diff --git a/configure.ac b/configure.ac
index f1811205f..837d018e3 100644
--- a/configure.ac
+++ b/configure.ac
@@ -656,11 +656,8 @@ AC_PROG_SED
 # See if we support thread-local storage.
 LXC_CHECK_TLS
 
-if test "x$GCC" = "xyes"; then
-	CFLAGS="$CFLAGS -Wall"
-	if test "x$enable_werror" = "xyes"; then
-		CFLAGS="$CFLAGS -Werror"
-	fi
+if test "x$enable_werror" = "xyes"; then
+	CFLAGS="$CFLAGS -Werror -Wvla -std=gnu11"
 fi
 
 # Files requiring some variable expansion
diff --git a/src/include/ifaddrs.c b/src/include/ifaddrs.c
index 1f954dd7d..3fbe170d6 100644
--- a/src/include/ifaddrs.c
+++ b/src/include/ifaddrs.c
@@ -575,7 +575,15 @@ int getifaddrs(struct ifaddrs **ifap)
     }
 
     unsigned l_numLinks = countLinks(l_socket, l_linkResults) + countLinks(l_socket, l_addrResults);
-    struct ifaddrs *l_links[l_numLinks];
+    struct ifaddrs **l_links;
+    l_links = malloc(l_numLinks * sizeof(struct ifaddrs *));
+    if (!l_links)
+    {
+        close(l_socket);
+        freeResultList(l_linkResults);
+        return -1;
+    }
+
     memset(l_links, 0, l_numLinks * sizeof(struct ifaddrs *));
 
     interpret(l_socket, l_linkResults, l_links, ifap);
@@ -583,6 +591,7 @@ int getifaddrs(struct ifaddrs **ifap)
 
     freeResultList(l_linkResults);
     freeResultList(l_addrResults);
+    free(l_links);
     close(l_socket);
     return 0;
 }
diff --git a/src/include/lxcmntent.c b/src/include/lxcmntent.c
index dcb34a2f6..53f5256a1 100644
--- a/src/include/lxcmntent.c
+++ b/src/include/lxcmntent.c
@@ -18,6 +18,7 @@
    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
  */
 
+#include <alloca.h>
 #include <stdio.h>
 #include <string.h>
 #include <mntent.h>
@@ -153,7 +154,10 @@ FILE *setmntent (const char *file, const char *mode)
     /* Extend the mode parameter with "c" to disable cancellation in the
     I/O functions and "e" to set FD_CLOEXEC. */
     size_t modelen = strlen (mode);
-    char newmode[modelen + 3];
+    char *newmode;
+
+    newmode = alloca(modelen + 3);
+
     memcpy (newmode, mode, modelen);
     memcpy (newmode + modelen, "ce", 3);
     FILE *result = fopen (file, newmode);
diff --git a/src/lxc/cgroups/cgfsng.c b/src/lxc/cgroups/cgfsng.c
index 935b868b9..311a1dfce 100644
--- a/src/lxc/cgroups/cgfsng.c
+++ b/src/lxc/cgroups/cgfsng.c
@@ -274,14 +274,13 @@ static uint32_t *lxc_cpumask(char *buf, size_t nbits)
 	char *token;
 	size_t arrlen;
 	uint32_t *bitarr;
-	char *saveptr = NULL;
 
 	arrlen = BITS_TO_LONGS(nbits);
 	bitarr = calloc(arrlen, sizeof(uint32_t));
 	if (!bitarr)
 		return NULL;
 
-	for (; (token = strtok_r(buf, ",", &saveptr)); buf = NULL) {
+	lxc_iterate_parts(token, buf, ",") {
 		errno = 0;
 		unsigned end, start;
 		char *range;
@@ -728,7 +727,7 @@ static char **cg_hybrid_get_controllers(char **klist, char **nlist, char *line,
 	 */
 	int i;
 	char *dup, *p2, *tok;
-	char *p = line, *saveptr = NULL, *sep = ",";
+	char *p = line, *sep = ",";
 	char **aret = NULL;
 
 	for (i = 0; i < 4; i++) {
@@ -755,16 +754,17 @@ static char **cg_hybrid_get_controllers(char **klist, char **nlist, char *line,
 	*p2 = '\0';
 
 	if (type == CGROUP_SUPER_MAGIC) {
-		/* strdup() here for v1 hierarchies. Otherwise strtok_r() will
-		 * destroy mountpoints such as "/sys/fs/cgroup/cpu,cpuacct".
+		/* strdup() here for v1 hierarchies. Otherwise
+		 * lxc_iterate_parts() will destroy mountpoints such as
+		 * "/sys/fs/cgroup/cpu,cpuacct".
 		 */
 		dup = strdup(p);
 		if (!dup)
 			return NULL;
 
