diff --git a/src/frontend/com_fft.c b/src/frontend/com_fft.c
index 555d0a3dc..6159debd7 100644
--- a/src/frontend/com_fft.c
+++ b/src/frontend/com_fft.c
@@ -489,7 +489,7 @@ done:
     tfree(fdvec);
     tfree(win);
 
-    free(reald);
+    tfree(reald);
 
     free_pnode(names);
 }
diff --git a/src/frontend/com_hardcopy.c b/src/frontend/com_hardcopy.c
index 76cdaf8f1..075fcb3ec 100644
--- a/src/frontend/com_hardcopy.c
+++ b/src/frontend/com_hardcopy.c
@@ -73,7 +73,7 @@ com_hardcopy(wordlist *wl)
             psfname[2] = 's';
             psfname[3] = '\0';
         } else {
-            fname = realloc(fname, strlen(fname)+4);
+            fname = trealloc(fname, strlen(fname)+4);
             strcat(fname, ".ps");
         }
         tempgraph->devdep = fname;
diff --git a/src/frontend/com_sysinfo.c b/src/frontend/com_sysinfo.c
index 456319b45..0fdc64b06 100644
--- a/src/frontend/com_sysinfo.c
+++ b/src/frontend/com_sysinfo.c
@@ -76,8 +76,8 @@ static void
 tesFreeSystemInfo(TesSystemInfo *info)
 {
     if (info != NULL) {
-        free(info->cpuModelName);
-        free(info->osName);
+        tfree(info->cpuModelName);
+        tfree(info->osName);
     }
 }
 
@@ -323,7 +323,7 @@ tesCreateSystemInfo(TesSystemInfo *info)
                 }
             }
             info->numPhysicalProcessors = numProcs;
-            free(physIDs);
+            tfree(physIDs);
         }
 
         /* another test to get number of logical processors
@@ -341,7 +341,7 @@ tesCreateSystemInfo(TesSystemInfo *info)
          * }
          */
 
-        free(inStr);
+        tfree(inStr);
         fclose(file);
     } else {
         error = TES_FAIL;
diff --git a/src/frontend/define.c b/src/frontend/define.c
index b8523c424..f572d8a57 100644
--- a/src/frontend/define.c
+++ b/src/frontend/define.c
@@ -413,8 +413,8 @@ com_undefine(wordlist *wlist)
             struct udfunc *next = udf->ud_next;
             cp_remkword(CT_UDFUNCS, udf->ud_name);
             free_pnode(udf->ud_text);
-            free(udf->ud_name);
-            free(udf);
+            tfree(udf->ud_name);
+            tfree(udf);
             udf = next;
         }
         udfuncs = NULL;
@@ -432,8 +432,8 @@ com_undefine(wordlist *wlist)
                     udfuncs = udf->ud_next;
                 cp_remkword(CT_UDFUNCS, wlist->wl_word);
                 free_pnode(udf->ud_text);
-                free(udf->ud_name);
-                free(udf);
+                tfree(udf->ud_name);
+                tfree(udf);
             } else {
                 prev_udf = udf;
             }
diff --git a/src/frontend/device.c b/src/frontend/device.c
index 71638d98b..12fba6d1f 100644
--- a/src/frontend/device.c
+++ b/src/frontend/device.c
@@ -1401,7 +1401,7 @@ com_alter_mod(wordlist *wl)
     {
         char *dir_name = ngdirname(filename);
         modeldeck = inp_readall(modfile, dir_name, 0, 0, NULL);
-        free(dir_name);
+        tfree(dir_name);
     }
     tfree(input);
     tfree(filename);
diff --git a/src/frontend/inpcom.c b/src/frontend/inpcom.c
index 8df295a2f..5956caebf 100644
--- a/src/frontend/inpcom.c
+++ b/src/frontend/inpcom.c
@@ -320,8 +320,8 @@ read_a_lib(char *y, char *dir_name)
         fclose(newfp);
     }
 
