Another few memory safety fixes

The core tests are now AddressSanitizer-clean.