diff --git a/src/libsodium/crypto_hash/sha256/cp/hash_sha256.c b/src/libsodium/crypto_hash/sha256/cp/hash_sha256.c
index 6dc89343..ffb38f6b 100644
--- a/src/libsodium/crypto_hash/sha256/cp/hash_sha256.c
+++ b/src/libsodium/crypto_hash/sha256/cp/hash_sha256.c
@@ -271,7 +271,7 @@ crypto_hash_sha256_update(crypto_hash_sha256_state *state,
         in += 64;
         inlen -= 64;
     }
-    memcpy(state->buf, in, inlen);
+    memcpy(state->buf, in, inlen); /* inlen < 64 */
 
     return 0;
 }
diff --git a/src/libsodium/crypto_hash/sha512/cp/hash_sha512.c b/src/libsodium/crypto_hash/sha512/cp/hash_sha512.c
index 164cedb6..0b5624fa 100644
--- a/src/libsodium/crypto_hash/sha512/cp/hash_sha512.c
+++ b/src/libsodium/crypto_hash/sha512/cp/hash_sha512.c
@@ -291,7 +291,7 @@ crypto_hash_sha512_update(crypto_hash_sha512_state *state,
         src += 128;
         inlen -= 128;
     }
-    memcpy(state->buf, src, inlen);
+    memcpy(state->buf, src, inlen); /* inlen < 128 */
 
     return 0;
 }
diff --git a/src/libsodium/crypto_stream/chacha20/ref/stream_chacha20_ref.c b/src/libsodium/crypto_stream/chacha20/ref/stream_chacha20_ref.c
index fa8e8352..d3c09af1 100644
--- a/src/libsodium/crypto_stream/chacha20/ref/stream_chacha20_ref.c
+++ b/src/libsodium/crypto_stream/chacha20/ref/stream_chacha20_ref.c
@@ -229,7 +229,7 @@ chacha_encrypt_bytes(chacha_ctx *ctx, const u8 *m, u8 *c, unsigned long long byt
         if (bytes <= 64) {
             if (bytes < 64) {
                 for (i = 0; i < (unsigned int) bytes; ++i) {
-                    ctarget[i] = c[i];
+                    ctarget[i] = c[i]; /* ctarget cannot be NULL */
                 }
             }
             ctx->input[12] = j12;