-    free(yy);
-    free(y_resolved);
+    tfree(yy);
+    tfree(y_resolved);
 
     return lib;
 }
diff --git a/src/frontend/parse.c b/src/frontend/parse.c
index 691a660db..775dcb12c 100644
--- a/src/frontend/parse.c
+++ b/src/frontend/parse.c
@@ -552,7 +552,7 @@ db_print_pnode_tree(struct pnode *p, char *print)
     fclose(db_stream);
     if (print)
         printf("%s:%d: %s {%s}\n%s\n", __FILE__, __LINE__, __func__, print, buf);
-    free(buf);
+    tfree(buf);
 #endif
 }
 
diff --git a/src/frontend/spiceif.c b/src/frontend/spiceif.c
index 682f2f55e..96d638a64 100644
--- a/src/frontend/spiceif.c
+++ b/src/frontend/spiceif.c
@@ -659,7 +659,7 @@ spif_getparam_special(CKTcircuit *ckt, char **name, char *param, int ind, int do
                     {
                         char *x = tv->va_name;
                         tv->va_name = tprintf("%s [%s]", tv->va_name, device->instanceParms[i].keyword);
-                        free(x);
+                        tfree(x);
                     }
                     if (vv)
                         tv->va_next = vv;
@@ -704,7 +704,7 @@ spif_getparam_special(CKTcircuit *ckt, char **name, char *param, int ind, int do
                     {
                         char *x = tv->va_name;
                         tv->va_name = tprintf("%s [%s]", tv->va_name, device->modelParms[i].keyword);
-                        free(x);
+                        tfree(x);
                     }
                     /* tv->va_string = device->modelParms[i].keyword;   Put the name of the variable */
                     if (vv)
diff --git a/src/frontend/subckt.c b/src/frontend/subckt.c
index 2b00ab146..082cbea3e 100644
--- a/src/frontend/subckt.c
+++ b/src/frontend/subckt.c
@@ -98,6 +98,8 @@ static wordlist *modtranslate(struct card *deck, char *subname, wordlist *new_mo
 static void devmodtranslate(struct card *deck, char *subname, wordlist * const orig_modnames);
 static int inp_numnodes(char c);
 
+#define N_GLOBAL_NODES 1005
+
 /*---------------------------------------------------------------------
  * table is used in settrans and gettrans -- it holds the netnames used
  * in the .subckt definition (t_old), and in the subcircuit invocation
@@ -106,7 +108,7 @@ static int inp_numnodes(char c);
 static struct tab {
     char *t_old;
     char *t_new;
-} table[512];   /* That had better be enough. */
+} table[N_GLOBAL_NODES];   /* That had better be enough. */
 
 
 /*---------------------------------------------------------------------
@@ -131,7 +133,7 @@ static bool use_numparams = FALSE;
 
 static char start[32], sbend[32], invoke[32], model[32];
 
-static char *global_nodes[128];
+static char *global_nodes[N_GLOBAL_NODES];
 static int num_global_nodes;
 
 
@@ -151,6 +153,10 @@ collect_global_nodes(struct card *c)
             char *s = c->line;
             s = nexttok(s);
             while (*s) {
+                if (num_global_nodes == N_GLOBAL_NODES) {
+                    fprintf(stderr, "ERROR, N_GLOBAL_NODES overflow\n");
+                    controlled_exit(EXIT_FAILURE);
+                }
                 char *t = skip_non_ws(s);
                 global_nodes[num_global_nodes++] = copy_substring(s, t);
                 s = skip_ws(t);
@@ -1246,7 +1252,7 @@ translate(struct card *deck, char *formal, char *actual, char *scname, const cha
     }
     rtn = 1;
  quit:
-    for (i = 0; ; i++) {
+    for (i = 0; i < N_GLOBAL_NODES; i++) {
         if (!table[i].t_old && !table[i].t_new)
             break;
         FREE(table[i].t_old);
@@ -1338,7 +1344,7 @@ settrans(char *formal, char *actual, const char *subname)
 
     memset(table, 0, sizeof(*table));
 
-    for (i = 0; ; i++) {
+    for (i = 0; i < N_GLOBAL_NODES; i++) {
         table[i].t_old = gettok(&formal);
         table[i].t_new = gettok(&actual);
 
@@ -1351,6 +1357,11 @@ settrans(char *formal, char *actual, const char *subname)
                 return 1;       /* Too many actual / too few formal */
         }
     }
+    if (i == N_GLOBAL_NODES) {
+        fprintf(stderr, "ERROR, N_GLOBAL_NODES overflow\n");
+        controlled_exit(EXIT_FAILURE);
+    }
+
     return 0;
 }
 
diff --git a/src/frontend/trannoise/1-f-code.c b/src/frontend/trannoise/1-f-code.c
index f03da97de..d000619d9 100644
--- a/src/frontend/trannoise/1-f-code.c
+++ b/src/frontend/trannoise/1-f-code.c
@@ -104,8 +104,8 @@ f_alpha(int n_pts, int n_exp, double X[], double Q_d, double alpha)
 
