diff --git a/src/lib/rnp.cpp b/src/lib/rnp.cpp
index 3f259f2884..418bba0e78 100644
--- a/src/lib/rnp.cpp
+++ b/src/lib/rnp.cpp
@@ -512,12 +512,14 @@ hex_encode_value(const uint8_t *value, size_t len, char **res)
     size_t hex_len = len * 2 + 1;
     *res = (char *) malloc(hex_len);
     if (!*res) {
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
     if (!rnp::hex_encode(value, len, *res, hex_len, rnp::HexFormat::Uppercase)) {
+        /* LCOV_EXCL_START we do know that it must not fail here*/
         free(*res);
         *res = NULL;
         return RNP_ERROR_GENERIC;
+        /* LCOV_EXCL_END */
     }
     return RNP_SUCCESS;
 }
@@ -531,7 +533,7 @@ get_map_value(const id_str_pair *map, int val, char **res)
     }
     char *strcp = strdup(str);
     if (!strcp) {
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
     *res = strcp;
     return RNP_SUCCESS;
@@ -545,7 +547,7 @@ ret_str_value(const char *str, char **res)
     }
     char *strcp = strdup(str);
     if (!strcp) {
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
     *res = strcp;
     return RNP_SUCCESS;
@@ -935,7 +937,7 @@ try {
     }
     *homedir = strdup(home.c_str());
     if (!*homedir) {
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
     return RNP_SUCCESS;
 }
@@ -987,6 +989,7 @@ try {
         return RNP_SUCCESS;
     }
 
+    /* LCOV_EXCL_START */
     free(*pub_format);
     *pub_format = NULL;
     free(*pub_path);
@@ -996,6 +999,7 @@ try {
     free(*sec_path);
     *sec_path = NULL;
     return RNP_ERROR_OUT_OF_MEMORY;
+    /* LCOV_EXCL_END */
 }
 FFI_GUARD
 
@@ -1029,7 +1033,7 @@ try {
     if (guess) {
         *format = strdup(guess);
         if (!*format) {
-            return RNP_ERROR_OUT_OF_MEMORY;
+            return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
         }
     }
 
@@ -1093,7 +1097,7 @@ json_array_add_id_str(json_object *arr, const id_str_pair *map, bool (*check)(in
 {
     while (map->str) {
         if (check(map->id) && !json_array_add(arr, map->str)) {
-            return RNP_ERROR_OUT_OF_MEMORY;
+            return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
         }
         map++;
     }
@@ -1109,7 +1113,7 @@ try {
 
     json_object *features = json_object_new_array();
     if (!features) {
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
     rnp::JSONObject featwrap(features);
     rnp_result_t    ret = RNP_ERROR_BAD_PARAMETERS;
@@ -1138,7 +1142,7 @@ try {
                 continue;
             }
             if (!json_array_add(features, desc->pgp_name)) {
-                return RNP_ERROR_OUT_OF_MEMORY;
+                return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_START
             }
         }
         ret = RNP_SUCCESS;
@@ -1154,7 +1158,7 @@ try {
     }
     *result = strdup(*result);
     if (!*result) {
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
     return RNP_SUCCESS;
 }
@@ -1401,7 +1405,7 @@ try {
     size_t pass_len = strlen(pass.data()) + 1;
     *password = (char *) malloc(pass_len);
     if (!*password) {
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
     memcpy(*password, pass.data(), pass_len);
     return RNP_SUCCESS;
@@ -1665,14 +1669,14 @@ add_key_status(json_object *           keys,
 {
     json_object *jsokey = json_object_new_object();
     if (!jsokey) {
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
 
     if (!json_add(jsokey, "public", key_status_to_str(pub)) ||
         !json_add(jsokey, "secret", key_status_to_str(sec)) ||
         !json_add(jsokey, "fingerprint", key->fp()) || !json_array_add(keys, jsokey)) {
         json_object_put(jsokey);
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
 
     return RNP_SUCCESS;
@@ -1734,12 +1738,12 @@ try {
 
     json_object *jsores = json_object_new_object();
     if (!jsores) {
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
     rnp::JSONObject jsowrap(jsores);
     json_object *   jsokeys = json_object_new_array();
     if (!json_add(jsores, "keys", jsokeys)) {
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
 
