]> git.sur5r.net Git - openldap/blobdiff - servers/slapd/schema_init.c
More system schema checks
[openldap] / servers / slapd / schema_init.c
index 4dd9022c2275dff99337bd3bd0382630420f1cef..cfd141b2fcba882a814eb77db8dc1ce76c30d46d 100644 (file)
@@ -1,7 +1,7 @@
 /* schema_init.c - init builtin schema */
 /* $OpenLDAP$ */
 /*
- * Copyright 1998-2000 The OpenLDAP Foundation, All Rights Reserved.
+ * Copyright 1998-2002 The OpenLDAP Foundation, All Rights Reserved.
  * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
  */
 
@@ -123,31 +123,31 @@ static int octetStringIndexer(
        Syntax *syntax,
        MatchingRule *mr,
        struct berval *prefix,
-       struct berval **values,
-       struct berval ***keysp )
+       BVarray values,
+       BVarray *keysp )
 {
        int i;
        size_t slen, mlen;
-       struct berval **keys;
+       BVarray keys;
        HASH_CONTEXT   HASHcontext;
        unsigned char   HASHdigest[HASH_BYTES];
        struct berval digest;
        digest.bv_val = HASHdigest;
        digest.bv_len = sizeof(HASHdigest);
 
-       for( i=0; values[i] != NULL; i++ ) {
+       for( i=0; values[i].bv_val != NULL; i++ ) {
                /* just count them */
        }
 
        /* we should have at least one value at this point */
        assert( i > 0 );
 
-       keys = ch_malloc( sizeof( struct berval ) * (i+1) );
+       keys = ch_malloc( sizeof( struct berval ) * (i+1) );
 
-       slen = strlen( syntax->ssyn_oid );
-       mlen = strlen( mr->smr_oid );
+       slen = syntax->ssyn_oidlen;
+       mlen = mr->smr_oidlen;
 
-       for( i=0; values[i] != NULL; i++ ) {
+       for( i=0; values[i].bv_val != NULL; i++ ) {
                HASH_Init( &HASHcontext );
                if( prefix != NULL && prefix->bv_len > 0 ) {
                        HASH_Update( &HASHcontext,
@@ -158,13 +158,13 @@ static int octetStringIndexer(
                HASH_Update( &HASHcontext,
                        mr->smr_oid, mlen );
                HASH_Update( &HASHcontext,
-                       values[i]->bv_val, values[i]->bv_len );
+                       values[i].bv_val, values[i].bv_len );
                HASH_Final( HASHdigest, &HASHcontext );
 
-               keys[i] = ber_bvdup( &digest );
+               ber_dupbv( &keys[i], &digest );
        }
 
-       keys[i] = NULL;
+       keys[i].bv_val = NULL;
 
        *keysp = keys;
 
@@ -179,10 +179,10 @@ static int octetStringFilter(
        MatchingRule *mr,
        struct berval *prefix,
        void * assertValue,
-       struct berval ***keysp )
+       BVarray *keysp )
 {
        size_t slen, mlen;
-       struct berval **keys;
+       BVarray keys;
        HASH_CONTEXT   HASHcontext;
        unsigned char   HASHdigest[HASH_BYTES];
        struct berval *value = (struct berval *) assertValue;
@@ -190,10 +190,10 @@ static int octetStringFilter(
        digest.bv_val = HASHdigest;
        digest.bv_len = sizeof(HASHdigest);
 
-       slen = strlen( syntax->ssyn_oid );
-       mlen = strlen( mr->smr_oid );
+       slen = syntax->ssyn_oidlen;
+       mlen = mr->smr_oidlen;
 
-       keys = ch_malloc( sizeof( struct berval ) * 2 );
+       keys = ch_malloc( sizeof( struct berval ) * 2 );
 
        HASH_Init( &HASHcontext );
        if( prefix != NULL && prefix->bv_len > 0 ) {
@@ -208,8 +208,8 @@ static int octetStringFilter(
                value->bv_val, value->bv_len );
        HASH_Final( HASHdigest, &HASHcontext );
 
-       keys[0] = ber_bvdup( &digest );
-       keys[1] = NULL;
+       ber_dupbv( keys, &digest );
+       keys[1].bv_val = NULL;
 
        *keysp = keys;
 
@@ -222,37 +222,38 @@ nameUIDValidate(
        struct berval *in )
 {
        int rc;
-       struct berval *dn;
+       struct berval dn;
 
        if( in->bv_len == 0 ) return LDAP_SUCCESS;
 
-       dn = ber_bvdup( in );
+       ber_dupbv( &dn, in );
+       if( !dn.bv_val ) return LDAP_OTHER;
 
-       if( dn->bv_val[dn->bv_len-1] == '\'' ) {
+       if( dn.bv_val[dn.bv_len-1] == 'B'
+               && dn.bv_val[dn.bv_len-2] == '\'' )
+       {
                /* assume presence of optional UID */
                ber_len_t i;
 
-               for(i=dn->bv_len-2; i>2; i--) {
-                       if( dn->bv_val[i] != '0' &&     dn->bv_val[i] != '1' ) {
+               for(i=dn.bv_len-3; i>1; i--) {
+                       if( dn.bv_val[i] != '0' &&      dn.bv_val[i] != '1' ) {
                                break;
                        }
                }
-               if( dn->bv_val[i] != '\'' ||
-                   dn->bv_val[i-1] != 'B' ||
-                   dn->bv_val[i-2] != '#' ) {
-                       ber_bvfree( dn );
+               if( dn.bv_val[i] != '\'' ||
+                   dn.bv_val[i-1] != '#' ) {
+                       ber_memfree( dn.bv_val );
                        return LDAP_INVALID_SYNTAX;
                }
 
-               /* trim the UID to allow use of dn_validate */
-               dn->bv_val[i-2] = '\0';
+               /* trim the UID to allow use of dnValidate */
+               dn.bv_val[i-1] = '\0';
+               dn.bv_len = i-1;
        }
 
-       /* FIXME: should use dnValidate */
-       rc = dn_validate( dn->bv_val ) == NULL
-               ? LDAP_INVALID_SYNTAX : LDAP_SUCCESS;
+       rc = dnValidate( NULL, &dn );
 
-       ber_bvfree( dn );
+       ber_memfree( &dn );
        return rc;
 }
 
@@ -260,60 +261,60 @@ static int
 nameUIDNormalize(
        Syntax *syntax,
        struct berval *val,
-       struct berval **normalized )
+       struct berval *normalized )
 {
-       struct berval *out = ber_bvdup( val );
+       struct berval out;
        int rc;
 
-       if( out->bv_len != 0 ) {
-               char *dn;
+       ber_dupbv( &out, val );
+       if( out.bv_len != 0 ) {
                ber_len_t dnlen;
                char *uid = NULL;
                ber_len_t uidlen = 0;
 
-               if( out->bv_val[out->bv_len-1] == '\'' ) {
+               if( out.bv_val[out.bv_len-1] == '\'' ) {
                        /* assume presence of optional UID */
-                       uid = strrchr( out->bv_val, '#' );
+                       uid = strrchr( out.bv_val, '#' );
 
                        if( uid == NULL ) {
-                               ber_bvfree( out );
+                               free( out.bv_val );
                                return LDAP_INVALID_SYNTAX;
                        }
 
-                       uidlen = out->bv_len - (uid - out->bv_val);
+                       uidlen = out.bv_len - (uid - out.bv_val);
                        /* temporarily trim the UID */
                        *uid = '\0';
-                       out->bv_len -= uidlen;
+                       out.bv_len -= uidlen;
                }
 
 #ifdef USE_DN_NORMALIZE
-               rc = dnNormalize( NULL, out, normalized );
+               rc = dnNormalize2( NULL, &out, normalized );
 #else
-               rc = dnPretty( NULL, out, normalized );
+               rc = dnPretty2( NULL, &out, normalized );
 #endif
 
                if( rc != LDAP_SUCCESS ) {
-                       ber_bvfree( out );
+                       free( out.bv_val );
                        return LDAP_INVALID_SYNTAX;
                }
 
-               dnlen = (*normalized)->bv_len;
+               dnlen = normalized->bv_len;
 
                if( uidlen ) {
-                       struct berval *b2 = ch_malloc(sizeof(struct berval));
-                       b2->bv_val = ch_malloc(dnlen + uidlen + 1);
-                       SAFEMEMCPY( b2->bv_val, (*normalized)->bv_val, dnlen );
+                       struct berval b2;
+                       b2.bv_val = ch_malloc(dnlen + uidlen + 1);
+                       AC_MEMCPY( b2.bv_val, normalized->bv_val, dnlen );
 
                        /* restore the separator */
                        *uid = '#';
                        /* shift the UID */
-                       SAFEMEMCPY( (*normalized)->bv_val+dnlen, uid, uidlen );
-                       b2->bv_len = dnlen + uidlen;
-                       (*normalized)->bv_val[dnlen+uidlen] = '\0';
-                       ber_bvfree(*normalized);
+                       AC_MEMCPY( normalized->bv_val+dnlen, uid, uidlen );
+                       b2.bv_len = dnlen + uidlen;
+                       normalized->bv_val[dnlen+uidlen] = '\0';
+                       free(normalized->bv_val);
                        *normalized = b2;
                }
-               ber_bvfree( out );
+               free( out.bv_val );
        }
 
        return LDAP_SUCCESS;
@@ -378,14 +379,13 @@ static int
 bitStringNormalize(
        Syntax *syntax,
        struct berval *val,
-       struct berval **normalized )
+       struct berval *normalized )
 {
        /*
-     * A normalized bitString is has no extaneous (leading) zero bits.
+        * A normalized bitString is has no extaneous (leading) zero bits.
         * That is, '00010'B is normalized to '10'B
         * However, as a special case, '0'B requires no normalization.
-     */
-       struct berval *newval;
+        */
        char *p;
 
        /* start at the first bit */
@@ -394,28 +394,24 @@ bitStringNormalize(
        /* Find the first non-zero bit */
        while ( *p == '0' ) p++;
 
-       newval = (struct berval *) ch_malloc( sizeof(struct berval) );
-
        if( *p == '\'' ) {
                /* no non-zero bits */
-               newval->bv_val = ch_strdup("\'0\'B");
-               newval->bv_len = sizeof("\'0\'B") - 1;
+               ber_str2bv( "\'0\'B", sizeof("\'0\'B") - 1, 1, normalized );
                goto done;
        }
 
-       newval->bv_val = ch_malloc( val->bv_len + 1 );
+       normalized->bv_val = ch_malloc( val->bv_len + 1 );
 
-       newval->bv_val[0] = '\'';
-       newval->bv_len = 1;
+       normalized->bv_val[0] = '\'';
+       normalized->bv_len = 1;
 
        for( ; *p != '\0'; p++ ) {
-               newval->bv_val[newval->bv_len++] = *p;
+               normalized->bv_val[normalized->bv_len++] = *p;
        }
 
-       newval->bv_val[newval->bv_len] = '\0';
+       normalized->bv_val[normalized->bv_len] = '\0';
 
 done:
-       *normalized = newval;
        return LDAP_SUCCESS;
 }
 
@@ -494,56 +490,53 @@ static int
 UTF8StringNormalize(
        Syntax *syntax,
        struct berval *val,
-       struct berval **normalized )
+       struct berval *normalized )
 {
-       struct berval *newval;
        char *p, *q, *s;
-
-       newval = ch_malloc( sizeof( struct berval ) );
+       int len = 0;
 
        p = val->bv_val;
 
        /* Ignore initial whitespace */
-       while ( ldap_utf8_isspace( p ) ) {
-               LDAP_UTF8_INCR( p );
+       /* All space is ASCII. All ASCII is 1 byte */
+       while ( ASCII_SPACE( *p ) ) {
+               p++;
        }
 
        if( *p == '\0' ) {
-               ch_free( newval );
                return LDAP_INVALID_SYNTAX;
        }
 
