diff --git a/ci/build.sh b/ci/build.sh
index 2afcd018..ffdeba01 100755
--- a/ci/build.sh
+++ b/ci/build.sh
@@ -30,6 +30,6 @@ esac
 
 # always fail on warnings; https://github.com/ostreedev/ostree/pull/971
 # NB: this disables the default set of flags from configure.ac
-export CFLAGS="-Wall -Werror ${CFLAGS:-}"
+export CFLAGS="-Wall -Werror -fanalyzer ${CFLAGS:-}"
 
 build --enable-gtk-doc ${CONFIGOPTS:-}
diff --git a/tests/test-rollsum.c b/tests/test-rollsum.c
index 08c78b66..08aea235 100644
--- a/tests/test-rollsum.c
+++ b/tests/test-rollsum.c
@@ -75,8 +75,8 @@ test_rollsum (void)
 #define MAX_BUFFER_SIZE 1000000
   gsize i;
   int len;
-  g_autofree unsigned char *a = malloc (MAX_BUFFER_SIZE);
-  g_autofree unsigned char *b = malloc (MAX_BUFFER_SIZE);
+  g_autofree unsigned char *a = g_malloc (MAX_BUFFER_SIZE);
+  g_autofree unsigned char *b = g_malloc (MAX_BUFFER_SIZE);
   g_autoptr(GRand) rand = g_rand_new ();
 
   /* These two buffers produce the same crc32.  */