     // import keys to the main keystore.
@@ -1778,7 +1782,7 @@ try {
         }
         *results = strdup(*results);
         if (!*results) {
-            return RNP_ERROR_OUT_OF_MEMORY;
+            return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
         }
     }
     return RNP_SUCCESS;
@@ -1802,26 +1806,26 @@ add_sig_status(json_object *           sigs,
 {
     json_object *jsosig = json_object_new_object();
     if (!jsosig) {
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
 
     if (!json_add(jsosig, "public", sig_status_to_str(pub)) ||
         !json_add(jsosig, "secret", sig_status_to_str(sec))) {
         json_object_put(jsosig);
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
 
     if (signer) {
         const pgp_fingerprint_t &fp = signer->fp();
         if (!json_add(jsosig, "signer fingerprint", fp)) {
             json_object_put(jsosig);
-            return RNP_ERROR_OUT_OF_MEMORY;
+            return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
         }
     }
 
     if (!json_array_add(sigs, jsosig)) {
         json_object_put(jsosig);
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
 
     return RNP_SUCCESS;
@@ -1847,12 +1851,12 @@ try {
 
     json_object *jsores = json_object_new_object();
     if (!jsores) {
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
     rnp::JSONObject jsowrap(jsores);
     json_object *   jsosigs = json_object_new_array();
     if (!json_add(jsores, "sigs", jsosigs)) {
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
 
     for (auto &sig : sigs) {
@@ -1869,11 +1873,11 @@ try {
     if (results) {
         *results = (char *) json_object_to_json_string_ext(jsores, JSON_C_TO_STRING_PRETTY);
         if (!*results) {
-            return RNP_ERROR_OUT_OF_MEMORY;
+            return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
         }
         *results = strdup(*results);
         if (!*results) {
-            return RNP_ERROR_OUT_OF_MEMORY;
+            return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
         }
     }
     return RNP_SUCCESS;
@@ -1913,13 +1917,13 @@ do_save_keys(rnp_ffi_t              ffi,
     // include the public keys, if desired
     if (key_type == KEY_TYPE_PUBLIC || key_type == KEY_TYPE_ANY) {
         if (!copy_store_keys(ffi, tmp_store, ffi->pubring)) {
-            return RNP_ERROR_OUT_OF_MEMORY;
+            return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
         }
     }
     // include the secret keys, if desired
     if (key_type == KEY_TYPE_SECRET || key_type == KEY_TYPE_ANY) {
         if (!copy_store_keys(ffi, tmp_store, ffi->secring)) {
-            return RNP_ERROR_OUT_OF_MEMORY;
+            return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
         }
     }
     // preliminary check on the format
@@ -2083,9 +2087,11 @@ try {
     if (do_copy) {
         data = (uint8_t *) malloc(buf_len);
         if (!data) {
+            /* LCOV_EXCL_START */
             delete *input;
             *input = NULL;
             return RNP_ERROR_OUT_OF_MEMORY;
+            /* LCOV_EXCL_END */
         }
         memcpy(data, buf, buf_len);
     }
@@ -2137,8 +2143,10 @@ try {
     obj->closer = closer;
     obj->app_ctx = app_ctx;
     if (!init_src_common(src, 0)) {
+        /* LCOV_EXCL_START */
         delete obj;
         return RNP_ERROR_OUT_OF_MEMORY;
+        /* LCOV_EXCL_END */
     }
     src->param = obj;
     src->raw_read = input_reader_bounce;
@@ -2168,14 +2176,16 @@ try {
     }
     ob = (rnp_output_st *) calloc(1, sizeof(*ob));
     if (!ob) {
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
     if (rnp_stat(path, &st) == 0 && S_ISDIR(st.st_mode)) {
         // a bit hacky, just save the directory path
         ob->dst_directory = strdup(path);
         if (!ob->dst_directory) {
+            /* LCOV_EXCL_START */
             free(ob);
             return RNP_ERROR_OUT_OF_MEMORY;
+            /* LCOV_EXCL_END */
         }
     } else {
         // simple output to a file
@@ -2203,7 +2213,7 @@ try {
     }
     rnp_output_t res = (rnp_output_t) calloc(1, sizeof(*res));
     if (!res) {
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
     rnp_result_t ret = RNP_ERROR_GENERIC;
     if (random) {
@@ -2228,7 +2238,7 @@ try {
     }
     rnp_output_t res = (rnp_output_t) calloc(1, sizeof(*res));
     if (!res) {
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
     rnp_result_t ret = init_stdout_dest(&res->dst);
     if (ret) {
@@ -2250,7 +2260,7 @@ try {
 