-       newval->bv_val = ch_strdup( p );
-       p = q = newval->bv_val;
+       ber_str2bv( p, val->bv_len - (p - val->bv_val), 1, normalized );
+
+       assert( normalized->bv_val );
+
+       p = q = normalized->bv_val;
        s = NULL;
 
        while ( *p ) {
-               int len;
-
-               if ( ldap_utf8_isspace( p ) ) {
-                       len = LDAP_UTF8_COPY(q,p);
-                       s=q;
-                       p+=len;
-                       q+=len;
+               q += len;
+               if ( ASCII_SPACE( *p ) ) {
+                       s = q - len;
+                       len = 1;
+                       *q = *p++;
 
                        /* Ignore the extra whitespace */
-                       while ( ldap_utf8_isspace( p ) ) {
-                               LDAP_UTF8_INCR( p );
+                       while ( ASCII_SPACE( *p ) ) {
+                               p++;
                        }
                } else {
                        len = LDAP_UTF8_COPY(q,p);
                        s=NULL;
                        p+=len;
-                       q+=len;
                }
        }
 
-       assert( *newval->bv_val );
-       assert( newval->bv_val < p );
-       assert( q <= p );
+       assert( normalized->bv_val < p );
+       assert( q+len <= p );
 
        /* cannot start with a space */
-       assert( !ldap_utf8_isspace(newval->bv_val) );
+       assert( !ASCII_SPACE(normalized->bv_val[0]) );
 
        /*
         * If the string ended in space, backup the pointer one
@@ -552,27 +545,29 @@ UTF8StringNormalize(
         */
 
        if ( s != NULL ) {
+               len = q - s;
                q = s;
        }
 
        /* cannot end with a space */
-       assert( !ldap_utf8_isspace( LDAP_UTF8_PREV(q) ) );
+       assert( !ASCII_SPACE( *q ) );
+
+       q += len;
 
        /* null terminate */
        *q = '\0';
 
-       newval->bv_len = q - newval->bv_val;
-       *normalized = newval;
+       normalized->bv_len = q - normalized->bv_val;
 
        return LDAP_SUCCESS;
 }
 
-/* Returns Unicode cannonically normalized copy of a substring assertion
+/* Returns Unicode canonically normalized copy of a substring assertion
  * Skipping attribute description */
 static SubstringsAssertion *
 UTF8SubstringsassertionNormalize(
        SubstringsAssertion *sa,
-       char casefold )
+       unsigned casefold )
 {
        SubstringsAssertion *nsa;
        int i;
@@ -582,30 +577,33 @@ UTF8SubstringsassertionNormalize(
                return NULL;
        }
 
-       if( sa->sa_initial != NULL ) {
-               nsa->sa_initial = ber_bvstr( UTF8normalize( sa->sa_initial, casefold ) );
-               if( nsa->sa_initial == NULL ) {
+       if( sa->sa_initial.bv_val != NULL ) {
+               ber_str2bv( UTF8normalize( &sa->sa_initial, casefold ), 0,
+                       0, &nsa->sa_initial );
+               if( nsa->sa_initial.bv_val == NULL ) {
                        goto err;
                }
        }
 
        if( sa->sa_any != NULL ) {
-               for( i=0; sa->sa_any[i] != NULL; i++ ) {
+               for( i=0; sa->sa_any[i].bv_val != NULL; i++ ) {
                        /* empty */
                }
-               nsa->sa_any = (struct berval **)ch_malloc( (i + 1) * sizeof(struct berval *) );
-               for( i=0; sa->sa_any[i] != NULL; i++ ) {
-                       nsa->sa_any[i] = ber_bvstr( UTF8normalize( sa->sa_any[i], casefold ) );
-                       if( nsa->sa_any[i] == NULL ) {
+               nsa->sa_any = (struct berval *)ch_malloc( (i + 1) * sizeof(struct berval) );
+               for( i=0; sa->sa_any[i].bv_val != NULL; i++ ) {
+                       ber_str2bv( UTF8normalize( &sa->sa_any[i], casefold ),
+                               0, 0, &nsa->sa_any[i] );
+                       if( nsa->sa_any[i].bv_val == NULL ) {
                                goto err;
                        }
                }
-               nsa->sa_any[i] = NULL;
+               nsa->sa_any[i].bv_val = NULL;
        }
 
-       if( sa->sa_final != NULL ) {
-               nsa->sa_final = ber_bvstr( UTF8normalize( sa->sa_final, casefold ) );
-               if( nsa->sa_final == NULL ) {
+       if( sa->sa_final.bv_val != NULL ) {
+               ber_str2bv( UTF8normalize( &sa->sa_final, casefold ), 0,
+                       0, &nsa->sa_final );
+               if( nsa->sa_final.bv_val == NULL ) {
                        goto err;
                }
        }
@@ -613,9 +611,9 @@ UTF8SubstringsassertionNormalize(
        return nsa;
 
 err:
-       ber_bvfree( nsa->sa_final );
-       ber_bvecfree( nsa->sa_any );
-       ber_bvfree( nsa->sa_initial );
+       if ( nsa->sa_final.bv_val ) free( nsa->sa_final.bv_val );
+       if ( nsa->sa_any )bvarray_free( nsa->sa_any );
+       if ( nsa->sa_initial.bv_val ) free( nsa->sa_initial.bv_val );
        ch_free( nsa );
        return NULL;
 }
@@ -636,7 +634,7 @@ strip8bitChars(
                        while( *++q & 0x80 ) {
                                /* empty */
                        }
-                       p = memmove(p, q, strlen(q) + 1);
+                       p = AC_MEMCPY(p, q, strlen(q) + 1);
                } else {
                        p++;
                }
@@ -668,7 +666,7 @@ approxMatch(
        size_t avlen;
 
        /* Yes, this is necessary */
-       nval = UTF8normalize( value, UTF8_NOCASEFOLD );
+       nval = UTF8normalize( value, LDAP_UTF8_NOCASEFOLD );
        if( nval == NULL ) {
                *matchp = 1;
                return LDAP_SUCCESS;
@@ -677,7 +675,7 @@ approxMatch(
 
        /* Yes, this is necessary */
        assertv = UTF8normalize( ((struct berval *)assertedValue),
-                                UTF8_NOCASEFOLD );
+               LDAP_UTF8_NOCASEFOLD );
        if( assertv == NULL ) {
                ch_free( nval );
                *matchp = 1;
@@ -773,16 +771,17 @@ approxIndexer(
        Syntax *syntax,
        MatchingRule *mr,
        struct berval *prefix,
-       struct berval **values,
-       struct berval ***keysp )
+       BVarray values,
+       BVarray *keysp )
 {
        char *val, *c;
        int i,j, len, wordcount, keycount=0;
-       struct berval **newkeys, **keys=NULL;
+       struct berval *newkeys;
+       BVarray keys=NULL;
 
-       for( j=0; values[j] != NULL; j++ ) {
+       for( j=0; values[j].bv_val != NULL; j++ ) {
                /* Yes, this is necessary */
-               val = UTF8normalize( values[j], UTF8_NOCASEFOLD );
+               val = UTF8normalize( &values[j], LDAP_UTF8_NOCASEFOLD );
                strip8bitChars( val );
 
                /* Isolate how many words there are. There will be a key for each */
@@ -795,9 +794,9 @@ approxIndexer(
                }
 
                /* Allocate/increase storage to account for new keys */
-               newkeys = (struct berval **)ch_malloc( (keycount + wordcount + 1) 
-                       * sizeof(struct berval *) );
-               memcpy( newkeys, keys, keycount * sizeof(struct berval *) );
+               newkeys = (struct berval *)ch_malloc( (keycount + wordcount + 1) 
+                       * sizeof(struct berval) );
+               AC_MEMCPY( newkeys, keys, keycount * sizeof(struct berval) );
                if( keys ) ch_free( keys );
                keys = newkeys;
 
@@ -805,16 +804,14 @@ approxIndexer(
                for( c=val,i=0;  i<wordcount;  c+=len+1  ) {
                        len = strlen( c );
                        if( len < SLAPD_APPROX_WORDLEN ) continue;
-                       keys[keycount] = (struct berval *)ch_malloc( sizeof(struct berval) );
-                       keys[keycount]->bv_val = phonetic( c );
-                       keys[keycount]->bv_len = strlen( keys[keycount]->bv_val );
+                       ber_str2bv( phonetic( c ), 0, 0, &keys[keycount] );
                        keycount++;
                        i++;
                }
 
                free( val );
        }
-       keys[keycount] = NULL;
+       keys[keycount].bv_val = NULL;
        *keysp = keys;
 
        return LDAP_SUCCESS;
@@ -828,18 +825,18 @@ approxFilter(
        MatchingRule *mr,
        struct berval *prefix,
        void * assertValue,
-       struct berval ***keysp )
+       BVarray *keysp )
 {
        char *val, *c;
        int i, count, len;
-       struct berval **keys;
+       BVarray keys;
 
        /* Yes, this is necessary */
        val = UTF8normalize( ((struct berval *)assertValue),
-                            UTF8_NOCASEFOLD );
+               LDAP_UTF8_NOCASEFOLD );
        if( val == NULL ) {
-               keys = (struct berval **)ch_malloc( sizeof(struct berval *) );
-               keys[0] = NULL;
+               keys = (struct berval *)ch_malloc( sizeof(struct berval) );
+               keys[0].bv_val = NULL;
                *keysp = keys;
                return LDAP_SUCCESS;
        }
@@ -855,19 +852,19 @@ approxFilter(
        }
 
        /* Allocate storage for new keys */
-       keys = (struct berval **)ch_malloc( (count + 1) * sizeof(struct berval *) );
+       keys = (struct berval *)ch_malloc( (count + 1) * sizeof(struct berval) );
 
        /* Get a phonetic copy of each word */
        for( c=val,i=0;  i<count; c+=len+1 ) {
                len = strlen(c);
                if( len < SLAPD_APPROX_WORDLEN ) continue;
-               keys[i] = ber_bvstr( phonetic( c ) );
+               ber_str2bv( phonetic( c ), 0, 0, &keys[i] );
                i++;
        }
 
        free( val );
 
-       keys[count] = NULL;
+       keys[count].bv_val = NULL;
        *keysp = keys;
 
        return LDAP_SUCCESS;
@@ -926,32 +923,32 @@ approxIndexer(
        Syntax *syntax,
        MatchingRule *mr,
        struct berval *prefix,
-       struct berval **values,
-       struct berval ***keysp )
+       BVarray values,
+       BVarray *keysp )
 {
        int i;
-       struct berval **keys;
+       BVarray *keys;
        char *s;
 
-       for( i=0; values[i] != NULL; i++ ) {
+       for( i=0; values[i].bv_val != NULL; i++ ) {
                /* empty - just count them */
        }
 
        /* we should have at least one value at this point */
        assert( i > 0 );
 
-       keys = (struct berval **)ch_malloc( sizeof( struct berval * ) * (i+1) );
+       keys = (struct berval *)ch_malloc( sizeof( struct berval ) * (i+1) );
 
        /* Copy each value and run it through phonetic() */
-       for( i=0; values[i] != NULL; i++ ) {
+       for( i=0; values[i].bv_val != NULL; i++ ) {
                /* Yes, this is necessary */
-               s = UTF8normalize( values[i], UTF8_NOCASEFOLD );
+               s = UTF8normalize( &values[i], UTF8_NOCASEFOLD );
 
                /* strip 8-bit chars and run through phonetic() */
-               keys[i] = ber_bvstr( phonetic( strip8bitChars( s ) ) );
+               ber_str2bv( phonetic( strip8bitChars( s ) ), 0, 0, &keys[i] );
                free( s );
        }
-       keys[i] = NULL;
+       keys[i].bv_val = NULL;
 
        *keysp = keys;
        return LDAP_SUCCESS;
@@ -966,12 +963,12 @@ approxFilter(
        MatchingRule *mr,
        struct berval *prefix,
        void * assertValue,
-       struct berval ***keysp )
+       BVarray *keysp )
 {
-       struct berval **keys;
+       BVarray keys;
        char *s;
 