-		for (tok = strtok_r(dup, sep, &saveptr); tok;
-		     tok = strtok_r(NULL, sep, &saveptr))
+		lxc_iterate_parts(tok, dup, sep) {
 			must_append_controller(klist, nlist, &aret, tok);
+		}
 
 		free(dup);
 	}
@@ -786,15 +786,14 @@ static char **cg_unified_make_empty_controller(void)
 static char **cg_unified_get_controllers(const char *file)
 {
 	char *buf, *tok;
-	char *saveptr = NULL, *sep = " \t\n";
+	char *sep = " \t\n";
 	char **aret = NULL;
 
 	buf = read_file(file);
 	if (!buf)
 		return NULL;
 
-	for (tok = strtok_r(buf, sep, &saveptr); tok;
-	     tok = strtok_r(NULL, sep, &saveptr)) {
+	lxc_iterate_parts(tok, buf, sep) {
 		int newentry;
 		char *copy;
 
@@ -878,7 +877,7 @@ static char *copy_to_eol(char *p)
  */
 static bool controller_in_clist(char *cgline, char *c)
 {
-	char *tok, *saveptr = NULL, *eol, *tmp;
+	char *tok, *eol, *tmp;
 	size_t len;
 
 	eol = strchr(cgline, ':');
@@ -890,8 +889,7 @@ static bool controller_in_clist(char *cgline, char *c)
 	memcpy(tmp, cgline, len);
 	tmp[len] = '\0';
 
-	for (tok = strtok_r(tmp, ",", &saveptr); tok;
-	     tok = strtok_r(NULL, ",", &saveptr)) {
+	lxc_iterate_parts(tok, tmp, ",") {
 		if (strcmp(tok, c) == 0)
 			return true;
 	}
@@ -955,7 +953,7 @@ static int get_existing_subsystems(char ***klist, char ***nlist)
 		return -1;
 
 	while (getline(&line, &len, f) != -1) {
-		char *p, *p2, *tok, *saveptr = NULL;
+		char *p, *p2, *tok;
 		p = strchr(line, ':');
 		if (!p)
 			continue;
@@ -977,8 +975,7 @@ static int get_existing_subsystems(char ***klist, char ***nlist)
 			continue;
 		}
 
-		for (tok = strtok_r(p, ",", &saveptr); tok;
-		     tok = strtok_r(NULL, ",", &saveptr)) {
+		lxc_iterate_parts(tok, p, ",") {
 			if (strncmp(tok, "name=", 5) == 0)
 				must_append_string(nlist, tok);
 			else
@@ -2531,13 +2528,13 @@ static bool cg_init(struct cgroup_ops *ops)
 	tmp = lxc_global_config_value("lxc.cgroup.use");
 	if (tmp) {
 		char *chop, *cur, *pin;
-		char *saveptr = NULL;
 
 		pin = must_copy_string(tmp);
 		chop = pin;
 
-		for (; (cur = strtok_r(chop, ",", &saveptr)); chop = NULL)
+		lxc_iterate_parts(cur, chop, ",") {
 			must_append_string(&ops->cgroup_use, cur);
+		}
 
 		free(pin);
 	}
diff --git a/src/lxc/conf.c b/src/lxc/conf.c
index f5b94b091..ff9bd091b 100644
--- a/src/lxc/conf.c
+++ b/src/lxc/conf.c
@@ -1888,7 +1888,6 @@ static void parse_mntopt(char *opt, unsigned long *flags, char **data, size_t si
 int parse_mntopts(const char *mntopts, unsigned long *mntflags, char **mntdata)
 {
 	char *data, *p, *s;
-	char *saveptr = NULL;
 	size_t size;
 