     *output = (rnp_output_t) calloc(1, sizeof(**output));
     if (!*output) {
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
     rnp_result_t ret = init_mem_dest(&(*output)->dst, NULL, max_alloc);
     if (ret) {
@@ -2279,7 +2289,7 @@ try {
     }
     *output = (rnp_output_t) calloc(1, sizeof(**output));
     if (!*output) {
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
     rnp_result_t ret = init_armored_dst(&(*output)->dst, &base->dst, msgtype);
     if (ret) {
@@ -2308,7 +2318,7 @@ try {
         uint8_t *tmp_buf = *buf;
         *buf = (uint8_t *) malloc(*len);
         if (!*buf) {
-            return RNP_ERROR_OUT_OF_MEMORY;
+            return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
         }
         memcpy(*buf, tmp_buf, *len);
     }
@@ -2348,13 +2358,15 @@ try {
 
     *output = (rnp_output_t) calloc(1, sizeof(**output));
     if (!*output) {
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
     rnp_result_t ret = init_null_dest(&(*output)->dst);
     if (ret) {
+        /* LCOV_EXCL_START cannot fail */
         free(*output);
         *output = NULL;
         return ret;
+        /* LCOV_EXCL_END */
     }
     return RNP_SUCCESS;
 }
@@ -2395,7 +2407,7 @@ try {
 
     *output = (rnp_output_t) calloc(1, sizeof(**output));
     if (!*output) {
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
     (*output)->writer = writer;
     (*output)->closer = closer;
@@ -3466,13 +3478,13 @@ try {
     if (mode) {
         *mode = strdup(get_protection_mode(op));
         if (!*mode) {
-            return RNP_ERROR_OUT_OF_MEMORY;
+            return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
         }
     }
     if (cipher) {
         *cipher = strdup(get_protection_cipher(op));
         if (!*cipher) {
-            return RNP_ERROR_OUT_OF_MEMORY;
+            return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
         }
     }
     if (valid) {
@@ -3661,15 +3673,17 @@ try {
 
     *handle = (rnp_signature_handle_t) calloc(1, sizeof(**handle));
     if (!*handle) {
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
 
     try {
         (*handle)->sig = new pgp_subsig_t(sig->sig_pkt);
     } catch (const std::exception &e) {
+        /* LCOV_EXCL_START */
         FFI_LOG(sig->ffi, "%s", e.what());
         free(*handle);
         return RNP_ERROR_OUT_OF_MEMORY;
+        /* LCOV_EXCL_END */
     }
     (*handle)->ffi = sig->ffi;
     (*handle)->key = NULL;
@@ -5907,7 +5921,7 @@ try {
 
     *uid = (rnp_uid_handle_t) malloc(sizeof(**uid));
     if (!*uid) {
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
 
     (*uid)->ffi = key->ffi;
@@ -5961,7 +5975,7 @@ try {
     }
     *data = malloc(id->pkt.uid_len);
     if (id->pkt.uid_len && !*data) {
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
     memcpy(*data, id->pkt.uid, id->pkt.uid_len);
     *size = id->pkt.uid_len;
@@ -6007,7 +6021,7 @@ rnp_key_return_signature(rnp_ffi_t               ffi,
 {
     *sig = (rnp_signature_handle_t) calloc(1, sizeof(**sig));
     if (!*sig) {
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
     (*sig)->ffi = ffi;
     (*sig)->key = key;
@@ -6078,7 +6092,7 @@ create_key_signature(rnp_key_handle_t        signer,
     }
     *sig = (rnp_signature_handle_t) calloc(1, sizeof(**sig));
     if (!*sig) {
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
     try {
         pgp_signature_t sigpkt;
@@ -6094,10 +6108,12 @@ create_key_signature(rnp_key_handle_t        signer,
         (*sig)->own_sig = true;
         (*sig)->new_sig = true;
     } catch (const std::exception &e) {
+        /* LCOV_EXCL_START */
         FFI_LOG(signer->ffi, "%s", e.what());
         free(*sig);
         *sig = NULL;
         return RNP_ERROR_OUT_OF_MEMORY;
+        /* LCOV_EXCL_END */
     }
 
     return RNP_SUCCESS;
@@ -6860,7 +6876,7 @@ try {
     }
     char *curvenamecp = strdup(curvename);
     if (!curvenamecp) {
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
     *curve = curvenamecp;
     return RNP_SUCCESS;
@@ -7165,7 +7181,7 @@ try {
 