-       keys = (struct berval **)ch_malloc( sizeof( struct berval * ) * 2 );
+       keys = (struct berval *)ch_malloc( sizeof( struct berval * ) * 2 );
 
        /* Yes, this is necessary */
        s = UTF8normalize( ((struct berval *)assertValue),
@@ -1002,7 +999,7 @@ caseExactMatch(
 {
        *matchp = UTF8normcmp( value->bv_val,
                ((struct berval *) assertedValue)->bv_val,
-               UTF8_NOCASEFOLD );
+               LDAP_UTF8_NOCASEFOLD );
        return LDAP_SUCCESS;
 }
 
@@ -1020,10 +1017,11 @@ caseExactIgnoreSubstringsMatch(
        struct berval left;
        int i;
        ber_len_t inlen=0;
-       char *nav, casefold;
+       char *nav;
+       unsigned casefold;
 
        casefold = strcmp( mr->smr_oid, caseExactSubstringsMatchOID )
-               ? UTF8_CASEFOLD : UTF8_NOCASEFOLD;
+               ? LDAP_UTF8_CASEFOLD : LDAP_UTF8_NOCASEFOLD;
 
        nav = UTF8normalize( value, casefold );
        if( nav == NULL ) {
@@ -1040,56 +1038,56 @@ caseExactIgnoreSubstringsMatch(
        }
 
        /* Add up asserted input length */
-       if( sub->sa_initial ) {
-               inlen += sub->sa_initial->bv_len;
+       if( sub->sa_initial.bv_val ) {
+               inlen += sub->sa_initial.bv_len;
        }
        if( sub->sa_any ) {
-               for(i=0; sub->sa_any[i] != NULL; i++) {
-                       inlen += sub->sa_any[i]->bv_len;
+               for(i=0; sub->sa_any[i].bv_val != NULL; i++) {
+                       inlen += sub->sa_any[i].bv_len;
                }
        }
-       if( sub->sa_final ) {
-               inlen += sub->sa_final->bv_len;
+       if( sub->sa_final.bv_val ) {
+               inlen += sub->sa_final.bv_len;
        }
 
-       if( sub->sa_initial ) {
+       if( sub->sa_initial.bv_val ) {
                if( inlen > left.bv_len ) {
                        match = 1;
                        goto done;
                }
 
-               match = strncmp( sub->sa_initial->bv_val, left.bv_val,
-                       sub->sa_initial->bv_len );
+               match = strncmp( sub->sa_initial.bv_val, left.bv_val,
+                       sub->sa_initial.bv_len );
 
                if( match != 0 ) {
                        goto done;
                }
 
-               left.bv_val += sub->sa_initial->bv_len;
-               left.bv_len -= sub->sa_initial->bv_len;
-               inlen -= sub->sa_initial->bv_len;
+               left.bv_val += sub->sa_initial.bv_len;
+               left.bv_len -= sub->sa_initial.bv_len;
+               inlen -= sub->sa_initial.bv_len;
        }
 
-       if( sub->sa_final ) {
+       if( sub->sa_final.bv_val ) {
                if( inlen > left.bv_len ) {
                        match = 1;
                        goto done;
                }
 
-               match = strncmp( sub->sa_final->bv_val,
-                       &left.bv_val[left.bv_len - sub->sa_final->bv_len],
-                       sub->sa_final->bv_len );
+               match = strncmp( sub->sa_final.bv_val,
+                       &left.bv_val[left.bv_len - sub->sa_final.bv_len],
+                       sub->sa_final.bv_len );
 
                if( match != 0 ) {
                        goto done;
                }
 
-               left.bv_len -= sub->sa_final->bv_len;
-               inlen -= sub->sa_final->bv_len;
+               left.bv_len -= sub->sa_final.bv_len;
+               inlen -= sub->sa_final.bv_len;
        }
 
        if( sub->sa_any ) {
-               for(i=0; sub->sa_any[i]; i++) {
+               for(i=0; sub->sa_any[i].bv_val; i++) {
                        ber_len_t idx;
                        char *p;
 
@@ -1100,11 +1098,11 @@ retry:
                                goto done;
                        }
 
-                       if( sub->sa_any[i]->bv_len == 0 ) {
+                       if( sub->sa_any[i].bv_len == 0 ) {
                                continue;
                        }
 
-                       p = strchr( left.bv_val, *sub->sa_any[i]->bv_val );
+                       p = strchr( left.bv_val, *sub->sa_any[i].bv_val );
 
                        if( p == NULL ) {
                                match = 1;
@@ -1117,9 +1115,12 @@ retry:
                        if( idx >= left.bv_len ) {
                                /* this shouldn't happen */
                                free( nav );
-                               ch_free( sub->sa_final );
-                               ber_bvecfree( sub->sa_any );
-                               ch_free( sub->sa_initial );
+                               if ( sub->sa_final.bv_val )
+                                       ch_free( sub->sa_final.bv_val );
+                               if ( sub->sa_any )
+                                       bvarray_free( sub->sa_any );
+                               if ( sub->sa_initial.bv_val )
+                                       ch_free( sub->sa_initial.bv_val );
                                ch_free( sub );
                                return LDAP_OTHER;
                        }
@@ -1127,15 +1128,15 @@ retry:
                        left.bv_val = p;
                        left.bv_len -= idx;
 
-                       if( sub->sa_any[i]->bv_len > left.bv_len ) {
+                       if( sub->sa_any[i].bv_len > left.bv_len ) {
                                /* not enough left */
                                match = 1;
                                goto done;
                        }
 
                        match = strncmp( left.bv_val,
-                               sub->sa_any[i]->bv_val,
-                               sub->sa_any[i]->bv_len );
+                               sub->sa_any[i].bv_val,
+                               sub->sa_any[i].bv_len );
 
                        if( match != 0 ) {
                                left.bv_val++;
@@ -1143,18 +1144,18 @@ retry:
                                goto retry;
                        }
 
-                       left.bv_val += sub->sa_any[i]->bv_len;
-                       left.bv_len -= sub->sa_any[i]->bv_len;
-                       inlen -= sub->sa_any[i]->bv_len;
+                       left.bv_val += sub->sa_any[i].bv_len;
+                       left.bv_len -= sub->sa_any[i].bv_len;
+                       inlen -= sub->sa_any[i].bv_len;
                }
        }
 
 done:
        free( nav );
        if( sub != NULL ) {
-               ber_bvfree( sub->sa_final );
-               ber_bvecfree( sub->sa_any );
-               ber_bvfree( sub->sa_initial );
+               if ( sub->sa_final.bv_val ) free( sub->sa_final.bv_val );
+               if ( sub->sa_any ) bvarray_free( sub->sa_any );
+               if ( sub->sa_initial.bv_val ) free( sub->sa_initial.bv_val );
                ch_free( sub );
        }
        *matchp = match;
@@ -1168,38 +1169,38 @@ static int caseExactIgnoreIndexer(
        Syntax *syntax,
        MatchingRule *mr,
        struct berval *prefix,
-       struct berval **values,
-       struct berval ***keysp )
+       BVarray values,
+       BVarray *keysp )
 {
        int i;
-       char casefold;
+       unsigned casefold;
        size_t slen, mlen;
-       struct berval **keys;
+       BVarray keys;
        HASH_CONTEXT   HASHcontext;
        unsigned char   HASHdigest[HASH_BYTES];
        struct berval digest;
        digest.bv_val = HASHdigest;
        digest.bv_len = sizeof(HASHdigest);
 
-       for( i=0; values[i] != NULL; i++ ) {
+       for( i=0; values[i].bv_val != NULL; i++ ) {
                /* empty - just count them */
        }
 
        /* we should have at least one value at this point */
        assert( i > 0 );
 
-       keys = ch_malloc( sizeof( struct berval ) * (i+1) );
+       keys = ch_malloc( sizeof( struct berval ) * (i+1) );
 
-       slen = strlen( syntax->ssyn_oid );
-       mlen = strlen( mr->smr_oid );
+       slen = syntax->ssyn_oidlen;
+       mlen = mr->smr_oidlen;
 
        casefold = strcmp( mr->smr_oid, caseExactMatchOID )
-               ? UTF8_CASEFOLD : UTF8_NOCASEFOLD;
+               ? LDAP_UTF8_CASEFOLD : LDAP_UTF8_NOCASEFOLD;
 
-       for( i=0; values[i] != NULL; i++ ) {
-               struct berval *value;
-               value = ber_bvstr( UTF8normalize( values[i],
-                       casefold ) );
+       for( i=0; values[i].bv_val != NULL; i++ ) {
+               struct berval value;
+               ber_str2bv( UTF8normalize( &values[i], casefold ), 0, 0,
+                       &value );
 
                HASH_Init( &HASHcontext );
                if( prefix != NULL && prefix->bv_len > 0 ) {
@@ -1211,15 +1212,15 @@ static int caseExactIgnoreIndexer(
                HASH_Update( &HASHcontext,
                        mr->smr_oid, mlen );
                HASH_Update( &HASHcontext,
-                       value->bv_val, value->bv_len );
+                       value.bv_val, value.bv_len );
                HASH_Final( HASHdigest, &HASHcontext );
 
-               ber_bvfree( value );
+               free( value.bv_val );
 
-               keys[i] = ber_bvdup( &digest );
+               ber_dupbv( &keys[i], &digest );
        }
 
-       keys[i] = NULL;
+       keys[i].bv_val = NULL;
        *keysp = keys;
        return LDAP_SUCCESS;
 }
@@ -1232,34 +1233,34 @@ static int caseExactIgnoreFilter(
        MatchingRule *mr,
        struct berval *prefix,
        void * assertValue,
-       struct berval ***keysp )
+       BVarray *keysp )
 {
-       char casefold;
+       unsigned casefold;
        size_t slen, mlen;
-       struct berval **keys;
+       BVarray keys;
        HASH_CONTEXT   HASHcontext;
        unsigned char   HASHdigest[HASH_BYTES];
-       struct berval *value;
+       struct berval value;
        struct berval digest;
        digest.bv_val = HASHdigest;
        digest.bv_len = sizeof(HASHdigest);
 
-       slen = strlen( syntax->ssyn_oid );
-       mlen = strlen( mr->smr_oid );
+       slen = syntax->ssyn_oidlen;
+       mlen = mr->smr_oidlen;
 
        casefold = strcmp( mr->smr_oid, caseExactMatchOID )
-               ? UTF8_CASEFOLD : UTF8_NOCASEFOLD;
+               ? LDAP_UTF8_CASEFOLD : LDAP_UTF8_NOCASEFOLD;
 
-       value = ber_bvstr( UTF8normalize( ((struct berval *) assertValue),
-               casefold ) );
+       ber_str2bv( UTF8normalize( ((struct berval *) assertValue), casefold ),
+               0, 0, &value );
        /* This usually happens if filter contains bad UTF8 */
-       if( value == NULL ) {
-               keys = ch_malloc( sizeof( struct berval ) );
-               keys[0] = NULL;
+       if( value.bv_val == NULL ) {
+               keys = ch_malloc( sizeof( struct berval ) );
+               keys[0].bv_val = NULL;
                return LDAP_SUCCESS;
        }
 
-       keys = ch_malloc( sizeof( struct berval ) * 2 );
+       keys = ch_malloc( sizeof( struct berval ) * 2 );
 
        HASH_Init( &HASHcontext );
        if( prefix != NULL && prefix->bv_len > 0 ) {
@@ -1271,13 +1272,13 @@ static int caseExactIgnoreFilter(
        HASH_Update( &HASHcontext,
                mr->smr_oid, mlen );
        HASH_Update( &HASHcontext,
-               value->bv_val, value->bv_len );
+               value.bv_val, value.bv_len );
        HASH_Final( HASHdigest, &HASHcontext );
 
-       keys[0] = ber_bvdup( &digest );
-       keys[1] = NULL;
+       ber_dupbv( keys, &digest );
+       keys[1].bv_val = NULL;
 
-       ber_bvfree( value );
+       free( value.bv_val );
 