 	*mntdata = NULL;
@@ -1909,7 +1908,7 @@ int parse_mntopts(const char *mntopts, unsigned long *mntflags, char **mntdata)
 	}
 	*data = 0;
 
-	for (; (p = strtok_r(s, ",", &saveptr)); s = NULL)
+	lxc_iterate_parts(p, s, ",")
 		parse_mntopt(p, mntflags, &data, size);
 
 	if (*data)
@@ -1942,7 +1941,6 @@ static void parse_propagationopt(char *opt, unsigned long *flags)
 static int parse_propagationopts(const char *mntopts, unsigned long *pflags)
 {
 	char *p, *s;
-	char *saveptr = NULL;
 
 	if (!mntopts)
 		return 0;
@@ -1954,7 +1952,7 @@ static int parse_propagationopts(const char *mntopts, unsigned long *pflags)
 	}
 
 	*pflags = 0L;
-	for (; (p = strtok_r(s, ",", &saveptr)); s = NULL)
+	lxc_iterate_parts(p, s, ",")
 		parse_propagationopt(p, pflags);
 	free(s);
 
diff --git a/src/lxc/confile.c b/src/lxc/confile.c
index 456cd4c2e..e05ba9fcf 100644
--- a/src/lxc/confile.c
+++ b/src/lxc/confile.c
@@ -1007,9 +1007,9 @@ static int set_config_monitor_signal_pdeath(const char *key, const char *value,
 static int set_config_group(const char *key, const char *value,
 			    struct lxc_conf *lxc_conf, void *data)
 {
-	char *groups, *groupptr, *sptr, *token;
+	char *groups, *token;
 	struct lxc_list *grouplist;
-	int ret = -1;
+	int ret = 0;
 
 	if (lxc_config_value_empty(value))
 		return lxc_clear_groups(lxc_conf);
@@ -1021,20 +1021,17 @@ static int set_config_group(const char *key, const char *value,
 	/* In case several groups are specified in a single line split these
 	 * groups in a single element for the list.
 	 */
-	for (groupptr = groups;; groupptr = NULL) {
-		token = strtok_r(groupptr, " \t", &sptr);
-		if (!token) {
-			ret = 0;
+	lxc_iterate_parts(token, groups, " \t") {
+		grouplist = malloc(sizeof(*grouplist));
+		if (!grouplist) {
+			ret = -1;
 			break;
 		}
 
-		grouplist = malloc(sizeof(*grouplist));
-		if (!grouplist)
-			break;
-
 		grouplist->elem = strdup(token);
 		if (!grouplist->elem) {
 			free(grouplist);
+			ret = -1;
 			break;
 		}
 
@@ -1678,7 +1675,7 @@ static int set_config_mount_fstab(const char *key, const char *value,
 static int set_config_mount_auto(const char *key, const char *value,
 				 struct lxc_conf *lxc_conf, void *data)
 {
-	char *autos, *autoptr, *sptr, *token;
+	char *autos, *token;
 	int i;
 	int ret = -1;
 	static struct {
@@ -1726,15 +1723,9 @@ static int set_config_mount_auto(const char *key, const char *value,
 	if (!autos)
 		return -1;
 
-	for (autoptr = autos;; autoptr = NULL) {
+	lxc_iterate_parts(token, autos, " \t") {
 		bool is_shmounts = false;
 
-		token = strtok_r(autoptr, " \t", &sptr);
-		if (!token) {
-			ret = 0;
-			break;
-		}
-
 		for (i = 0; allowed_auto_mounts[i].token; i++) {
 			if (!strcmp(allowed_auto_mounts[i].token, token))
 				break;
@@ -1748,7 +1739,7 @@ static int set_config_mount_auto(const char *key, const char *value,
 
 		if (!allowed_auto_mounts[i].token) {
 			ERROR("Invalid filesystem to automount \"%s\"", token);
-			break;
+			goto on_error;
 		}
 
 		lxc_conf->auto_mounts &= ~allowed_auto_mounts[i].mask;
@@ -1757,23 +1748,27 @@ static int set_config_mount_auto(const char *key, const char *value,
 			lxc_conf->shmount.path_host = strdup(token + (sizeof("shmounts:") - 1));
 			if (!lxc_conf->shmount.path_host) {
 				SYSERROR("Failed to copy shmounts host path");
-				break;
+				goto on_error;
 			}
 
 			if (strcmp(lxc_conf->shmount.path_host, "") == 0) {
 				ERROR("Invalid shmounts path: empty");
-				break;
+				goto on_error;
 			}
 
 			lxc_conf->shmount.path_cont = strdup("/dev/.lxc-mounts");
 			if(!lxc_conf->shmount.path_cont) {
 				SYSERROR("Failed to copy shmounts container path");
-				break;
+				goto on_error;
 			}
 		}
 	}
 
