diff --git a/scrub-2.6.1-analyzer-fixes.patch b/scrub-2.6.1-analyzer-fixes.patch
new file mode 100644
index 0000000..350c2ab
--- /dev/null
+++ b/scrub-2.6.1-analyzer-fixes.patch
@@ -0,0 +1,31 @@
+diff -up scrub-2.6.1/src/fillfile.c.analyzer-fixes scrub-2.6.1/src/fillfile.c
+--- scrub-2.6.1/src/fillfile.c.analyzer-fixes	2021-03-18 10:42:37.201845461 -0400
++++ scrub-2.6.1/src/fillfile.c	2021-03-18 10:43:38.358151439 -0400
+@@ -131,10 +131,13 @@ refill_init(struct memstruct **mpp, refi
+ 
+     if (!(mp = malloc(sizeof(struct memstruct))))
+         goto nomem;
+-    if (!(mp->buf = malloc(memsize)))
++    if (!(mp->buf = malloc(memsize))) {
++        free(mp);
+         goto nomem;
++    }
+     mp->size = memsize;
+     mp->refill = refill;
++    mp->thd = 0;
+ #if WITH_PTHREADS
+     if (!no_threads) {
+         if ((mp->err = pthread_create(&mp->thd, NULL, refill_thread, mp))) {
+diff -up scrub-2.6.1/src/scrub.c.analyzer-fixes scrub-2.6.1/src/scrub.c
+diff -up scrub-2.6.1/src/sig.c.analyzer-fixes scrub-2.6.1/src/sig.c
+--- scrub-2.6.1/src/sig.c.analyzer-fixes	2021-03-18 10:44:20.715363360 -0400
++++ scrub-2.6.1/src/sig.c	2021-03-18 10:44:54.319531489 -0400
+@@ -74,7 +74,7 @@ writesig(char *path)
+         goto nomem;
+     if ((fd = open(path, O_RDWR)) < 0)
+         goto error;
+-    if ((n = read_all(fd, buf, blocksize)) < 0)
++    if (read_all(fd, buf, blocksize) < 0)
+         goto error;
+     memcpy(buf, SCRUB_MAGIC, sizeof(SCRUB_MAGIC));
+     if (lseek(fd, 0, SEEK_SET) < 0)
diff --git a/scrub.spec b/scrub.spec
index c15cd5d..5504b05 100644
--- a/scrub.spec
+++ b/scrub.spec
@@ -1,6 +1,6 @@
 Name:		scrub
 Version:	2.6.1
-Release:	1%{?dist}
+Release:	2%{?dist}
 Summary:	Disk scrubbing program
 License:	GPLv2+
 URL:		https://github.com/chaos/scrub/
@@ -11,6 +11,8 @@ Patch0:		scrub-2.6.1-symlinks-to-block-device.patch
 Patch1:		scrub-2.6.1-use-libgcrypt.patch
 Patch2:		scrub-2.6.1-extentonly.patch
 Patch3:		scrub-2.5.2-test-use-power-2-filesizes.patch
+# https://github.com/chaos/scrub/commit/864a454f16ac3e47103064b0e4fe3a9111593e49
+Patch4:		scrub-2.6.1-analyzer-fixes.patch
 BuildRequires:	make
 BuildRequires:	gcc
 BuildRequires:	libgcrypt-devel
@@ -31,6 +33,7 @@ the file system is full, then scrubbed as in 2).
 %patch1 -p1 -b .libgcrypt
 %patch2 -p1 -b .extent-only
 %patch3 -p1 -b .test-use-power-2-filesizes
+%patch4 -p1 -b .analyzer-fixes
 autoreconf -ifv --include=config
 
 %build
@@ -48,6 +51,9 @@ autoreconf -ifv --include=config
 %{_mandir}/man1/scrub.1*
 
 %changelog
+* Thu Mar 18 2021 Tom Callaway <spot@fedoraproject.org> - 2.6.1-2
+- apply analyzer fixes from upstream
+
 * Wed Feb 24 2021 Tom Callaway <spot@fedoraproject.org> - 2.6.1-1
 - update to 2.6.1
 - update URLs