        *keysp = keys;
        return LDAP_SUCCESS;
@@ -1290,14 +1291,14 @@ static int caseExactIgnoreSubstringsIndexer(
        Syntax *syntax,
        MatchingRule *mr,
        struct berval *prefix,
-       struct berval **values,
-       struct berval ***keysp )
+       BVarray values,
+       BVarray *keysp )
 {
-       char casefold;
+       unsigned casefold;
        ber_len_t i, nkeys;
        size_t slen, mlen;
-       struct berval **keys;
-       struct berval **nvalues;
+       BVarray keys;
+       BVarray nvalues;
 
        HASH_CONTEXT   HASHcontext;
        unsigned char   HASHdigest[HASH_BYTES];
@@ -1307,7 +1308,7 @@ static int caseExactIgnoreSubstringsIndexer(
 
        nkeys=0;
 
-       for( i=0; values[i] != NULL; i++ ) {
+       for( i=0; values[i].bv_val != NULL; i++ ) {
                /* empty - just count them */
        }
 
@@ -1315,43 +1316,43 @@ static int caseExactIgnoreSubstringsIndexer(
        assert( i > 0 );
 
        casefold = strcmp( mr->smr_oid, caseExactSubstringsMatchOID )
-               ? UTF8_CASEFOLD : UTF8_NOCASEFOLD;
+               ? LDAP_UTF8_CASEFOLD : LDAP_UTF8_NOCASEFOLD;
 
-       nvalues = ch_malloc( sizeof( struct berval ) * (i+1) );
-       for( i=0; values[i] != NULL; i++ ) {
-               nvalues[i] = ber_bvstr( UTF8normalize( values[i],
-                       casefold ) );
+       nvalues = ch_malloc( sizeof( struct berval ) * (i+1) );
+       for( i=0; values[i].bv_val != NULL; i++ ) {
+               ber_str2bv( UTF8normalize( &values[i], casefold ),
+                       0, 0, &nvalues[i] );
        }
-       nvalues[i] = NULL;
+       nvalues[i].bv_val = NULL;
        values = nvalues;
 
-       for( i=0; values[i] != NULL; i++ ) {
+       for( i=0; values[i].bv_val != NULL; i++ ) {
                /* count number of indices to generate */
-               if( values[i]->bv_len < SLAP_INDEX_SUBSTR_MINLEN ) {
+               if( values[i].bv_len < SLAP_INDEX_SUBSTR_MINLEN ) {
                        continue;
                }
 
                if( flags & SLAP_INDEX_SUBSTR_INITIAL ) {
-                       if( values[i]->bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) {
+                       if( values[i].bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) {
                                nkeys += SLAP_INDEX_SUBSTR_MAXLEN -
                                        ( SLAP_INDEX_SUBSTR_MINLEN - 1);
                        } else {
-                               nkeys += values[i]->bv_len - ( SLAP_INDEX_SUBSTR_MINLEN - 1 );
+                               nkeys += values[i].bv_len - ( SLAP_INDEX_SUBSTR_MINLEN - 1 );
                        }
                }
 
                if( flags & SLAP_INDEX_SUBSTR_ANY ) {
-                       if( values[i]->bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) {
-                               nkeys += values[i]->bv_len - ( SLAP_INDEX_SUBSTR_MAXLEN - 1 );
+                       if( values[i].bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) {
+                               nkeys += values[i].bv_len - ( SLAP_INDEX_SUBSTR_MAXLEN - 1 );
                        }
                }
 
                if( flags & SLAP_INDEX_SUBSTR_FINAL ) {
-                       if( values[i]->bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) {
+                       if( values[i].bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) {
                                nkeys += SLAP_INDEX_SUBSTR_MAXLEN -
                                        ( SLAP_INDEX_SUBSTR_MINLEN - 1);
                        } else {
-                               nkeys += values[i]->bv_len - ( SLAP_INDEX_SUBSTR_MINLEN - 1 );
+                               nkeys += values[i].bv_len - ( SLAP_INDEX_SUBSTR_MINLEN - 1 );
                        }
                }
        }
@@ -1359,29 +1360,26 @@ static int caseExactIgnoreSubstringsIndexer(
        if( nkeys == 0 ) {
                /* no keys to generate */
                *keysp = NULL;
-               ber_bvecfree( nvalues );
+               bvarray_free( nvalues );
                return LDAP_SUCCESS;
        }
 
-       keys = ch_malloc( sizeof( struct berval ) * (nkeys+1) );
+       keys = ch_malloc( sizeof( struct berval ) * (nkeys+1) );
 
-       slen = strlen( syntax->ssyn_oid );
-       mlen = strlen( mr->smr_oid );
+       slen = syntax->ssyn_oidlen;
+       mlen = mr->smr_oidlen;
 
        nkeys=0;
-       for( i=0; values[i] != NULL; i++ ) {
+       for( i=0; values[i].bv_val != NULL; i++ ) {
                ber_len_t j,max;
-               struct berval *value;
-
-               if( values[i]->bv_len < SLAP_INDEX_SUBSTR_MINLEN ) continue;
 
-               value = values[i];
+               if( values[i].bv_len < SLAP_INDEX_SUBSTR_MINLEN ) continue;
 
                if( ( flags & SLAP_INDEX_SUBSTR_ANY ) &&
-                       ( value->bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) )
+                       ( values[i].bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) )
                {
                        char pre = SLAP_INDEX_SUBSTR_PREFIX;
-                       max = value->bv_len - ( SLAP_INDEX_SUBSTR_MAXLEN - 1);
+                       max = values[i].bv_len - ( SLAP_INDEX_SUBSTR_MAXLEN - 1);
 
                        for( j=0; j<max; j++ ) {
                                HASH_Init( &HASHcontext );
@@ -1397,16 +1395,16 @@ static int caseExactIgnoreSubstringsIndexer(
                                HASH_Update( &HASHcontext,
                                        mr->smr_oid, mlen );
                                HASH_Update( &HASHcontext,
-                                       &value->bv_val[j],
+                                       &values[i].bv_val[j],
                                        SLAP_INDEX_SUBSTR_MAXLEN );
                                HASH_Final( HASHdigest, &HASHcontext );
 
-                               keys[nkeys++] = ber_bvdup( &digest );
+                               ber_dupbv( &keys[nkeys++], &digest );
                        }
                }
 
-               max = SLAP_INDEX_SUBSTR_MAXLEN < value->bv_len
-                       ? SLAP_INDEX_SUBSTR_MAXLEN : value->bv_len;
+               max = SLAP_INDEX_SUBSTR_MAXLEN < values[i].bv_len
+                       ? SLAP_INDEX_SUBSTR_MAXLEN : values[i].bv_len;
 
                for( j=SLAP_INDEX_SUBSTR_MINLEN; j<=max; j++ ) {
                        char pre;
@@ -1425,10 +1423,10 @@ static int caseExactIgnoreSubstringsIndexer(
                                HASH_Update( &HASHcontext,
                                        mr->smr_oid, mlen );
                                HASH_Update( &HASHcontext,
-                                       value->bv_val, j );
+                                       values[i].bv_val, j );
                                HASH_Final( HASHdigest, &HASHcontext );
 
-                               keys[nkeys++] = ber_bvdup( &digest );
+                               ber_dupbv( &keys[nkeys++], &digest );
                        }
 
                        if( flags & SLAP_INDEX_SUBSTR_FINAL ) {
@@ -1445,10 +1443,10 @@ static int caseExactIgnoreSubstringsIndexer(
                                HASH_Update( &HASHcontext,
                                        mr->smr_oid, mlen );
                                HASH_Update( &HASHcontext,
-                                       &value->bv_val[value->bv_len-j], j );
+                                       &values[i].bv_val[values[i].bv_len-j], j );
                                HASH_Final( HASHdigest, &HASHcontext );
 
-                               keys[nkeys++] = ber_bvdup( &digest );
+                               ber_dupbv( &keys[nkeys++], &digest );
                        }
 
                }
@@ -1456,14 +1454,14 @@ static int caseExactIgnoreSubstringsIndexer(
        }
 
        if( nkeys > 0 ) {
-               keys[nkeys] = NULL;
+               keys[nkeys].bv_val = NULL;
                *keysp = keys;
        } else {
                ch_free( keys );
                *keysp = NULL;
        }
 
-       ber_bvecfree( nvalues );
+       bvarray_free( nvalues );
 
        return LDAP_SUCCESS;
 }
@@ -1475,20 +1473,21 @@ static int caseExactIgnoreSubstringsFilter(
        MatchingRule *mr,
        struct berval *prefix,
        void * assertValue,
-       struct berval ***keysp )
+       BVarray *keysp )
 {
        SubstringsAssertion *sa;
-       char pre, casefold;
+       char pre;
+       unsigned casefold;
        ber_len_t nkeys = 0;
        size_t slen, mlen, klen;
-       struct berval **keys;
+       BVarray keys;
        HASH_CONTEXT   HASHcontext;
        unsigned char   HASHdigest[HASH_BYTES];
        struct berval *value;
        struct berval digest;
 
        casefold = strcmp( mr->smr_oid, caseExactSubstringsMatchOID )
-               ? UTF8_CASEFOLD : UTF8_NOCASEFOLD;
+               ? LDAP_UTF8_CASEFOLD : LDAP_UTF8_NOCASEFOLD;
 
        sa = UTF8SubstringsassertionNormalize( assertValue, casefold );
        if( sa == NULL ) {
@@ -1496,33 +1495,33 @@ static int caseExactIgnoreSubstringsFilter(
                return LDAP_SUCCESS;
        }
 
-       if( flags & SLAP_INDEX_SUBSTR_INITIAL && sa->sa_initial != NULL &&
-               sa->sa_initial->bv_len >= SLAP_INDEX_SUBSTR_MINLEN )
+       if( flags & SLAP_INDEX_SUBSTR_INITIAL && sa->sa_initial.bv_val != NULL &&
+               sa->sa_initial.bv_len >= SLAP_INDEX_SUBSTR_MINLEN )
        {
                nkeys++;
        }
 
        if( flags & SLAP_INDEX_SUBSTR_ANY && sa->sa_any != NULL ) {
                ber_len_t i;
-               for( i=0; sa->sa_any[i] != NULL; i++ ) {
-                       if( sa->sa_any[i]->bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) {
+               for( i=0; sa->sa_any[i].bv_val != NULL; i++ ) {
+                       if( sa->sa_any[i].bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) {
                                /* don't bother accounting for stepping */
-                               nkeys += sa->sa_any[i]->bv_len -
+                               nkeys += sa->sa_any[i].bv_len -
                                        ( SLAP_INDEX_SUBSTR_MAXLEN - 1 );
                        }
                }
        }
 
-       if( flags & SLAP_INDEX_SUBSTR_FINAL && sa->sa_final != NULL &&
-               sa->sa_final->bv_len >= SLAP_INDEX_SUBSTR_MINLEN )
+       if( flags & SLAP_INDEX_SUBSTR_FINAL && sa->sa_final.bv_val != NULL &&
+               sa->sa_final.bv_len >= SLAP_INDEX_SUBSTR_MINLEN )
        {
                nkeys++;
        }
 
        if( nkeys == 0 ) {
-               ber_bvfree( sa->sa_final );
-               ber_bvecfree( sa->sa_any );
-               ber_bvfree( sa->sa_initial );
+               if ( sa->sa_final.bv_val ) free( sa->sa_final.bv_val );
+               if ( sa->sa_any ) bvarray_free( sa->sa_any );
+               if ( sa->sa_initial.bv_val ) free( sa->sa_initial.bv_val );
                ch_free( sa );
                *keysp = NULL;
                return LDAP_SUCCESS;
@@ -1531,17 +1530,17 @@ static int caseExactIgnoreSubstringsFilter(
        digest.bv_val = HASHdigest;
        digest.bv_len = sizeof(HASHdigest);
 
-       slen = strlen( syntax->ssyn_oid );
-       mlen = strlen( mr->smr_oid );
+       slen = syntax->ssyn_oidlen;
+       mlen = mr->smr_oidlen;
 
