Index: qemu/block-vvfat.c
===================================================================
--- qemu.orig/block-vvfat.c	2008-09-04 18:04:22.000000000 +0000
+++ qemu/block-vvfat.c	2008-09-04 18:20:12.000000000 +0000
@@ -1523,7 +1523,7 @@
         uint16_t* entry=((uint16_t*)s->fat2)+cluster;
         return le16_to_cpu(*entry);
     } else {
-        const uint8_t* x=s->fat2+cluster*3/2;
+        const uint8_t* x=((uint8_t*)s->fat2)+cluster*3/2;
         return ((x[0]|(x[1]<<8))>>(cluster&1?4:0))&0x0fff;
     }
 }
Index: qemu/hw/rtl8139.c
===================================================================
--- qemu.orig/hw/rtl8139.c	2008-09-04 18:06:41.000000000 +0000
+++ qemu/hw/rtl8139.c	2008-09-04 18:40:18.000000000 +0000
@@ -752,6 +752,8 @@
         /* write packet data */
         if (wrapped && !(s->RxBufferSize < 65536 && rtl8139_RxWrap(s)))
         {
+            const uint8_t *buffer;
+
             DEBUG_PRINT((">>> RTL8139: rx packet wrapped in buffer at %d\n", size-wrapped));
 
             if (size > wrapped)
@@ -763,8 +765,9 @@
             /* reset buffer pointer */
             s->RxBufAddr = 0;
 
+            buffer = buf;
             cpu_physical_memory_write( s->RxBuf + s->RxBufAddr,
-                                       buf + (size-wrapped), wrapped );
+                                       &buffer[size-wrapped], wrapped );
 
             s->RxBufAddr = wrapped;
 
Index: qemu/linux-user/elfload.c
===================================================================
--- qemu.orig/linux-user/elfload.c	2008-09-04 18:09:11.000000000 +0000
+++ qemu/linux-user/elfload.c	2008-09-04 18:19:33.000000000 +0000
@@ -993,10 +993,10 @@
     struct elf_shdr sechdr, symtab, strtab;
     char *strings;
     struct syminfo *s;
+    struct elf_sym *syms;
 #if (ELF_CLASS == ELFCLASS64)
     // Disas uses 32 bit symbols
     struct elf32_sym *syms32 = NULL;
-    struct elf_sym *sym;
 #endif
 
     lseek(fd, hdr->e_shoff, SEEK_SET);
@@ -1037,18 +1037,18 @@
     if (read(fd, s->disas_symtab, symtab.sh_size) != symtab.sh_size)
 	return;
 
+    syms = s->disas_symtab;
     for (i = 0; i < symtab.sh_size / sizeof(struct elf_sym); i++) {
 #ifdef BSWAP_NEEDED
-	bswap_sym(s->disas_symtab + sizeof(struct elf_sym)*i);
+        bswap_sym(&syms[i]);
 #endif
 #if (ELF_CLASS == ELFCLASS64)
-        sym = s->disas_symtab + sizeof(struct elf_sym)*i;
-        syms32[i].st_name = sym->st_name;
-        syms32[i].st_info = sym->st_info;
-        syms32[i].st_other = sym->st_other;
-        syms32[i].st_shndx = sym->st_shndx;
-        syms32[i].st_value = sym->st_value & 0xffffffff;
-        syms32[i].st_size = sym->st_size & 0xffffffff;
+        syms32[i].st_name = syms[i].st_name;
+        syms32[i].st_info = syms[i].st_info;
+        syms32[i].st_other = syms[i].st_other;
+        syms32[i].st_shndx = syms[i].st_shndx;
+        syms32[i].st_value = syms[i].st_value & 0xffffffff;
+        syms32[i].st_size = syms[i].st_size & 0xffffffff;
 #endif
     }
 
Index: qemu/nbd.c
===================================================================
--- qemu.orig/nbd.c	2008-09-04 17:51:14.000000000 +0000
+++ qemu/nbd.c	2008-09-04 18:20:08.000000000 +0000
@@ -75,11 +75,12 @@
 
     while (offset < size) {
         ssize_t len;
+        char *buf = buffer;
 
         if (do_read) {
-            len = read(fd, buffer + offset, size - offset);
+            len = read(fd, &buf[offset], size - offset);
         } else {
-            len = write(fd, buffer + offset, size - offset);
+            len = write(fd, &buf[offset], size - offset);
         }
 
         /* recoverable error */
Index: qemu/hw/pflash_cfi01.c
===================================================================
--- qemu.orig/hw/pflash_cfi01.c	2008-09-04 18:32:55.000000000 +0000
+++ qemu/hw/pflash_cfi01.c	2008-09-04 18:34:35.000000000 +0000
@@ -185,12 +185,15 @@
                           int size)
 {
     int offset_end;
+    uint8_t *buf;
+
     if (pfl->bs) {
         offset_end = offset + size;
         /* round to sectors */
         offset = offset >> 9;
         offset_end = (offset_end + 511) >> 9;
-        bdrv_write(pfl->bs, offset, pfl->storage + (offset << 9),
+        buf = pfl->storage;
+        bdrv_write(pfl->bs, offset, &buf[offset << 9],
                    offset_end - offset);
     }
 }
Index: qemu/hw/pflash_cfi02.c
===================================================================
--- qemu.orig/hw/pflash_cfi02.c	2008-09-04 18:34:54.000000000 +0000
+++ qemu/hw/pflash_cfi02.c	2008-09-04 18:35:30.000000000 +0000
@@ -214,12 +214,15 @@
                           int size)
 {
     int offset_end;
+    uint8_t *buf;
+
     if (pfl->bs) {
         offset_end = offset + size;
         /* round to sectors */
         offset = offset >> 9;
         offset_end = (offset_end + 511) >> 9;
-        bdrv_write(pfl->bs, offset, pfl->storage + (offset << 9),
+        buf = pfl->storage;
+        bdrv_write(pfl->bs, offset, &buf[offset << 9],
                    offset_end - offset);
     }
 }
