diff --git a/lib/libutil/login_cap.c b/lib/libutil/login_cap.c
index 529ce8227322..8fee76050b04 100644
--- a/lib/libutil/login_cap.c
+++ b/lib/libutil/login_cap.c
@@ -61,6 +61,8 @@ static char * internal_string = NULL;
 static size_t internal_arraysz = 0;
 static const char ** internal_array = NULL;
 
+static char path_login_conf[] = _PATH_LOGIN_CONF;
+
 static char *
 allocstr(const char *str)
 {
@@ -215,15 +217,14 @@ login_getclassbyname(char const *name, const struct passwd *pwd)
 
 	if (dir && snprintf(userpath, MAXPATHLEN, "%s/%s", dir,
 			    _FILE_LOGIN_CONF) < MAXPATHLEN) {
-	    login_dbarray[i] = userpath;
 	    if (_secure_path(userpath, pwd->pw_uid, pwd->pw_gid) != -1)
-		i++;		/* only use 'secure' data */
+		login_dbarray[i++] = userpath;
 	}
 	/*
 	 * XXX: Why to add the system database if the class is `me'?
 	 */
-	if (_secure_path(_PATH_LOGIN_CONF, 0, 0) != -1)
-	    login_dbarray[i++] = _PATH_LOGIN_CONF;
+	if (_secure_path(path_login_conf, 0, 0) != -1)
+	    login_dbarray[i++] = path_login_conf;
 	login_dbarray[i] = NULL;
 
 	memset(lc, 0, sizeof(login_cap_t));
diff --git a/lib/libutil/login_class.c b/lib/libutil/login_class.c
index 94cb3aa14e6d..507451958d1e 100644
--- a/lib/libutil/login_class.c
+++ b/lib/libutil/login_class.c
@@ -142,14 +142,13 @@ substvar(const char * var, const struct passwd * pwd, int hlen, int pch, int nle
 	int	tildes = 0;
 	int	dollas = 0;
 	char	*p;
+	const char *q;
 
 	if (pwd != NULL) {
-	    /* Count the number of ~'s in var to substitute */
-	    for (p = (char *)var; (p = strchr(p, '~')) != NULL; p++)
-		++tildes;
-	    /* Count the number of $'s in var to substitute */
-	    for (p = (char *)var; (p = strchr(p, '$')) != NULL; p++)
-		++dollas;
+	    for (q = var; *q != '\0'; ++q) {
+		tildes += (*q == '~');
+		dollas += (*q == '$');
+	    }
 	}
 
 	np = malloc(strlen(var) + (dollas * nlen)