+	ret = 0;
+
+on_error:
 	free(autos);
+
 	return ret;
 }
 
@@ -1809,7 +1804,7 @@ int add_elem_to_mount_list(const char *value, struct lxc_conf *lxc_conf) {
 static int set_config_cap_keep(const char *key, const char *value,
 			       struct lxc_conf *lxc_conf, void *data)
 {
-	char *keepcaps, *keepptr, *sptr, *token;
+	char *keepcaps, *token;
 	struct lxc_list *keeplist;
 	int ret = -1;
 
@@ -1823,29 +1818,26 @@ static int set_config_cap_keep(const char *key, const char *value,
 	/* In case several capability keep is specified in a single line
 	 * split these caps in a single element for the list.
 	 */
-	for (keepptr = keepcaps;; keepptr = NULL) {
-		token = strtok_r(keepptr, " \t", &sptr);
-		if (!token) {
-			ret = 0;
-			break;
-		}
-
+	lxc_iterate_parts(token, keepcaps, " \t") {
 		if (!strcmp(token, "none"))
 			lxc_clear_config_keepcaps(lxc_conf);
 
 		keeplist = malloc(sizeof(*keeplist));
 		if (!keeplist)
-			break;
+			goto on_error;
 
 		keeplist->elem = strdup(token);
 		if (!keeplist->elem) {
 			free(keeplist);
-			break;
+			goto on_error;
 		}
 
 		lxc_list_add_tail(&lxc_conf->keepcaps, keeplist);
 	}
 
+	ret = 0;
+
+on_error:
 	free(keepcaps);
 
 	return ret;
@@ -1854,7 +1846,7 @@ static int set_config_cap_keep(const char *key, const char *value,
 static int set_config_cap_drop(const char *key, const char *value,
 			       struct lxc_conf *lxc_conf, void *data)
 {
-	char *dropcaps, *dropptr, *sptr, *token;
+	char *dropcaps, *token;
 	struct lxc_list *droplist;
 	int ret = -1;
 
@@ -1868,26 +1860,23 @@ static int set_config_cap_drop(const char *key, const char *value,
 	/* In case several capability drop is specified in a single line
 	 * split these caps in a single element for the list.
 	 */
-	for (dropptr = dropcaps;; dropptr = NULL) {
-		token = strtok_r(dropptr, " \t", &sptr);
-		if (!token) {
-			ret = 0;
-			break;
-		}
-
+	lxc_iterate_parts(token, dropcaps, " \t") {
 		droplist = malloc(sizeof(*droplist));
 		if (!droplist)
-			break;
+			goto on_error;
 
 		droplist->elem = strdup(token);
 		if (!droplist->elem) {
 			free(droplist);
-			break;
+			goto on_error;
 		}
 
 		lxc_list_add_tail(&lxc_conf->caps, droplist);
 	}
 
+        ret = 0;
+
+on_error:
 	free(dropcaps);
 
 	return ret;
@@ -2186,7 +2175,7 @@ static int set_config_uts_name(const char *key, const char *value,
 static int set_config_namespace_clone(const char *key, const char *value,
 				      struct lxc_conf *lxc_conf, void *data)
 {
-	char *ns, *nsptr, *token;
+	char *ns, *token;
 	int cloneflag = 0;
 	char *saveptr = NULL;
 
@@ -2203,9 +2192,8 @@ static int set_config_namespace_clone(const char *key, const char *value,
 	ns = strdup(value);
 	if (!ns)
 		return -1;
-	nsptr = ns;
 