     *result = strdup(key->revocation().reason.c_str());
     if (!*result) {
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
     return RNP_SUCCESS;
 }
@@ -7552,7 +7568,7 @@ key_to_bytes(pgp_key_t *key, uint8_t **buf, size_t *buf_len)
     auto vec = key->write_vec();
     *buf = (uint8_t *) calloc(1, vec.size());
     if (!*buf) {
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
     memcpy(*buf, vec.data(), vec.size());
     *buf_len = vec.size();
@@ -7640,8 +7656,10 @@ add_json_mpis(json_object *jso, ...)
             goto done;
         }
         if (!json_add_hex(jso, name, val->mpi, val->len)) {
+            /* LCOV_EXCL_START */
             ret = RNP_ERROR_OUT_OF_MEMORY;
             goto done;
+            /* LCOV_EXCL_END */
         }
     }
     ret = RNP_SUCCESS;
@@ -7762,8 +7780,10 @@ add_json_sig_mpis(json_object *jso, const pgp_signature_t *sig)
             return RNP_ERROR_BAD_PARAMETERS;
         }
     } catch (const std::exception &e) {
+        /* LCOV_EXCL_START */
         RNP_LOG("%s", e.what());
         return RNP_ERROR_OUT_OF_MEMORY;
+        /* LCOV_EXCL_END */
     }
     switch (sig->palg) {
     case PGP_PKA_RSA:
@@ -7874,25 +7894,25 @@ add_json_subsig(json_object *jso, bool is_sub, uint32_t flags, const pgp_subsig_
 {
     // userid (if applicable)
     if (!is_sub && !json_add(jso, "userid", (int) subsig->uid)) {
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
     // trust
     json_object *jsotrust = json_object_new_object();
     if (!jsotrust || !json_add(jso, "trust", jsotrust)) {
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
     // trust level and amount
     if (!json_add(jsotrust, "level", (int) subsig->trustlevel) ||
         !json_add(jsotrust, "amount", (int) subsig->trustamount)) {
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
     // key flags (usage)
     if (!add_json_key_usage(jso, subsig->key_flags)) {
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
     // key flags (other)
     if (!add_json_key_flags(jso, subsig->key_flags)) {
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
     // preferences
     const pgp_user_prefs_t &prefs = subsig->prefs;
@@ -7901,36 +7921,36 @@ add_json_subsig(json_object *jso, bool is_sub, uint32_t flags, const pgp_subsig_
         json_object *jsoprefs = json_object_new_object();
         if (!jsoprefs || !json_add(jso, "preferences", jsoprefs) ||
             !add_json_user_prefs(jsoprefs, prefs)) {
-            return RNP_ERROR_OUT_OF_MEMORY;
+            return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
         }
     }
     const pgp_signature_t *sig = &subsig->sig;
     // version
     if (!json_add(jso, "version", (int) sig->version)) {
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
     // signature type
     auto type = id_str_pair::lookup(sig_type_map, sig->type());
     if (!json_add(jso, "type", type)) {
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
     // signer key type
     const char *key_type = id_str_pair::lookup(pubkey_alg_map, sig->palg);
     if (!json_add(jso, "key type", key_type)) {
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
     // hash
     const char *hash = id_str_pair::lookup(hash_alg_map, sig->halg);
     if (!json_add(jso, "hash", hash)) {
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
     // creation time
     if (!json_add(jso, "creation time", (uint64_t) sig->creation())) {
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
     // expiration (seconds)
     if (!json_add(jso, "expiration", (uint64_t) sig->expiration())) {
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_START
     }
     // signer
     json_object *jsosigner = NULL;
@@ -7938,7 +7958,7 @@ add_json_subsig(json_object *jso, bool is_sub, uint32_t flags, const pgp_subsig_
     if (sig->has_keyid()) {
         jsosigner = json_object_new_object();
         if (!jsosigner) {
-            return RNP_ERROR_OUT_OF_MEMORY;
+            return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
         }
         char         keyid[PGP_KEY_ID_SIZE * 2 + 1];
         pgp_key_id_t signer = sig->keyid();
@@ -7946,8 +7966,10 @@ add_json_subsig(json_object *jso, bool is_sub, uint32_t flags, const pgp_subsig_
             return RNP_ERROR_GENERIC;
         }
         if (!json_add(jsosigner, "keyid", keyid)) {
+            /* LCOV_EXCL_START */
             json_object_put(jsosigner);
             return RNP_ERROR_OUT_OF_MEMORY;