 #endif
 
-    free(hfa);
-    free(wfa);
+    tfree(hfa);
+    tfree(wfa);
     /* fft tables will be freed in vsrcaccept.c and isrcaccept.c
        fftFree(); */
     fprintf(stdout, "%d 1/f noise values in time domain created\n", n_pts);
diff --git a/src/frontend/variable.c b/src/frontend/variable.c
index 781be0d2b..6652b053d 100644
--- a/src/frontend/variable.c
+++ b/src/frontend/variable.c
@@ -678,20 +678,20 @@ cp_variablesubst(wordlist *wlist)
                 char *x = nwl->wl_word;
                 char *tail_ = copy(tail);
                 nwl->wl_word = tprintf("%.*s%s", prefix_len, wl->wl_word, nwl->wl_word);
-                free(x);
+                tfree(x);
                 if (wlist == wl)
                     wlist = nwl;
                 wl = wl_splice(wl, nwl);
                 i = (int) strlen(wl->wl_word);
                 x = wl->wl_word;
                 wl->wl_word = tprintf("%s%s", wl->wl_word, tail_);
-                free(x);
-                free(tail_);
+                tfree(x);
+                tfree(tail_);
             } else if (prefix_len || *tail) {
                 char *x = wl->wl_word;
                 wl->wl_word = tprintf("%.*s%s", prefix_len, wl->wl_word, tail);
                 i = prefix_len;
-                free(x);
+                tfree(x);
             } else {
                 wordlist *next = wl->wl_next;
                 if (wlist == wl)
diff --git a/src/include/ngspice/fftext.h b/src/include/ngspice/fftext.h
index 2b2dacd49..7881197d8 100644
--- a/src/include/ngspice/fftext.h
+++ b/src/include/ngspice/fftext.h
@@ -101,7 +101,7 @@ void rspectprod(double *data1, double *data2, double *outdata, int N);
 // aInit = CACHEFILLMALLOC( NUMFLOATS*sizeof(float) );
 // a = (float *) CEILCACHELINE(ainit);
 // ... main body of code ...
-// free(aInit);
+// tfree(aInit);
 //
 // To disable this alignment, set CACHELINESIZE to 1
 //#define CACHELINESIZE 32				// Bytes per cache line
diff --git a/src/main.c b/src/main.c
index 5c2dfaa80..7e05180ba 100644
--- a/src/main.c
+++ b/src/main.c
@@ -657,10 +657,10 @@ app_rl_readlines(void)
                 cp_evloop(expanded_line);
                 add_history(expanded_line);
             }
-            free(expanded_line);
+            tfree(expanded_line);
         }
 
-        free(line);
+        tfree(line);
     }
     /* History gets written in ../fte/misccoms.c com_quit */
 
diff --git a/src/maths/cmaths/cmath1.c b/src/maths/cmaths/cmath1.c
index 5a9c35b2c..0b9bb1abc 100644
--- a/src/maths/cmaths/cmath1.c
+++ b/src/maths/cmaths/cmath1.c
@@ -731,7 +731,7 @@ cx_sortorder(void *data, short int type, int length, int *newlength, short int *
     int i;
 
     amplitude_index_t *array_amplitudes;
-    array_amplitudes = (amplitude_index_t *) malloc(sizeof(amplitude_index_t) * (size_t) length);
+    array_amplitudes = (amplitude_index_t *) tmalloc(sizeof(amplitude_index_t) * (size_t) length);
 
     *newlength = length;
     *newtype = VF_REAL;
@@ -748,7 +748,7 @@ cx_sortorder(void *data, short int type, int length, int *newlength, short int *
             d[i] = array_amplitudes[i].index;
     }
 
-    free(array_amplitudes);
+    tfree(array_amplitudes);
 