-       keys = ch_malloc( sizeof( struct berval ) * (nkeys+1) );
+       keys = ch_malloc( sizeof( struct berval ) * (nkeys+1) );
        nkeys = 0;
 
-       if( flags & SLAP_INDEX_SUBSTR_INITIAL && sa->sa_initial != NULL &&
-               sa->sa_initial->bv_len >= SLAP_INDEX_SUBSTR_MINLEN )
+       if( flags & SLAP_INDEX_SUBSTR_INITIAL && sa->sa_initial.bv_val != NULL &&
+               sa->sa_initial.bv_len >= SLAP_INDEX_SUBSTR_MINLEN )
        {
                pre = SLAP_INDEX_SUBSTR_INITIAL_PREFIX;
-               value = sa->sa_initial;
+               value = &sa->sa_initial;
 
                klen = SLAP_INDEX_SUBSTR_MAXLEN < value->bv_len
                        ? SLAP_INDEX_SUBSTR_MAXLEN : value->bv_len;
@@ -1561,7 +1560,7 @@ static int caseExactIgnoreSubstringsFilter(
                        value->bv_val, klen );
                HASH_Final( HASHdigest, &HASHcontext );
 
-               keys[nkeys++] = ber_bvdup( &digest );
+               ber_dupbv( &keys[nkeys++], &digest );
        }
 
        if( flags & SLAP_INDEX_SUBSTR_ANY && sa->sa_any != NULL ) {
@@ -1569,12 +1568,12 @@ static int caseExactIgnoreSubstringsFilter(
                pre = SLAP_INDEX_SUBSTR_PREFIX;
                klen = SLAP_INDEX_SUBSTR_MAXLEN;
 
-               for( i=0; sa->sa_any[i] != NULL; i++ ) {
-                       if( sa->sa_any[i]->bv_len < SLAP_INDEX_SUBSTR_MAXLEN ) {
+               for( i=0; sa->sa_any[i].bv_val != NULL; i++ ) {
+                       if( sa->sa_any[i].bv_len < SLAP_INDEX_SUBSTR_MAXLEN ) {
                                continue;
                        }
 
-                       value = sa->sa_any[i];
+                       value = &sa->sa_any[i];
 
                        for(j=0;
                                j <= value->bv_len - SLAP_INDEX_SUBSTR_MAXLEN;
@@ -1595,17 +1594,17 @@ static int caseExactIgnoreSubstringsFilter(
                                        &value->bv_val[j], klen ); 
                                HASH_Final( HASHdigest, &HASHcontext );
 
-                               keys[nkeys++] = ber_bvdup( &digest );
+                               ber_dupbv( &keys[nkeys++], &digest );
                        }
 
                }
        }
 
-       if( flags & SLAP_INDEX_SUBSTR_FINAL && sa->sa_final != NULL &&
-               sa->sa_final->bv_len >= SLAP_INDEX_SUBSTR_MINLEN )
+       if( flags & SLAP_INDEX_SUBSTR_FINAL && sa->sa_final.bv_val != NULL &&
+               sa->sa_final.bv_len >= SLAP_INDEX_SUBSTR_MINLEN )
        {
                pre = SLAP_INDEX_SUBSTR_FINAL_PREFIX;
-               value = sa->sa_final;
+               value = &sa->sa_final;
 
                klen = SLAP_INDEX_SUBSTR_MAXLEN < value->bv_len
                        ? SLAP_INDEX_SUBSTR_MAXLEN : value->bv_len;
@@ -1625,19 +1624,19 @@ static int caseExactIgnoreSubstringsFilter(
                        &value->bv_val[value->bv_len-klen], klen );
                HASH_Final( HASHdigest, &HASHcontext );
 
-               keys[nkeys++] = ber_bvdup( &digest );
+               ber_dupbv( &keys[nkeys++], &digest );
        }
 
        if( nkeys > 0 ) {
-               keys[nkeys] = NULL;
+               keys[nkeys].bv_val = NULL;
                *keysp = keys;
        } else {
                ch_free( keys );
                *keysp = NULL;
        }
-       ber_bvfree( sa->sa_final );
-       ber_bvecfree( sa->sa_any );
-       ber_bvfree( sa->sa_initial );
+       if ( sa->sa_final.bv_val ) free( sa->sa_final.bv_val );
+       if ( sa->sa_any ) bvarray_free( sa->sa_any );
+       if ( sa->sa_initial.bv_val ) free( sa->sa_initial.bv_val );
        ch_free( sa );
 
        return LDAP_SUCCESS;
@@ -1654,7 +1653,7 @@ caseIgnoreMatch(
 {
        *matchp = UTF8normcmp( value->bv_val,
                ((struct berval *) assertedValue)->bv_val,
-               UTF8_CASEFOLD );
+               LDAP_UTF8_CASEFOLD );
        return LDAP_SUCCESS;
 }
        
@@ -1815,11 +1814,10 @@ static int
 integerNormalize(
        Syntax *syntax,
        struct berval *val,
-       struct berval **normalized )
+       struct berval *normalized )
 {
        char *p;
        int negative=0;
-       struct berval *newval;
        ber_len_t len;
 
 
@@ -1847,24 +1845,21 @@ integerNormalize(
                len--;
        }
 
-       newval = (struct berval *) ch_malloc( sizeof(struct berval) );
-
        /* If there are no non-zero digits left, the number is zero, otherwise
           allocate space for the number and copy it into the buffer */
        if( len == 0 ) {
-               newval->bv_val = ch_strdup("0");
-               newval->bv_len = 1;
+               normalized->bv_val = ch_strdup("0");
+               normalized->bv_len = 1;
        }
        else {
-               newval->bv_len = len+negative;
-               newval->bv_val = ch_malloc( newval->bv_len );
+               normalized->bv_len = len+negative;
+               normalized->bv_val = ch_malloc( normalized->bv_len );
                if( negative ) {
-                       newval->bv_val[0] = '-';
+                       normalized->bv_val[0] = '-';
                }
-               memcpy( newval->bv_val + negative, p, len );
+               AC_MEMCPY( normalized->bv_val + negative, p, len );
        }
 
-       *normalized = newval;
        return LDAP_SUCCESS;
 }
 
@@ -1875,26 +1870,26 @@ static int integerIndexer(
        Syntax *syntax,
        MatchingRule *mr,
        struct berval *prefix,
-       struct berval **values,
-       struct berval ***keysp )
+       BVarray values,
+       BVarray *keysp )
 {
        int i;
-       struct berval **keys;
+       BVarray keys;
 
        /* we should have at least one value at this point */
-       assert( values != NULL && values[0] != NULL );
+       assert( values != NULL && values[0].bv_val != NULL );
 
-       for( i=0; values[i] != NULL; i++ ) {
+       for( i=0; values[i].bv_val != NULL; i++ ) {
                /* empty -- just count them */
        }
 
-       keys = ch_malloc( sizeof( struct berval ) * (i+1) );
+       keys = ch_malloc( sizeof( struct berval ) * (i+1) );
 
-       for( i=0; values[i] != NULL; i++ ) {
-               integerNormalize( syntax, values[i], &keys[i] );
+       for( i=0; values[i].bv_val != NULL; i++ ) {
+               integerNormalize( syntax, &values[i], &keys[i] );
        }
 
-       keys[i] = NULL;
+       keys[i].bv_val = NULL;
        *keysp = keys;
        return LDAP_SUCCESS;
 }
@@ -1907,13 +1902,13 @@ static int integerFilter(
        MatchingRule *mr,
        struct berval *prefix,
        void * assertValue,
-       struct berval ***keysp )
+       BVarray *keysp )
 {
-       struct berval **keys;
+       BVarray keys;
 
-       keys = ch_malloc( sizeof( struct berval ) * 2 );
+       keys = ch_malloc( sizeof( struct berval ) * 2 );
        integerNormalize( syntax, assertValue, &keys[0] );
-       keys[1] = NULL;
+       keys[1].bv_val = NULL;
        *keysp = keys;
 
        return LDAP_SUCCESS;
@@ -1944,8 +1939,6 @@ printableStringValidate(
 {
        ber_len_t i;
 
-       if( !val->bv_len ) return LDAP_INVALID_SYNTAX;
-
        for(i=0; i < val->bv_len; i++) {
                if( !SLAP_PRINTABLE(val->bv_val[i]) ) {
                        return LDAP_INVALID_SYNTAX;
@@ -1962,8 +1955,6 @@ printablesStringValidate(
 {
        ber_len_t i;
 
-       if( !val->bv_len ) return LDAP_INVALID_SYNTAX;
-
        for(i=0; i < val->bv_len; i++) {
                if( !SLAP_PRINTABLES(val->bv_val[i]) ) {
                        return LDAP_INVALID_SYNTAX;
@@ -1980,10 +1971,10 @@ IA5StringValidate(
 {
        ber_len_t i;
 
-       if( !val->bv_len ) return LDAP_INVALID_SYNTAX;
-
        for(i=0; i < val->bv_len; i++) {
-               if( !isascii(val->bv_val[i]) ) return LDAP_INVALID_SYNTAX;
+               if( !LDAP_ASCII(val->bv_val[i]) ) {
+                       return LDAP_INVALID_SYNTAX;
+               }
        }
 
        return LDAP_SUCCESS;
@@ -1993,13 +1984,10 @@ static int
 IA5StringNormalize(
        Syntax *syntax,
        struct berval *val,
-       struct berval **normalized )
+       struct berval *normalized )
 {
-       struct berval *newval;
        char *p, *q;
 
-       newval = ch_malloc( sizeof( struct berval ) );
-
        p = val->bv_val;
 
        /* Ignore initial whitespace */
@@ -2007,13 +1995,8 @@ IA5StringNormalize(
                p++;
        }
 
-       if( *p == '\0' ) {
-               ch_free( newval );
-               return LDAP_INVALID_SYNTAX;
-       }
-
-       newval->bv_val = ch_strdup( p );
-       p = q = newval->bv_val;
+       normalized->bv_val = ch_strdup( p );
+       p = q = normalized->bv_val;
 
        while ( *p ) {
                if ( ASCII_SPACE( *p ) ) {
@@ -2028,13 +2011,9 @@ IA5StringNormalize(
                }
        }
 
-       assert( *newval->bv_val );
-       assert( newval->bv_val < p );
+       assert( normalized->bv_val <= p );
        assert( q <= p );
 
-       /* cannot start with a space */
-       assert( !ASCII_SPACE(*newval->bv_val) );
-
        /*
         * If the string ended in space, backup the pointer one
         * position.  One is enough because the above loop collapsed
@@ -2045,14 +2024,10 @@ IA5StringNormalize(
                --q;
        }
 
-       /* cannot end with a space */
-       assert( !ASCII_SPACE( q[-1] ) );
-
        /* null terminate */
        *q = '\0';
 
-       newval->bv_len = q - newval->bv_val;
-       *normalized = newval;
+       normalized->bv_len = q - normalized->bv_val;
 
        return LDAP_SUCCESS;
 }
@@ -2094,56 +2069,56 @@ caseExactIA5SubstringsMatch(
        ber_len_t inlen=0;
 
        /* Add up asserted input length */
-       if( sub->sa_initial ) {
-               inlen += sub->sa_initial->bv_len;
+       if( sub->sa_initial.bv_val ) {
+               inlen += sub->sa_initial.bv_len;
        }
        if( sub->sa_any ) {
-               for(i=0; sub->sa_any[i] != NULL; i++) {
-                       inlen += sub->sa_any[i]->bv_len;
+               for(i=0; sub->sa_any[i].bv_val != NULL; i++) {
+                       inlen += sub->sa_any[i].bv_len;
                }
        }
-       if( sub->sa_final ) {
-               inlen += sub->sa_final->bv_len;
+       if( sub->sa_final.bv_val ) {
+               inlen += sub->sa_final.bv_len;
        }
 