-	for (; (token = strtok_r(nsptr, " \t", &saveptr)); nsptr = NULL) {
+	lxc_iterate_parts(token, ns, " \t") {
 		token += lxc_char_left_gc(token, strlen(token));
 		token[lxc_char_right_gc(token, strlen(token))] = '\0';
 		cloneflag = lxc_namespace_2_cloneflag(token);
@@ -2223,7 +2211,7 @@ static int set_config_namespace_clone(const char *key, const char *value,
 static int set_config_namespace_keep(const char *key, const char *value,
 				     struct lxc_conf *lxc_conf, void *data)
 {
-	char *ns, *nsptr, *token;
+	char *ns, *token;
 	int cloneflag = 0;
 	char *saveptr = NULL;
 
@@ -2240,9 +2228,8 @@ static int set_config_namespace_keep(const char *key, const char *value,
 	ns = strdup(value);
 	if (!ns)
 		return -1;
-	nsptr = ns;
 
-	for (; (token = strtok_r(nsptr, " \t", &saveptr)); nsptr = NULL) {
+	lxc_iterate_parts(token, ns, " \t") {
 		token += lxc_char_left_gc(token, strlen(token));
 		token[lxc_char_right_gc(token, strlen(token))] = '\0';
 		cloneflag = lxc_namespace_2_cloneflag(token);
@@ -2541,7 +2528,7 @@ signed long lxc_config_parse_arch(const char *arch)
 
 int lxc_fill_elevated_privileges(char *flaglist, int *flags)
 {
-	char *token, *saveptr = NULL;
+	char *token;
 	int i, aflag;
 	struct {
 		const char *token;
@@ -2563,8 +2550,7 @@ int lxc_fill_elevated_privileges(char *flaglist, int *flags)
 		return 0;
 	}
 
-	token = strtok_r(flaglist, "|", &saveptr);
-	while (token) {
+	lxc_iterate_parts(token, flaglist, "|") {
 		aflag = -1;
 
 		for (i = 0; all_privs[i].token; i++)
@@ -2575,8 +2561,6 @@ int lxc_fill_elevated_privileges(char *flaglist, int *flags)
 			return -1;
 
 		*flags |= aflag;
-
-		token = strtok_r(NULL, "|", &saveptr);
 	}
 
 	return 0;
diff --git a/src/lxc/lxccontainer.c b/src/lxc/lxccontainer.c
index f1829cf8d..c5b515f60 100644
--- a/src/lxc/lxccontainer.c
+++ b/src/lxc/lxccontainer.c
@@ -759,7 +759,6 @@ static char **split_init_cmd(const char *incmd)
 	char *copy, *p;
 	char **argv;
 	int nargs = 0;
-	char *saveptr = NULL;
 
 	if (!incmd)
 		return NULL;
@@ -775,7 +774,7 @@ static char **split_init_cmd(const char *incmd)
 	} while (!argv);
 
 	argv[0] = NULL;
-	for (; (p = strtok_r(copy, " ", &saveptr)); copy = NULL)
+	lxc_iterate_parts(p, copy, " ")
 		push_arg(&argv, p, &nargs);
 
 	if (nargs == 0) {
diff --git a/src/lxc/namespace.c b/src/lxc/namespace.c
index 9512bfe5e..5b26d64ba 100644
--- a/src/lxc/namespace.c
+++ b/src/lxc/namespace.c
@@ -232,7 +232,7 @@ extern int lxc_namespace_2_std_identifiers(char *namespaces)
 
 int lxc_fill_namespace_flags(char *flaglist, int *flags)
 {
-	char *token, *saveptr = NULL;
+	char *token;
 	int aflag;
 
 	if (!flaglist) {
@@ -240,15 +240,12 @@ int lxc_fill_namespace_flags(char *flaglist, int *flags)
 		return -1;
 	}
 
-	token = strtok_r(flaglist, "|", &saveptr);
-	while (token) {
+	lxc_iterate_parts(token, flaglist, "|") {
 		aflag = lxc_namespace_2_cloneflag(token);
 		if (aflag < 0)
 			return -1;
 
