c
+++ b/plugins/sudoers/sudoreplay.c
@@ -193,8 +193,10 @@ static void *open_io_fd(char *pathbuf, int len, const char *suffix);
 # define REGEX_T	char
 #endif
 
-#define VALID_ID(s) (isalnum((s)[0]) && isalnum((s)[1]) && isalnum((s)[2]) && \
-    isalnum((s)[3]) && isalnum((s)[4]) && isalnum((s)[5]) && (s)[6] == '\0')
+#define VALID_ID(s) (isalnum((unsigned char)(s)[0]) && \
+    isalnum((unsigned char)(s)[1]) && isalnum((unsigned char)(s)[2]) && \
+    isalnum((unsigned char)(s)[3]) && isalnum((unsigned char)(s)[4]) && \
+    isalnum((unsigned char)(s)[5]) && (s)[6] == '\0')
 
 int
 main(int argc, char *argv[])
@@ -634,8 +636,8 @@ list_session_dir(char *pathbuf, REGEX_T *re, const char *user, const char *tty)
 	return(-1);
     }
     while ((dp = readdir(d)) != NULL) {
-	if (NAMLEN(dp) != 2 || !isalnum(dp->d_name[0]) ||
-	    !isalnum(dp->d_name[1]))
+	if (NAMLEN(dp) != 2 || !isalnum((unsigned char)dp->d_name[0]) ||
+	    !isalnum((unsigned char)dp->d_name[1]))
 	    continue;
 
 	/* open log file, print id and command */
@@ -758,8 +760,8 @@ list_sessions(int argc, char **argv, const char *pattern, const char *user,
      * We do a depth-first traversal.
      */
     while ((dp1 = readdir(d1)) != NULL) {
-	if (NAMLEN(dp1) != 2 || !isalnum(dp1->d_name[0]) ||
-	    !isalnum(dp1->d_name[1]))
+	if (NAMLEN(dp1) != 2 || !isalnum((unsigned char)dp1->d_name[0]) ||
+	    !isalnum((unsigned char)dp1->d_name[1]))
 	    continue;
 
 	pathbuf[sdlen + 0] = '/';
@@ -771,8 +773,8 @@ list_sessions(int argc, char **argv, const char *pattern, const char *user,
 	    continue;
 
 	while ((dp2 = readdir(d2)) != NULL) {
-	    if (NAMLEN(dp2) != 2 || !isalnum(dp2->d_name[0]) ||
-		!isalnum(dp2->d_name[1]))
+	    if (NAMLEN(dp2) != 2 || !isalnum((unsigned char)dp2->d_name[0]) ||
+		!isalnum((unsigned char)dp2->d_name[1]))
 		continue;
 
 	    pathbuf[sdlen + 3] = '/';