-       if( sub->sa_initial ) {
+       if( sub->sa_initial.bv_val ) {
                if( inlen > left.bv_len ) {
                        match = 1;
                        goto done;
                }
 
-               match = strncmp( sub->sa_initial->bv_val, left.bv_val,
-                       sub->sa_initial->bv_len );
+               match = strncmp( sub->sa_initial.bv_val, left.bv_val,
+                       sub->sa_initial.bv_len );
 
                if( match != 0 ) {
                        goto done;
                }
 
-               left.bv_val += sub->sa_initial->bv_len;
-               left.bv_len -= sub->sa_initial->bv_len;
-               inlen -= sub->sa_initial->bv_len;
+               left.bv_val += sub->sa_initial.bv_len;
+               left.bv_len -= sub->sa_initial.bv_len;
+               inlen -= sub->sa_initial.bv_len;
        }
 
-       if( sub->sa_final ) {
+       if( sub->sa_final.bv_val ) {
                if( inlen > left.bv_len ) {
                        match = 1;
                        goto done;
                }
 
-               match = strncmp( sub->sa_final->bv_val,
-                       &left.bv_val[left.bv_len - sub->sa_final->bv_len],
-                       sub->sa_final->bv_len );
+               match = strncmp( sub->sa_final.bv_val,
+                       &left.bv_val[left.bv_len - sub->sa_final.bv_len],
+                       sub->sa_final.bv_len );
 
                if( match != 0 ) {
                        goto done;
                }
 
-               left.bv_len -= sub->sa_final->bv_len;
-               inlen -= sub->sa_final->bv_len;
+               left.bv_len -= sub->sa_final.bv_len;
+               inlen -= sub->sa_final.bv_len;
        }
 
        if( sub->sa_any ) {
-               for(i=0; sub->sa_any[i]; i++) {
+               for(i=0; sub->sa_any[i].bv_val; i++) {
                        ber_len_t idx;
                        char *p;
 
@@ -2154,11 +2129,11 @@ retry:
                                goto done;
                        }
 
-                       if( sub->sa_any[i]->bv_len == 0 ) {
+                       if( sub->sa_any[i].bv_len == 0 ) {
                                continue;
                        }
 
-                       p = strchr( left.bv_val, *sub->sa_any[i]->bv_val );
+                       p = strchr( left.bv_val, *sub->sa_any[i].bv_val );
 
                        if( p == NULL ) {
                                match = 1;
@@ -2176,15 +2151,15 @@ retry:
                        left.bv_val = p;
                        left.bv_len -= idx;
 
-                       if( sub->sa_any[i]->bv_len > left.bv_len ) {
+                       if( sub->sa_any[i].bv_len > left.bv_len ) {
                                /* not enough left */
                                match = 1;
                                goto done;
                        }
 
                        match = strncmp( left.bv_val,
-                               sub->sa_any[i]->bv_val,
-                               sub->sa_any[i]->bv_len );
+                               sub->sa_any[i].bv_val,
+                               sub->sa_any[i].bv_len );
 
                        if( match != 0 ) {
                                left.bv_val++;
@@ -2192,9 +2167,9 @@ retry:
                                goto retry;
                        }
 
-                       left.bv_val += sub->sa_any[i]->bv_len;
-                       left.bv_len -= sub->sa_any[i]->bv_len;
-                       inlen -= sub->sa_any[i]->bv_len;
+                       left.bv_val += sub->sa_any[i].bv_len;
+                       left.bv_len -= sub->sa_any[i].bv_len;
+                       inlen -= sub->sa_any[i].bv_len;
                }
        }
 
@@ -2210,32 +2185,32 @@ static int caseExactIA5Indexer(
        Syntax *syntax,
        MatchingRule *mr,
        struct berval *prefix,
-       struct berval **values,
-       struct berval ***keysp )
+       BVarray values,
+       BVarray *keysp )
 {
        int i;
        size_t slen, mlen;
-       struct berval **keys;
+       BVarray keys;
        HASH_CONTEXT   HASHcontext;
        unsigned char   HASHdigest[HASH_BYTES];
        struct berval digest;
        digest.bv_val = HASHdigest;
        digest.bv_len = sizeof(HASHdigest);
 
-       for( i=0; values[i] != NULL; i++ ) {
+       for( i=0; values[i].bv_val != NULL; i++ ) {
                /* empty - just count them */
        }
 
        /* we should have at least one value at this point */
        assert( i > 0 );
 
-       keys = ch_malloc( sizeof( struct berval ) * (i+1) );
+       keys = ch_malloc( sizeof( struct berval ) * (i+1) );
 
-       slen = strlen( syntax->ssyn_oid );
-       mlen = strlen( mr->smr_oid );
+       slen = syntax->ssyn_oidlen;
+       mlen = mr->smr_oidlen;
 
-       for( i=0; values[i] != NULL; i++ ) {
-               struct berval *value = values[i];
+       for( i=0; values[i].bv_val != NULL; i++ ) {
+               struct berval *value = &values[i];
 
                HASH_Init( &HASHcontext );
                if( prefix != NULL && prefix->bv_len > 0 ) {
@@ -2250,10 +2225,10 @@ static int caseExactIA5Indexer(
                        value->bv_val, value->bv_len );
                HASH_Final( HASHdigest, &HASHcontext );
 
-               keys[i] = ber_bvdup( &digest );
+               ber_dupbv( &keys[i], &digest );
        }
 
-       keys[i] = NULL;
+       keys[i].bv_val = NULL;
        *keysp = keys;
        return LDAP_SUCCESS;
 }
@@ -2266,10 +2241,10 @@ static int caseExactIA5Filter(
        MatchingRule *mr,
        struct berval *prefix,
        void * assertValue,
-       struct berval ***keysp )
+       BVarray *keysp )
 {
        size_t slen, mlen;
-       struct berval **keys;
+       BVarray keys;
        HASH_CONTEXT   HASHcontext;
        unsigned char   HASHdigest[HASH_BYTES];
        struct berval *value;
@@ -2277,12 +2252,12 @@ static int caseExactIA5Filter(
        digest.bv_val = HASHdigest;
        digest.bv_len = sizeof(HASHdigest);
 
-       slen = strlen( syntax->ssyn_oid );
-       mlen = strlen( mr->smr_oid );
+       slen = syntax->ssyn_oidlen;
+       mlen = mr->smr_oidlen;
 
        value = (struct berval *) assertValue;
 
-       keys = ch_malloc( sizeof( struct berval ) * 2 );
+       keys = ch_malloc( sizeof( struct berval ) * 2 );
 
        HASH_Init( &HASHcontext );
        if( prefix != NULL && prefix->bv_len > 0 ) {
@@ -2297,8 +2272,8 @@ static int caseExactIA5Filter(
                value->bv_val, value->bv_len );
        HASH_Final( HASHdigest, &HASHcontext );
 
-       keys[0] = ber_bvdup( &digest );
-       keys[1] = NULL;
+       ber_dupbv( &keys[0], &digest );
+       keys[1].bv_val = NULL;
 
        *keysp = keys;
        return LDAP_SUCCESS;
@@ -2311,12 +2286,12 @@ static int caseExactIA5SubstringsIndexer(
        Syntax *syntax,
        MatchingRule *mr,
        struct berval *prefix,
-       struct berval **values,
-       struct berval ***keysp )
+       BVarray values,
+       BVarray *keysp )
 {
        ber_len_t i, nkeys;
        size_t slen, mlen;
-       struct berval **keys;
+       BVarray keys;
        HASH_CONTEXT   HASHcontext;
        unsigned char   HASHdigest[HASH_BYTES];
        struct berval digest;
@@ -2324,36 +2299,36 @@ static int caseExactIA5SubstringsIndexer(
        digest.bv_len = sizeof(HASHdigest);
 
        /* we should have at least one value at this point */
-       assert( values != NULL && values[0] != NULL );
+       assert( values != NULL && values[0].bv_val != NULL );
 
        nkeys=0;
-       for( i=0; values[i] != NULL; i++ ) {
+       for( i=0; values[i].bv_val != NULL; i++ ) {
                /* count number of indices to generate */
-               if( values[i]->bv_len < SLAP_INDEX_SUBSTR_MINLEN ) {
+               if( values[i].bv_len < SLAP_INDEX_SUBSTR_MINLEN ) {
                        continue;
                }
 
                if( flags & SLAP_INDEX_SUBSTR_INITIAL ) {
-                       if( values[i]->bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) {
+                       if( values[i].bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) {
                                nkeys += SLAP_INDEX_SUBSTR_MAXLEN -
                                        ( SLAP_INDEX_SUBSTR_MINLEN - 1);
                        } else {
-                               nkeys += values[i]->bv_len - ( SLAP_INDEX_SUBSTR_MINLEN - 1 );
+                               nkeys += values[i].bv_len - ( SLAP_INDEX_SUBSTR_MINLEN - 1 );
                        }
                }
 
                if( flags & SLAP_INDEX_SUBSTR_ANY ) {
-                       if( values[i]->bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) {
-                               nkeys += values[i]->bv_len - ( SLAP_INDEX_SUBSTR_MAXLEN - 1 );
+                       if( values[i].bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) {
+                               nkeys += values[i].bv_len - ( SLAP_INDEX_SUBSTR_MAXLEN - 1 );
                        }
                }
 
                if( flags & SLAP_INDEX_SUBSTR_FINAL ) {
-                       if( values[i]->bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) {
+                       if( values[i].bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) {
                                nkeys += SLAP_INDEX_SUBSTR_MAXLEN -
                                        ( SLAP_INDEX_SUBSTR_MINLEN - 1);
                        } else {
-                               nkeys += values[i]->bv_len - ( SLAP_INDEX_SUBSTR_MINLEN - 1 );
+                               nkeys += values[i].bv_len - ( SLAP_INDEX_SUBSTR_MINLEN - 1 );
                        }
                }
        }
@@ -2364,17 +2339,17 @@ static int caseExactIA5SubstringsIndexer(
                return LDAP_SUCCESS;
        }
 
-       keys = ch_malloc( sizeof( struct berval ) * (nkeys+1) );
+       keys = ch_malloc( sizeof( struct berval ) * (nkeys+1) );
 
-       slen = strlen( syntax->ssyn_oid );
-       mlen = strlen( mr->smr_oid );
+       slen = syntax->ssyn_oidlen;
+       mlen = mr->smr_oidlen;
 
        nkeys=0;
-       for( i=0; values[i] != NULL; i++ ) {
+       for( i=0; values[i].bv_val != NULL; i++ ) {
                ber_len_t j,max;
                struct berval *value;
 
-               value = values[i];
+               value = &values[i];
                if( value->bv_len < SLAP_INDEX_SUBSTR_MINLEN ) continue;
 
                if( ( flags & SLAP_INDEX_SUBSTR_ANY ) &&
@@ -2401,7 +2376,7 @@ static int caseExactIA5SubstringsIndexer(
                                        SLAP_INDEX_SUBSTR_MAXLEN );
                                HASH_Final( HASHdigest, &HASHcontext );
 
-                               keys[nkeys++] = ber_bvdup( &digest );
+                               ber_dupbv( &keys[nkeys++], &digest );
                        }
                }
 
@@ -2428,7 +2403,7 @@ static int caseExactIA5SubstringsIndexer(
                                        value->bv_val, j );
                                HASH_Final( HASHdigest, &HASHcontext );
 
-                               keys[nkeys++] = ber_bvdup( &digest );
+                               ber_dupbv( &keys[nkeys++], &digest );
                        }
 
                        if( flags & SLAP_INDEX_SUBSTR_FINAL ) {
@@ -2448,14 +2423,14 @@ static int caseExactIA5SubstringsIndexer(
                                        &value->bv_val[value->bv_len-j], j );
                                HASH_Final( HASHdigest, &HASHcontext );
 
-                               keys[nkeys++] = ber_bvdup( &digest );
+                               ber_dupbv( &keys[nkeys++], &digest );
                        }
 