 		*flags |= aflag;
-
-		token = strtok_r(NULL, "|", &saveptr);
 	}
 
 	return 0;
diff --git a/src/lxc/parse.c b/src/lxc/parse.c
index bc209347c..cd3110377 100644
--- a/src/lxc/parse.c
+++ b/src/lxc/parse.c
@@ -68,10 +68,9 @@ int lxc_file_for_each_line_mmap(const char *file, lxc_file_cb callback,
 				void *data)
 {
 	int fd;
-	char *buf, *chop, *line;
+	char *buf, *line;
 	struct stat st;
 	int ret = 0;
-	char *saveptr = NULL;
 
 	fd = open(file, O_RDONLY | O_CLOEXEC);
 	if (fd < 0)
@@ -94,7 +93,7 @@ int lxc_file_for_each_line_mmap(const char *file, lxc_file_cb callback,
 		return -1;
 	}
 
-	for (chop = buf; (line = strtok_r(chop, "\n\0", &saveptr)); chop = NULL) {
+	lxc_iterate_parts(line, buf, "\n\0") {
 		ret = callback(line, data);
 		if (ret) {
 			/* Callback rv > 0 means stop here callback rv < 0 means
diff --git a/src/lxc/state.c b/src/lxc/state.c
index 3ccbe583a..5afce9a6a 100644
--- a/src/lxc/state.c
+++ b/src/lxc/state.c
@@ -43,6 +43,7 @@
 #include "lxc.h"
 #include "monitor.h"
 #include "start.h"
+#include "utils.h"
 
 lxc_log_define(state, lxc);
 
@@ -78,16 +79,15 @@ lxc_state_t lxc_getstate(const char *name, const char *lxcpath)
 
 static int fillwaitedstates(const char *strstates, lxc_state_t *states)
 {
-	char *token, *saveptr = NULL;
-	char *strstates_dup = strdup(strstates);
+	char *token;
+	char *strstates_dup;
 	int state;
 
+	strstates_dup = strdup(strstates);
 	if (!strstates_dup)
 		return -1;
 
-	token = strtok_r(strstates_dup, "|", &saveptr);
-	while (token) {
-
+	lxc_iterate_parts(token, strstates_dup, "|") {
 		state = lxc_str2state(token);
 		if (state < 0) {
 			free(strstates_dup);
@@ -95,8 +95,6 @@ static int fillwaitedstates(const char *strstates, lxc_state_t *states)
 		}
 
 		states[state] = 1;
-
-		token = strtok_r(NULL, "|", &saveptr);
 	}
 	free(strstates_dup);
 	return 0;
diff --git a/src/lxc/storage/storage.c b/src/lxc/storage/storage.c
index 95e664800..3e64a4a62 100644
--- a/src/lxc/storage/storage.c
+++ b/src/lxc/storage/storage.c
@@ -567,15 +567,13 @@ struct lxc_storage *storage_create(const char *dest, const char *type,
 	/* -B lvm,dir */
 	if (strchr(type, ',')) {
 		char *dup, *token;
-		char *saveptr = NULL;
 		size_t len;
 
 		len = strlen(type);
 		dup = alloca(len + 1);
 		(void)strlcpy(dup, type, len + 1);
 
-		for (token = strtok_r(dup, ",", &saveptr); token;
-		     token = strtok_r(NULL, ",", &saveptr)) {
+		lxc_iterate_parts(token, dup, ",") {
 			bdev = do_storage_create(dest, token, cname, specs);
 			if (bdev)
 				return bdev;
diff --git a/src/lxc/tools/lxc_autostart.c b/src/lxc/tools/lxc_autostart.c
index 96fce421d..5d0445258 100644
--- a/src/lxc/tools/lxc_autostart.c
+++ b/src/lxc/tools/lxc_autostart.c
@@ -194,8 +194,6 @@ static struct lxc_list *accumulate_list(char *input, char *delimiter,
 static struct lxc_list *get_list(char *input, char *delimiter)
 {
 	char *workstr = NULL;
-	char *workptr = NULL;
-	char *sptr = NULL;
 	char *token = NULL;
 	struct lxc_list *worklist;
 	struct lxc_list *workstr_list;
@@ -212,11 +210,7 @@ static struct lxc_list *get_list(char *input, char *delimiter)
 		return NULL;
 	}
 