+            /* LCOV_EXCL_END */
         }
     }
     json_object_object_add(jso, "signer", jsosigner);
@@ -7956,7 +7978,7 @@ add_json_subsig(json_object *jso, bool is_sub, uint32_t flags, const pgp_subsig_
     if (flags & RNP_JSON_SIGNATURE_MPIS) {
         jsompis = json_object_new_object();
         if (!jsompis) {
-            return RNP_ERROR_OUT_OF_MEMORY;
+            return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
         }
         rnp_result_t tmpret;
         if ((tmpret = add_json_sig_mpis(jsompis, sig))) {
@@ -7979,11 +8001,11 @@ key_to_json(json_object *jso, rnp_key_handle_t handle, uint32_t flags)
         return RNP_ERROR_BAD_PARAMETERS;
     }
     if (!json_add(jso, "type", str)) {
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
     // length
     if (!json_add(jso, "length", (int) key->material().bits())) {
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
     // curve / alg-specific items
     switch (key->alg()) {
@@ -8000,7 +8022,7 @@ key_to_json(json_object *jso, rnp_key_handle_t handle, uint32_t flags)
         }
         if (!json_add(jso, "kdf hash", hash_name) ||
             !json_add(jso, "key wrap cipher", cipher_name)) {
-            return RNP_ERROR_OUT_OF_MEMORY;
+            return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
         }
     }
         FALLTHROUGH_STATEMENT;
@@ -8012,7 +8034,7 @@ key_to_json(json_object *jso, rnp_key_handle_t handle, uint32_t flags)
             return RNP_ERROR_BAD_PARAMETERS;
         }
         if (!json_add(jso, "curve", curve_name)) {
-            return RNP_ERROR_OUT_OF_MEMORY;
+            return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
         }
     } break;
 #if defined(ENABLE_CRYPTO_REFRESH)
@@ -8058,7 +8080,7 @@ key_to_json(json_object *jso, rnp_key_handle_t handle, uint32_t flags)
         return RNP_ERROR_GENERIC;
     }
     if (!json_add(jso, "keyid", keyid)) {
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
     // fingerprint
     char fpr[PGP_FINGERPRINT_HEX_SIZE] = {0};
@@ -8066,7 +8088,7 @@ key_to_json(json_object *jso, rnp_key_handle_t handle, uint32_t flags)
         return RNP_ERROR_GENERIC;
     }
     if (!json_add(jso, "fingerprint", fpr)) {
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
     // grip
     char grip[PGP_KEY_GRIP_SIZE * 2 + 1];
@@ -8074,33 +8096,33 @@ key_to_json(json_object *jso, rnp_key_handle_t handle, uint32_t flags)
         return RNP_ERROR_GENERIC;
     }
     if (!json_add(jso, "grip", grip)) {
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
     // revoked
     if (!json_add(jso, "revoked", key->revoked())) {
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
     // creation time
     if (!json_add(jso, "creation time", (uint64_t) key->creation())) {
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
     // expiration
     if (!json_add(jso, "expiration", (uint64_t) key->expiration())) {
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
     // key flags (usage)
     if (!add_json_key_usage(jso, key->flags())) {
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
     // key flags (other)
     if (!add_json_key_flags(jso, key->flags())) {
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
     // parent / subkeys
     if (key->is_primary()) {
         json_object *jsosubkeys_arr = json_object_new_array();
         if (!jsosubkeys_arr || !json_add(jso, "subkey grips", jsosubkeys_arr)) {
-            return RNP_ERROR_OUT_OF_MEMORY;
+            return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
         }
         for (auto &subfp : key->subkey_fps()) {
             const pgp_key_grip_t *subgrip = rnp_get_grip_by_fp(handle->ffi, subfp);
@@ -8111,7 +8133,7 @@ key_to_json(json_object *jso, rnp_key_handle_t handle, uint32_t flags)
                 return RNP_ERROR_GENERIC;
             }
             if (!json_array_add(jsosubkeys_arr, grip)) {
-                return RNP_ERROR_OUT_OF_MEMORY;
+                return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
             }
         }
     } else if (key->has_primary_fp()) {
@@ -8121,24 +8143,24 @@ key_to_json(json_object *jso, rnp_key_handle_t handle, uint32_t flags)
                 return RNP_ERROR_GENERIC;
             }
             if (!json_add(jso, "primary key grip", grip)) {
-                return RNP_ERROR_OUT_OF_MEMORY;
+                return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
             }
