diff --git a/dom/cache/StreamControl.cpp b/dom/cache/StreamControl.cpp
index 1d6a807df..e9ef71e62 100644
--- a/dom/cache/StreamControl.cpp
+++ b/dom/cache/StreamControl.cpp
@@ -64,7 +64,8 @@ StreamControl::CloseAllReadStreams()
 {
   AssertOwningThread();
 
-  ReadStreamList::ForwardIterator iter(mReadStreamList);
+  auto readStreamList = mReadStreamList;
+  ReadStreamList::ForwardIterator iter(readStreamList);
   while (iter.HasMore()) {
     iter.GetNext()->CloseStream();
   }
diff --git a/security/manager/ssl/SSLServerCertVerification.cpp b/security/manager/ssl/SSLServerCertVerification.cpp
index b54e019c0..531540c58 100644
--- a/security/manager/ssl/SSLServerCertVerification.cpp
+++ b/security/manager/ssl/SSLServerCertVerification.cpp
@@ -974,6 +974,7 @@ GatherBaselineRequirementsTelemetry(const ScopedCERTCertList& certList)
       // According to DNS.h, this includes space for the null-terminator
       char buf[net::kNetAddrMaxCStrBufSize] = { 0 };
       PRNetAddr addr;
+      memset(&addr, 0, sizeof(addr));
       if (currentName->name.other.len == 4) {
         addr.inet.family = PR_AF_INET;
         memcpy(&addr.inet.ip, currentName->name.other.data,
diff --git a/security/manager/ssl/TransportSecurityInfo.cpp b/security/manager/ssl/TransportSecurityInfo.cpp
index dec1ba066..7751ca2ed 100644
--- a/security/manager/ssl/TransportSecurityInfo.cpp
+++ b/security/manager/ssl/TransportSecurityInfo.cpp
@@ -23,6 +23,7 @@
 #include "nsServiceManagerUtils.h"
 #include "nsXULAppAPI.h"
 #include "PSMRunnable.h"
+#include "mozilla/net/DNS.h"
 
 #include "secerr.h"
 
@@ -677,8 +678,10 @@ GetSubjectAltNames(CERTCertificate *nssCert,
 
       case certIPAddress:
         {
-          char buf[INET6_ADDRSTRLEN];
+          // According to DNS.h, this includes space for the null-terminator
+          char buf[net::kNetAddrMaxCStrBufSize] = {0};
           PRNetAddr addr;
+          memset(&addr, 0, sizeof(addr));
           if (current->name.other.len == 4) {
             addr.inet.family = PR_AF_INET;
             memcpy(&addr.inet.ip, current->name.other.data, current->name.other.len);
diff --git a/security/manager/ssl/nsNSSCertHelper.cpp b/security/manager/ssl/nsNSSCertHelper.cpp
index b3eebe5dc..0c19e32cd 100644
--- a/security/manager/ssl/nsNSSCertHelper.cpp
+++ b/security/manager/ssl/nsNSSCertHelper.cpp
@@ -19,6 +19,7 @@
 #include "nsIDateTimeFormat.h"
 #include "nsDateTimeFormatCID.h"
 #include "nsServiceManagerUtils.h"
+#include "mozilla/net/DNS.h"
 #include <algorithm>
 
 using namespace mozilla;
@@ -1033,8 +1034,9 @@ ProcessGeneralName(PLArenaPool *arena,
     break;
   case certIPAddress:
     {
-      char buf[INET6_ADDRSTRLEN];
       PRStatus status = PR_FAILURE;
+      // According to DNS.h, this includes space for the null-terminator
+      char buf[net::kNetAddrMaxCStrBufSize] = {0};
       PRNetAddr addr;
       memset(&addr, 0, sizeof(addr));
       nssComponent->GetPIPNSSBundleString("CertDumpIPAddress", key);