-	for (workptr = workstr;; workptr = NULL) {
-		token = strtok_r(workptr, delimiter, &sptr);
-		if (!token)
-			break;
-
+	lxc_iterate_parts(token, workstr, delimiter) {
 		worklist = malloc(sizeof(*worklist));
 		if (!worklist)
 			break;
diff --git a/src/lxc/tools/lxc_destroy.c b/src/lxc/tools/lxc_destroy.c
index f7bd06d87..35514689f 100644
--- a/src/lxc/tools/lxc_destroy.c
+++ b/src/lxc/tools/lxc_destroy.c
@@ -209,10 +209,8 @@ static bool do_destroy_with_snapshots(struct lxc_container *c)
 	char *buf = NULL;
 	char *lxcpath = NULL;
 	char *lxcname = NULL;
-	char *scratch = NULL;
 	int fd;
 	int ret;
-	int counter = 0;
 
 	/* Destroy clones. */
 	ret = snprintf(path, MAXPATHLEN, "%s/%s/lxc_snapshots", c->config_path, c->name);
@@ -244,15 +242,10 @@ static bool do_destroy_with_snapshots(struct lxc_container *c)
 		}
 		close(fd);
 
-		while ((lxcpath = strtok_r(!counter ? buf : NULL, "\n", &scratch))) {
-			if (!(lxcname = strtok_r(NULL, "\n", &scratch)))
-				break;
-
+		lxc_iterate_parts(lxcpath, buf, "\n") {
 			c1 = lxc_container_new(lxcname, lxcpath);
-			if (!c1) {
-				counter++;
+			if (!c1)
 				continue;
-			}
 
 			/* We do not destroy recursively. If a clone of a clone
 			 * has clones or snapshots the user should remove it
@@ -264,7 +257,6 @@ static bool do_destroy_with_snapshots(struct lxc_container *c)
 			}
 
 			lxc_container_put(c1);
-			counter++;
 		}
 		free(buf);
 	}
diff --git a/src/lxc/utils.c b/src/lxc/utils.c
index 82c24c941..acda4d8dc 100644
--- a/src/lxc/utils.c
+++ b/src/lxc/utils.c
@@ -806,7 +806,7 @@ char *lxc_append_paths(const char *first, const char *second)
 
 bool lxc_string_in_list(const char *needle, const char *haystack, char _sep)
 {
-	char *token, *str, *saveptr = NULL;
+	char *token, *str;
 	char sep[2] = { _sep, '\0' };
 	size_t len;
 
@@ -817,17 +817,16 @@ bool lxc_string_in_list(const char *needle, const char *haystack, char _sep)
 	str = alloca(len + 1);
 	(void)strlcpy(str, haystack, len + 1);
 
-	for (; (token = strtok_r(str, sep, &saveptr)); str = NULL) {
+	lxc_iterate_parts(token, str, sep)
 		if (strcmp(needle, token) == 0)
 			return 1;
-	}
 
 	return 0;
 }
 
 char **lxc_string_split(const char *string, char _sep)
 {
-	char *token, *str, *saveptr = NULL;
+	char *token, *str;
 	char sep[2] = {_sep, '\0'};
 	char **tmp = NULL, **result = NULL;
 	size_t result_capacity = 0;
@@ -842,7 +841,7 @@ char **lxc_string_split(const char *string, char _sep)
 	str = alloca(len + 1);
 	(void)strlcpy(str, string, len + 1);
 
-	for (; (token = strtok_r(str, sep, &saveptr)); str = NULL) {
+	lxc_iterate_parts(token, str, sep) {
 		r = lxc_grow_array((void ***)&result, &result_capacity, result_count + 1, 16);
 		if (r < 0)
 			goto error_out;
@@ -946,7 +945,7 @@ char **lxc_string_split_quoted(char *string)
 
 char **lxc_string_split_and_trim(const char *string, char _sep)
 {
-	char *token, *str, *saveptr = NULL;
+	char *token, *str;
 	char sep[2] = { _sep, '\0' };
 	char **result = NULL;
 	size_t result_capacity = 0;
@@ -962,7 +961,7 @@ char **lxc_string_split_and_trim(const char *string, char _sep)
 	str = alloca(len + 1);
 	(void)strlcpy(str, string, len + 1);
 
-	for (; (token = strtok_r(str, sep, &saveptr)); str = NULL) {
+	lxc_iterate_parts(token, str, sep) {
 		while (token[0] == ' ' || token[0] == '\t')
 			token++;
 