                }
        }
 
        if( nkeys > 0 ) {
-               keys[nkeys] = NULL;
+               keys[nkeys].bv_val = NULL;
                *keysp = keys;
        } else {
                ch_free( keys );
@@ -2472,37 +2447,37 @@ static int caseExactIA5SubstringsFilter(
        MatchingRule *mr,
        struct berval *prefix,
        void * assertValue,
-       struct berval ***keysp )
+       BVarray *keysp )
 {
        SubstringsAssertion *sa = assertValue;
        char pre;
        ber_len_t nkeys = 0;
        size_t slen, mlen, klen;
-       struct berval **keys;
+       BVarray keys;
        HASH_CONTEXT   HASHcontext;
        unsigned char   HASHdigest[HASH_BYTES];
        struct berval *value;
        struct berval digest;
 
-       if( flags & SLAP_INDEX_SUBSTR_INITIAL && sa->sa_initial != NULL &&
-               sa->sa_initial->bv_len >= SLAP_INDEX_SUBSTR_MINLEN )
+       if( flags & SLAP_INDEX_SUBSTR_INITIAL && sa->sa_initial.bv_val != NULL &&
+               sa->sa_initial.bv_len >= SLAP_INDEX_SUBSTR_MINLEN )
        {
                nkeys++;
        }
 
        if( flags & SLAP_INDEX_SUBSTR_ANY && sa->sa_any != NULL ) {
                ber_len_t i;
-               for( i=0; sa->sa_any[i] != NULL; i++ ) {
-                       if( sa->sa_any[i]->bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) {
+               for( i=0; sa->sa_any[i].bv_val != NULL; i++ ) {
+                       if( sa->sa_any[i].bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) {
                                /* don't bother accounting for stepping */
-                               nkeys += sa->sa_any[i]->bv_len -
+                               nkeys += sa->sa_any[i].bv_len -
                                        ( SLAP_INDEX_SUBSTR_MAXLEN - 1 );
                        }
                }
        }
 
-       if( flags & SLAP_INDEX_SUBSTR_FINAL && sa->sa_final != NULL &&
-               sa->sa_final->bv_len >= SLAP_INDEX_SUBSTR_MINLEN )
+       if( flags & SLAP_INDEX_SUBSTR_FINAL && sa->sa_final.bv_val != NULL &&
+               sa->sa_final.bv_len >= SLAP_INDEX_SUBSTR_MINLEN )
        {
                nkeys++;
        }
@@ -2515,17 +2490,17 @@ static int caseExactIA5SubstringsFilter(
        digest.bv_val = HASHdigest;
        digest.bv_len = sizeof(HASHdigest);
 
-       slen = strlen( syntax->ssyn_oid );
-       mlen = strlen( mr->smr_oid );
+       slen = syntax->ssyn_oidlen;
+       mlen = mr->smr_oidlen;
 
-       keys = ch_malloc( sizeof( struct berval ) * (nkeys+1) );
+       keys = ch_malloc( sizeof( struct berval ) * (nkeys+1) );
        nkeys = 0;
 
-       if( flags & SLAP_INDEX_SUBSTR_INITIAL && sa->sa_initial != NULL &&
-               sa->sa_initial->bv_len >= SLAP_INDEX_SUBSTR_MINLEN )
+       if( flags & SLAP_INDEX_SUBSTR_INITIAL && sa->sa_initial.bv_val != NULL &&
+               sa->sa_initial.bv_len >= SLAP_INDEX_SUBSTR_MINLEN )
        {
                pre = SLAP_INDEX_SUBSTR_INITIAL_PREFIX;
-               value = sa->sa_initial;
+               value = &sa->sa_initial;
 
                klen = SLAP_INDEX_SUBSTR_MAXLEN < value->bv_len
                        ? SLAP_INDEX_SUBSTR_MAXLEN : value->bv_len;
@@ -2545,7 +2520,7 @@ static int caseExactIA5SubstringsFilter(
                        value->bv_val, klen );
                HASH_Final( HASHdigest, &HASHcontext );
 
-               keys[nkeys++] = ber_bvdup( &digest );
+               ber_dupbv( &keys[nkeys++], &digest );
        }
 
        if( flags & SLAP_INDEX_SUBSTR_ANY && sa->sa_any != NULL ) {
@@ -2553,12 +2528,12 @@ static int caseExactIA5SubstringsFilter(
                pre = SLAP_INDEX_SUBSTR_PREFIX;
                klen = SLAP_INDEX_SUBSTR_MAXLEN;
 
-               for( i=0; sa->sa_any[i] != NULL; i++ ) {
-                       if( sa->sa_any[i]->bv_len < SLAP_INDEX_SUBSTR_MAXLEN ) {
+               for( i=0; sa->sa_any[i].bv_val != NULL; i++ ) {
+                       if( sa->sa_any[i].bv_len < SLAP_INDEX_SUBSTR_MAXLEN ) {
                                continue;
                        }
 
-                       value = sa->sa_any[i];
+                       value = &sa->sa_any[i];
 
                        for(j=0;
                                j <= value->bv_len - SLAP_INDEX_SUBSTR_MAXLEN;
@@ -2579,16 +2554,16 @@ static int caseExactIA5SubstringsFilter(
                                        &value->bv_val[j], klen ); 
                                HASH_Final( HASHdigest, &HASHcontext );
 
-                               keys[nkeys++] = ber_bvdup( &digest );
+                               ber_dupbv( &keys[nkeys++], &digest );
                        }
                }
        }
 
-       if( flags & SLAP_INDEX_SUBSTR_FINAL && sa->sa_final != NULL &&
-               sa->sa_final->bv_len >= SLAP_INDEX_SUBSTR_MINLEN )
+       if( flags & SLAP_INDEX_SUBSTR_FINAL && sa->sa_final.bv_val != NULL &&
+               sa->sa_final.bv_len >= SLAP_INDEX_SUBSTR_MINLEN )
        {
                pre = SLAP_INDEX_SUBSTR_FINAL_PREFIX;
-               value = sa->sa_final;
+               value = &sa->sa_final;
 
                klen = SLAP_INDEX_SUBSTR_MAXLEN < value->bv_len
                        ? SLAP_INDEX_SUBSTR_MAXLEN : value->bv_len;
@@ -2608,11 +2583,11 @@ static int caseExactIA5SubstringsFilter(
                        &value->bv_val[value->bv_len-klen], klen );
                HASH_Final( HASHdigest, &HASHcontext );
 
-               keys[nkeys++] = ber_bvdup( &digest );
+               ber_dupbv( &keys[nkeys++], &digest );
        }
 
        if( nkeys > 0 ) {
-               keys[nkeys] = NULL;
+               keys[nkeys].bv_val = NULL;
                *keysp = keys;
        } else {
                ch_free( keys );
@@ -2659,56 +2634,56 @@ caseIgnoreIA5SubstringsMatch(
        ber_len_t inlen=0;
 
        /* Add up asserted input length */
-       if( sub->sa_initial ) {
-               inlen += sub->sa_initial->bv_len;
+       if( sub->sa_initial.bv_val ) {
+               inlen += sub->sa_initial.bv_len;
        }
        if( sub->sa_any ) {
-               for(i=0; sub->sa_any[i] != NULL; i++) {
-                       inlen += sub->sa_any[i]->bv_len;
+               for(i=0; sub->sa_any[i].bv_val != NULL; i++) {
+                       inlen += sub->sa_any[i].bv_len;
                }
        }
-       if( sub->sa_final ) {
-               inlen += sub->sa_final->bv_len;
+       if( sub->sa_final.bv_val ) {
+               inlen += sub->sa_final.bv_len;
        }
 
-       if( sub->sa_initial ) {
+       if( sub->sa_initial.bv_val ) {
                if( inlen > left.bv_len ) {
                        match = 1;
                        goto done;
                }
 
-               match = strncasecmp( sub->sa_initial->bv_val, left.bv_val,
-                       sub->sa_initial->bv_len );
+               match = strncasecmp( sub->sa_initial.bv_val, left.bv_val,
+                       sub->sa_initial.bv_len );
 
                if( match != 0 ) {
                        goto done;
                }
 
-               left.bv_val += sub->sa_initial->bv_len;
-               left.bv_len -= sub->sa_initial->bv_len;
-               inlen -= sub->sa_initial->bv_len;
+               left.bv_val += sub->sa_initial.bv_len;
+               left.bv_len -= sub->sa_initial.bv_len;
+               inlen -= sub->sa_initial.bv_len;
        }
 
-       if( sub->sa_final ) {
+       if( sub->sa_final.bv_val ) {
                if( inlen > left.bv_len ) {
                        match = 1;
                        goto done;
                }
 
-               match = strncasecmp( sub->sa_final->bv_val,
-                       &left.bv_val[left.bv_len - sub->sa_final->bv_len],
-                       sub->sa_final->bv_len );
+               match = strncasecmp( sub->sa_final.bv_val,
+                       &left.bv_val[left.bv_len - sub->sa_final.bv_len],
+                       sub->sa_final.bv_len );
 
                if( match != 0 ) {
                        goto done;
                }
 
-               left.bv_len -= sub->sa_final->bv_len;
-               inlen -= sub->sa_final->bv_len;
+               left.bv_len -= sub->sa_final.bv_len;
+               inlen -= sub->sa_final.bv_len;
        }
 
        if( sub->sa_any ) {
-               for(i=0; sub->sa_any[i]; i++) {
+               for(i=0; sub->sa_any[i].bv_val; i++) {
                        ber_len_t idx;
                        char *p;
 
@@ -2719,11 +2694,11 @@ retry:
                                goto done;
                        }
 
-                       if( sub->sa_any[i]->bv_len == 0 ) {
+                       if( sub->sa_any[i].bv_len == 0 ) {
                                continue;
                        }
 
-                       p = strcasechr( left.bv_val, *sub->sa_any[i]->bv_val );
+                       p = strcasechr( left.bv_val, *sub->sa_any[i].bv_val );
 
                        if( p == NULL ) {
                                match = 1;
@@ -2741,15 +2716,15 @@ retry:
                        left.bv_val = p;
                        left.bv_len -= idx;
 
-                       if( sub->sa_any[i]->bv_len > left.bv_len ) {
+                       if( sub->sa_any[i].bv_len > left.bv_len ) {
                                /* not enough left */
                                match = 1;
                                goto done;
                        }
 
                        match = strncasecmp( left.bv_val,
-                               sub->sa_any[i]->bv_val,
-                               sub->sa_any[i]->bv_len );
+                               sub->sa_any[i].bv_val,
+                               sub->sa_any[i].bv_len );
 
                        if( match != 0 ) {
                                left.bv_val++;
@@ -2758,9 +2733,9 @@ retry:
                                goto retry;
                        }
 
-                       left.bv_val += sub->sa_any[i]->bv_len;
-                       left.bv_len -= sub->sa_any[i]->bv_len;
-                       inlen -= sub->sa_any[i]->bv_len;
+                       left.bv_val += sub->sa_any[i].bv_len;
+                       left.bv_len -= sub->sa_any[i].bv_len;
+                       inlen -= sub->sa_any[i].bv_len;
                }
        }
 
@@ -2776,12 +2751,12 @@ static int caseIgnoreIA5Indexer(
        Syntax *syntax,
        MatchingRule *mr,
        struct berval *prefix,
-       struct berval **values,
-       struct berval ***keysp )
+       BVarray values,
+       BVarray *keysp )
 {
        int i;
        size_t slen, mlen;
-       struct berval **keys;
+       BVarray keys;
        HASH_CONTEXT   HASHcontext;
        unsigned char   HASHdigest[HASH_BYTES];
        struct berval digest;
@@ -2789,20 +2764,21 @@ static int caseIgnoreIA5Indexer(
        digest.bv_len = sizeof(HASHdigest);
 
        /* we should have at least one value at this point */
-       assert( values != NULL && values[0] != NULL );
+       assert( values != NULL && values[0].bv_val != NULL );
 
-       for( i=0; values[i] != NULL; i++ ) {
+       for( i=0; values[i].bv_val != NULL; i++ ) {
                /* just count them */
        }
 
