diff --git a/lib/includes/spdylay/spdylay.h b/lib/includes/spdylay/spdylay.h
index e03f55e..08322a4 100644
--- a/lib/includes/spdylay/spdylay.h
+++ b/lib/includes/spdylay/spdylay.h
@@ -1126,7 +1126,13 @@ typedef struct {
  * The :member:`spdylay_session_callbacks.send_callback` must be
  * specified.  If the application code uses `spdylay_session_recv()`,
  * the :member:`spdylay_session_callbacks.recv_callback` must be
- * specified. The other members of |callbacks| can be ``NULL``.
+ * specified. The other members of |callbacks| can be ``NULL``.  To
+ * use CREDENTIAL frame, specify :macro:`SPDYLAY_PROTO_SPDY3` in
+ * |version| and specify
+ * :member:`spdylay_session_callbacks.get_credential_ncerts`,
+ * :member:`spdylay_session_callbacks.get_credential_cert` and
+ * :member:`spdylay_session_callbacks.get_credential_proof`.  See also
+ * `spdylay_session_set_initial_client_cert_origin()`.
  *
  * This function returns 0 if it succeeds, or one of the following
  * negative error codes:
diff --git a/lib/spdylay_map.c b/lib/spdylay_map.c
index 8fb8dc4..eef9165 100644
--- a/lib/spdylay_map.c
+++ b/lib/spdylay_map.c
@@ -105,6 +105,7 @@ static spdylay_map_entry* insert_recur(spdylay_map_entry *entry,
     entry = spdylay_map_entry_new(key, val);
     if(entry == NULL) {
       *error = SPDYLAY_ERR_NOMEM;
+      return NULL;
     }
   } else if(key == entry->key) {
     *error = SPDYLAY_ERR_INVALID_ARGUMENT;
diff --git a/lib/spdylay_session.c b/lib/spdylay_session.c
index 52199be..40c879d 100644
--- a/lib/spdylay_session.c
+++ b/lib/spdylay_session.c
@@ -811,7 +811,7 @@ static int spdylay_session_get_credential_cert(spdylay_session *session,
   return 0;
  fail:
   for(j = 0; j < i; ++j) {
-    free(certs[i].data);
+    free(certs[j].data);
   }
   free(certs);
   return SPDYLAY_ERR_NOMEM;
@@ -865,6 +865,7 @@ int spdylay_session_prep_credential(spdylay_session *session,
         rv = spdylay_session_add_frame(session, SPDYLAY_CTRL, frame, NULL);
         if(rv != 0) {
           spdylay_frame_credential_free(&frame->credential);
+          free(frame);
           return rv;
         }
         return SPDYLAY_ERR_CREDENTIAL_PENDING;
diff --git a/tests/spdylay_session_test.c b/tests/spdylay_session_test.c
index 355dabd..b6be370 100644
--- a/tests/spdylay_session_test.c
+++ b/tests/spdylay_session_test.c
@@ -28,10 +28,10 @@
 
 #include <stdio.h>
 #include <assert.h>
-#include <arpa/inet.h>
 
 #include "spdylay_session.h"
 #include "spdylay_stream.h"
+#include "spdylay_net.h"
 
 #define OB_CTRL(ITEM) spdylay_outbound_item_get_ctrl_frame(ITEM)
 #define OB_CTRL_TYPE(ITEM) spdylay_outbound_item_get_ctrl_frame_type(ITEM)