@@ -1342,9 +1341,7 @@ bool detect_ramfs_rootfs(void)
 }
 
 char *on_path(const char *cmd, const char *rootfs) {
-	char *path = NULL;
-	char *entry = NULL;
-	char *saveptr = NULL;
+	char *entry = NULL, *path = NULL;
 	char cmdpath[MAXPATHLEN];
 	int ret;
 
@@ -1356,23 +1353,18 @@ char *on_path(const char *cmd, const char *rootfs) {
 	if (!path)
 		return NULL;
 
-	entry = strtok_r(path, ":", &saveptr);
-	while (entry) {
+	lxc_iterate_parts(entry, path, ":") {
 		if (rootfs)
 			ret = snprintf(cmdpath, MAXPATHLEN, "%s/%s/%s", rootfs, entry, cmd);
 		else
 			ret = snprintf(cmdpath, MAXPATHLEN, "%s/%s", entry, cmd);
-
 		if (ret < 0 || ret >= MAXPATHLEN)
-			goto next_loop;
+			continue;
 
 		if (access(cmdpath, X_OK) == 0) {
 			free(path);
 			return strdup(cmdpath);
 		}
-
-next_loop:
-		entry = strtok_r(NULL, ":", &saveptr);
 	}
 
 	free(path);
diff --git a/src/lxc/utils.h b/src/lxc/utils.h
index f09bc9018..7d672b777 100644
--- a/src/lxc/utils.h
+++ b/src/lxc/utils.h
@@ -620,4 +620,9 @@ extern int lxc_set_death_signal(int signal);
 extern int fd_cloexec(int fd, bool cloexec);
 extern int recursive_destroy(char *dirname);
 
+#define lxc_iterate_parts(__iterator, __splitme, __separators)                  \
+	for (char *__p = NULL, *__it = strtok_r(__splitme, __separators, &__p); \
+	     (__iterator = __it);                                               \
+	     __iterator = __it = strtok_r(NULL, __separators, &__p))
+
 #endif /* __LXC_UTILS_H */
diff --git a/src/tests/Makefile.am b/src/tests/Makefile.am
index e1532a102..e51efafd8 100644
--- a/src/tests/Makefile.am
+++ b/src/tests/Makefile.am
@@ -33,7 +33,7 @@ lxc_test_state_server_SOURCES = state_server.c lxctest.h
 lxc_test_share_ns_SOURCES = share_ns.c lxctest.h
 lxc_test_criu_check_feature_SOURCES = criu_check_feature.c lxctest.h
 lxc_test_raw_clone_SOURCES = lxc_raw_clone.c lxctest.h
-lxc_test_mount_injection_SOURCES = mount_injection.c
+lxc_test_mount_injection_SOURCES = mount_injection.c lxctest.h
 
 AM_CFLAGS=-DLXCROOTFSMOUNT=\"$(LXCROOTFSMOUNT)\" \
 	-DLXCPATH=\"$(LXCPATH)\" \
diff --git a/src/tests/mount_injection.c b/src/tests/mount_injection.c
index 7eef3c930..3d58b9c3f 100644
--- a/src/tests/mount_injection.c
+++ b/src/tests/mount_injection.c
@@ -17,7 +17,6 @@
  */
 
 
-#define _GNU_SOURCE
 #include <fcntl.h>
 #include <stdio.h>
 #include <stdlib.h>
@@ -30,6 +29,7 @@
 #include <sys/types.h>
 #include <unistd.h>
 
+#include "config.h"
 #include "lxctest.h"
 #include "utils.h"
 
@@ -145,9 +145,9 @@ static int perform_container_test(const char *name, const char *config_items[])
 	int i;
 	char *sret;
 	char template_log[sizeof(TEMPLATE)], template_dir[sizeof(TEMPLATE)],
-			device_message[sizeof("Check urandom device injected into "" - ") - 1 + strlen(name) + 1],
-			dir_message[sizeof("Check dir "" injected into "" - ") - 1 + sizeof(TEMPLATE) - 1 + strlen(name) + 1],
-			fs_message[sizeof("Check devtmpfs injected into "" - ") - 1 + strlen(name) + 1];
+			device_message[4096],
+			dir_message[4096],
+			fs_message[4096];
 	struct lxc_container *c;
 	struct lxc_mount mnt;
 	struct lxc_log log;