     /* Otherwise it is 0, but tmalloc zeros the stuff already. */
     return ((void *) d);
diff --git a/src/maths/fft/fftext.c b/src/maths/fft/fftext.c
index f2528bcf7..6dc6400e8 100644
--- a/src/maths/fft/fftext.c
+++ b/src/maths/fft/fftext.c
@@ -81,13 +81,13 @@ void fftFree(void)
     int i1;
     for (i1=8*sizeof(int)/2-1; i1>=0; i1--) {
         if (BRLowArray[i1] != NULL) {
-            free(BRLowArray[i1]);
+            tfree(BRLowArray[i1]);
             BRLowArray[i1] = NULL;
         }
     }
     for (i1=8*sizeof(int)-1; i1>=0; i1--) {
         if (UtblArray[i1] != NULL) {
-            free(UtblArray[i1]);
+            tfree(UtblArray[i1]);
             UtblArray[i1] = NULL;
         }
     }
diff --git a/src/misc/util.c b/src/misc/util.c
index 36bfc6c68..e8f1e58ce 100644
--- a/src/misc/util.c
+++ b/src/misc/util.c
@@ -160,7 +160,7 @@ basename(const char *name)
     int len; 
 
     if (tmp) {
-        free(tmp);
+        tfree(tmp);
         tmp = NULL;
     }
 
diff --git a/src/spicelib/devices/bsimsoi/b4soitemp.c b/src/spicelib/devices/bsimsoi/b4soitemp.c
index c6a1496db..6d617cd67 100644
--- a/src/spicelib/devices/bsimsoi/b4soitemp.c
+++ b/src/spicelib/devices/bsimsoi/b4soitemp.c
@@ -185,7 +185,7 @@ B4SOItemp(
             }
 
             if (Size_Not_Found)
-            {   pParam = (struct b4soiSizeDependParam *)malloc(
+            {   pParam = (struct b4soiSizeDependParam *)tmalloc(
                     sizeof(struct b4soiSizeDependParam));
             if (pLastKnot == NULL)
                 model->pSizeDependParamKnot = pParam;
diff --git a/src/spicelib/devices/cpl/cplsetup.c b/src/spicelib/devices/cpl/cplsetup.c
index d24f18d99..cff29580a 100644
--- a/src/spicelib/devices/cpl/cplsetup.c
+++ b/src/spicelib/devices/cpl/cplsetup.c
@@ -28,14 +28,14 @@ Modified: 2004 Paolo Nenzi - (ng)spice integration
         }                                       \
 }
 
-#define VECTOR_FREE(vec) free(vec)
+#define VECTOR_FREE(vec) tfree(vec)
 
 #define MATRIX_FREE(mat, m, j) {                \
         int k;                                  \
         for (k = 0; k < m; k++) {               \
-            free(mat[k]);                       \
+            tfree(mat[k]);                       \
         }                                       \
-        free(mat);                              \
+        tfree(mat);                              \
 }
 
 #define MAX_DEG 8
@@ -225,7 +225,7 @@ do { if((here->ptr = SMPmakeElt(matrix, here->first, here->second)) == NULL){\
                 }
                 here->CPLibr1Given = 1;
             }
-            free(branchname);
+            tfree(branchname);
             branchname = TMALLOC(char *, here->dimension);
             if (! here->CPLibr2Given) {
                 for (m = 0; m < here->dimension; m++) {
@@ -239,7 +239,7 @@ do { if((here->ptr = SMPmakeElt(matrix, here->first, here->second)) == NULL){\
                 }
                 here->CPLibr2Given = 1;
             }
-            free(branchname);
+            tfree(branchname);
 
             for (m = 0; m < here->dimension; m++) {
                 for (node = ckt->CKTnodes; node; node = node->next) {
@@ -337,10 +337,10 @@ CPLunsetup(GENmodel *inModel, CKTcircuit *ckt)
                 }
             }
 
-            free(here->CPLposNodes);
-            free(here->CPLnegNodes);
-            free(here->CPLibr1);
-            free(here->CPLibr2);
+            tfree(here->CPLposNodes);
+            tfree(here->CPLnegNodes);
+            tfree(here->CPLibr1);
+            tfree(here->CPLibr2);
 
             /* reset switches */
             here->CPLdcGiven=0;
@@ -583,8 +583,8 @@ static void
 free_vector(double *v, int nl, int nh)
 {
     NG_IGNORE(nh);
-
-    free(v + nl);
+    double *freev = v + nl;
+    tfree(freev);
 }
 
 static void