         }
     }
     // public
     json_object *jsopublic = json_object_new_object();
     if (!jsopublic || !json_add(jso, "public key", jsopublic)) {
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
     bool have_sec = handle->sec != NULL;
     bool have_pub = handle->pub != NULL;
     if (!json_add(jsopublic, "present", have_pub)) {
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
     if (flags & RNP_JSON_PUBLIC_MPIS) {
         json_object *jsompis = json_object_new_object();
         if (!jsompis || !json_add(jsopublic, "mpis", jsompis)) {
-            return RNP_ERROR_OUT_OF_MEMORY;
+            return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
         }
         rnp_result_t tmpret;
         if ((tmpret = add_json_public_mpis(jsompis, key))) {
@@ -8149,7 +8171,7 @@ key_to_json(json_object *jso, rnp_key_handle_t handle, uint32_t flags)
     json_object *jsosecret = json_object_new_object();
     if (!jsosecret || !json_add(jso, "secret key", jsosecret) ||
         !json_add(jsosecret, "present", have_sec)) {
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
     if (have_sec) {
         bool locked = handle->sec->is_locked();
@@ -8159,7 +8181,7 @@ key_to_json(json_object *jso, rnp_key_handle_t handle, uint32_t flags)
             } else {
                 json_object *jsompis = json_object_new_object();
                 if (!jsompis || !json_add(jsosecret, "mpis", jsompis)) {
-                    return RNP_ERROR_OUT_OF_MEMORY;
+                    return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
                 }
                 rnp_result_t tmpret;
                 if ((tmpret = add_json_secret_mpis(jsompis, handle->sec))) {
@@ -8169,18 +8191,18 @@ key_to_json(json_object *jso, rnp_key_handle_t handle, uint32_t flags)
         }
         if (!json_add(jsosecret, "locked", locked) ||
             !json_add(jsosecret, "protected", handle->sec->is_protected())) {
-            return RNP_ERROR_OUT_OF_MEMORY;
+            return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
         }
     }
     // userids
     if (key->is_primary()) {
         json_object *jsouids_arr = json_object_new_array();
         if (!jsouids_arr || !json_add(jso, "userids", jsouids_arr)) {
-            return RNP_ERROR_OUT_OF_MEMORY;
+            return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
         }
         for (size_t i = 0; i < key->uid_count(); i++) {
             if (!json_array_add(jsouids_arr, key->get_uid(i).str.c_str())) {
-                return RNP_ERROR_OUT_OF_MEMORY;
+                return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
             }
         }
     }
@@ -8188,13 +8210,15 @@ key_to_json(json_object *jso, rnp_key_handle_t handle, uint32_t flags)
     if (flags & RNP_JSON_SIGNATURES) {
         json_object *jsosigs_arr = json_object_new_array();
         if (!jsosigs_arr || !json_add(jso, "signatures", jsosigs_arr)) {
-            return RNP_ERROR_OUT_OF_MEMORY;
+            return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
         }
         for (size_t i = 0; i < key->sig_count(); i++) {
             json_object *jsosig = json_object_new_object();
             if (!jsosig || json_object_array_add(jsosigs_arr, jsosig)) {
+                /* LCOV_EXCL_START */
                 json_object_put(jsosig);
                 return RNP_ERROR_OUT_OF_MEMORY;
+                /* LCOV_EXCL_END */
             }
             rnp_result_t tmpret;
             if ((tmpret =
@@ -8215,7 +8239,7 @@ try {
     }
     json_object *jso = json_object_new_object();
     if (!jso) {
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
     rnp::JSONObject jsowrap(jso);
     rnp_result_t    ret = RNP_ERROR_GENERIC;
@@ -8228,7 +8252,7 @@ try {
     }
     *result = strdup(*result);
     if (!*result) {
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
     return RNP_SUCCESS;
 }
@@ -8258,8 +8282,10 @@ rnp_dump_src_to_json(pgp_source_t *src, uint32_t flags, char **result)
     }
     *result = strdup(*result);
     if (!*result) {
+        /* LCOV_EXCL_START */
         ret = RNP_ERROR_OUT_OF_MEMORY;
         goto done;
+        /* LCOV_EXCL_END */
     }
 
     ret = RNP_SUCCESS;
@@ -8521,7 +8547,7 @@ try {
     size_t      len = strlen(msg);
     *contents = (char *) calloc(1, len + 1);
     if (!*contents) {
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
     memcpy(*contents, msg, len);
     return RNP_SUCCESS;