-       keys = ch_malloc( sizeof( struct berval ) * (i+1) );
+       keys = ch_malloc( sizeof( struct berval ) * (i+1) );
 
-       slen = strlen( syntax->ssyn_oid );
-       mlen = strlen( mr->smr_oid );
+       slen = syntax->ssyn_oidlen;
+       mlen = mr->smr_oidlen;
 
-       for( i=0; values[i] != NULL; i++ ) {
-               struct berval *value = ber_bvdup( values[i] );
-               ldap_pvt_str2upper( value->bv_val );
+       for( i=0; values[i].bv_val != NULL; i++ ) {
+               struct berval value;
+               ber_dupbv( &value, &values[i] );
+               ldap_pvt_str2upper( value.bv_val );
 
                HASH_Init( &HASHcontext );
                if( prefix != NULL && prefix->bv_len > 0 ) {
@@ -2814,15 +2790,15 @@ static int caseIgnoreIA5Indexer(
                HASH_Update( &HASHcontext,
                        mr->smr_oid, mlen );
                HASH_Update( &HASHcontext,
-                       value->bv_val, value->bv_len );
+                       value.bv_val, value.bv_len );
                HASH_Final( HASHdigest, &HASHcontext );
 
-               ber_bvfree( value );
+               free( value.bv_val );
 
-               keys[i] = ber_bvdup( &digest );
+               ber_dupbv( &keys[i], &digest );
        }
 
-       keys[i] = NULL;
+       keys[i].bv_val = NULL;
        *keysp = keys;
        return LDAP_SUCCESS;
 }
@@ -2835,24 +2811,24 @@ static int caseIgnoreIA5Filter(
        MatchingRule *mr,
        struct berval *prefix,
        void * assertValue,
-       struct berval ***keysp )
+       BVarray *keysp )
 {
        size_t slen, mlen;
-       struct berval **keys;
+       BVarray keys;
        HASH_CONTEXT   HASHcontext;
        unsigned char   HASHdigest[HASH_BYTES];
-       struct berval *value;
+       struct berval value;
        struct berval digest;
        digest.bv_val = HASHdigest;
        digest.bv_len = sizeof(HASHdigest);
 
-       slen = strlen( syntax->ssyn_oid );
-       mlen = strlen( mr->smr_oid );
+       slen = syntax->ssyn_oidlen;
+       mlen = mr->smr_oidlen;
 
-       value = ber_bvdup( (struct berval *) assertValue );
-       ldap_pvt_str2upper( value->bv_val );
+       ber_dupbv( &value, (struct berval *) assertValue );
+       ldap_pvt_str2upper( value.bv_val );
 
-       keys = ch_malloc( sizeof( struct berval ) * 2 );
+       keys = ch_malloc( sizeof( struct berval ) * 2 );
 
        HASH_Init( &HASHcontext );
        if( prefix != NULL && prefix->bv_len > 0 ) {
@@ -2864,13 +2840,13 @@ static int caseIgnoreIA5Filter(
        HASH_Update( &HASHcontext,
                mr->smr_oid, mlen );
        HASH_Update( &HASHcontext,
-               value->bv_val, value->bv_len );
+               value.bv_val, value.bv_len );
        HASH_Final( HASHdigest, &HASHcontext );
 
-       keys[0] = ber_bvdup( &digest );
-       keys[1] = NULL;
+       ber_dupbv( &keys[0], &digest );
+       keys[1].bv_val = NULL;
 
-       ber_bvfree( value );
+       free( value.bv_val );
 
        *keysp = keys;
 
@@ -2884,12 +2860,12 @@ static int caseIgnoreIA5SubstringsIndexer(
        Syntax *syntax,
        MatchingRule *mr,
        struct berval *prefix,
-       struct berval **values,
-       struct berval ***keysp )
+       BVarray values,
+       BVarray *keysp )
 {
        ber_len_t i, nkeys;
        size_t slen, mlen;
-       struct berval **keys;
+       BVarray keys;
        HASH_CONTEXT   HASHcontext;
        unsigned char   HASHdigest[HASH_BYTES];
        struct berval digest;
@@ -2897,36 +2873,36 @@ static int caseIgnoreIA5SubstringsIndexer(
        digest.bv_len = sizeof(HASHdigest);
 
        /* we should have at least one value at this point */
-       assert( values != NULL && values[0] != NULL );
+       assert( values != NULL && values[0].bv_val != NULL );
 
        nkeys=0;
-       for( i=0; values[i] != NULL; i++ ) {
+       for( i=0; values[i].bv_val != NULL; i++ ) {
                /* count number of indices to generate */
-               if( values[i]->bv_len < SLAP_INDEX_SUBSTR_MINLEN ) {
+               if( values[i].bv_len < SLAP_INDEX_SUBSTR_MINLEN ) {
                        continue;
                }
 
                if( flags & SLAP_INDEX_SUBSTR_INITIAL ) {
-                       if( values[i]->bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) {
+                       if( values[i].bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) {
                                nkeys += SLAP_INDEX_SUBSTR_MAXLEN -
                                        ( SLAP_INDEX_SUBSTR_MINLEN - 1);
                        } else {
-                               nkeys += values[i]->bv_len - ( SLAP_INDEX_SUBSTR_MINLEN - 1 );
+                               nkeys += values[i].bv_len - ( SLAP_INDEX_SUBSTR_MINLEN - 1 );
                        }
                }
 
                if( flags & SLAP_INDEX_SUBSTR_ANY ) {
-                       if( values[i]->bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) {
-                               nkeys += values[i]->bv_len - ( SLAP_INDEX_SUBSTR_MAXLEN - 1 );
+                       if( values[i].bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) {
+                               nkeys += values[i].bv_len - ( SLAP_INDEX_SUBSTR_MAXLEN - 1 );
                        }
                }
 
                if( flags & SLAP_INDEX_SUBSTR_FINAL ) {
-                       if( values[i]->bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) {
+                       if( values[i].bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) {
                                nkeys += SLAP_INDEX_SUBSTR_MAXLEN -
                                        ( SLAP_INDEX_SUBSTR_MINLEN - 1);
                        } else {
-                               nkeys += values[i]->bv_len - ( SLAP_INDEX_SUBSTR_MINLEN - 1 );
+                               nkeys += values[i].bv_len - ( SLAP_INDEX_SUBSTR_MINLEN - 1 );
                        }
                }
        }
@@ -2937,26 +2913,26 @@ static int caseIgnoreIA5SubstringsIndexer(
                return LDAP_SUCCESS;
        }
 
-       keys = ch_malloc( sizeof( struct berval ) * (nkeys+1) );
+       keys = ch_malloc( sizeof( struct berval ) * (nkeys+1) );
 
-       slen = strlen( syntax->ssyn_oid );
-       mlen = strlen( mr->smr_oid );
+       slen = syntax->ssyn_oidlen;
+       mlen = mr->smr_oidlen;
 
        nkeys=0;
-       for( i=0; values[i] != NULL; i++ ) {
+       for( i=0; values[i].bv_val != NULL; i++ ) {
                int j,max;
-               struct berval *value;
+               struct berval value;
 
-               if( values[i]->bv_len < SLAP_INDEX_SUBSTR_MINLEN ) continue;
+               if( values[i].bv_len < SLAP_INDEX_SUBSTR_MINLEN ) continue;
 
-               value = ber_bvdup( values[i] );
-               ldap_pvt_str2upper( value->bv_val );
+               ber_dupbv( &value, &values[i] );
+               ldap_pvt_str2upper( value.bv_val );
 
                if( ( flags & SLAP_INDEX_SUBSTR_ANY ) &&
-                       ( value->bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) )
+                       ( value.bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) )
                {
                        char pre = SLAP_INDEX_SUBSTR_PREFIX;
-                       max = value->bv_len - ( SLAP_INDEX_SUBSTR_MAXLEN - 1);
+                       max = value.bv_len - ( SLAP_INDEX_SUBSTR_MAXLEN - 1);
 
                        for( j=0; j<max; j++ ) {
                                HASH_Init( &HASHcontext );
@@ -2972,16 +2948,16 @@ static int caseIgnoreIA5SubstringsIndexer(
                                HASH_Update( &HASHcontext,
                                        mr->smr_oid, mlen );
                                HASH_Update( &HASHcontext,
-                                       &value->bv_val[j],
+                                       &value.bv_val[j],
                                        SLAP_INDEX_SUBSTR_MAXLEN );
                                HASH_Final( HASHdigest, &HASHcontext );
 
-                               keys[nkeys++] = ber_bvdup( &digest );
+                               ber_dupbv( &keys[nkeys++], &digest );
                        }
                }
 
-               max = SLAP_INDEX_SUBSTR_MAXLEN < value->bv_len
-                       ? SLAP_INDEX_SUBSTR_MAXLEN : value->bv_len;
+               max = SLAP_INDEX_SUBSTR_MAXLEN < value.bv_len
+                       ? SLAP_INDEX_SUBSTR_MAXLEN : value.bv_len;
 
                for( j=SLAP_INDEX_SUBSTR_MINLEN; j<=max; j++ ) {
                        char pre;
@@ -3000,10 +2976,10 @@ static int caseIgnoreIA5SubstringsIndexer(
                                HASH_Update( &HASHcontext,
                                        mr->smr_oid, mlen );
                                HASH_Update( &HASHcontext,
-                                       value->bv_val, j );
+                                       value.bv_val, j );
                                HASH_Final( HASHdigest, &HASHcontext );
 
-                               keys[nkeys++] = ber_bvdup( &digest );
+                               ber_dupbv( &keys[nkeys++], &digest );
                        }
 
                        if( flags & SLAP_INDEX_SUBSTR_FINAL ) {
@@ -3020,19 +2996,19 @@ static int caseIgnoreIA5SubstringsIndexer(
                                HASH_Update( &HASHcontext,
                                        mr->smr_oid, mlen );
                                HASH_Update( &HASHcontext,
-                                       &value->bv_val[value->bv_len-j], j );
+                                       &value.bv_val[value.bv_len-j], j );
                                HASH_Final( HASHdigest, &HASHcontext );
 
-                               keys[nkeys++] = ber_bvdup( &digest );
+                               ber_dupbv( &keys[nkeys++], &digest );
                        }
 
                }
 
-               ber_bvfree( value );
+               free( value.bv_val );
        }
 
        if( nkeys > 0 ) {
-               keys[nkeys] = NULL;
+               keys[nkeys].bv_val = NULL;
                *keysp = keys;
        } else {
                ch_free( keys );
@@ -3049,37 +3025,37 @@ static int caseIgnoreIA5SubstringsFilter(
        MatchingRule *mr,
        struct berval *prefix,
        void * assertValue,
-       struct berval ***keysp )
+       BVarray *keysp )
 {
        SubstringsAssertion *sa = assertValue;
        char pre;
        ber_len_t nkeys = 0;
        size_t slen, mlen, klen;
-       struct berval **keys;
+       BVarray keys;
        HASH_CONTEXT   HASHcontext;
        unsigned char   HASHdigest[HASH_BYTES];
-       struct berval *value;
+       struct berval value;
        struct berval digest;
 
-       if((flags & SLAP_INDEX_SUBSTR_INITIAL) && sa->sa_initial != NULL &&
-               sa->sa_initial->bv_len >= SLAP_INDEX_SUBSTR_MINLEN )
+       if((flags & SLAP_INDEX_SUBSTR_INITIAL) && sa->sa_initial.bv_val != NULL &&
+               sa->sa_initial.bv_len >= SLAP_INDEX_SUBSTR_MINLEN )
        {
                nkeys++;
        }
 
        if((flags & SLAP_INDEX_SUBSTR_ANY) && sa->sa_any != NULL ) {
                ber_len_t i;
-               for( i=0; sa->sa_any[i] != NULL; i++ ) {
-                       if( sa->sa_any[i]->bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) {
+               for( i=0; sa->sa_any[i].bv_val != NULL; i++ ) {
+                       if( sa->sa_any[i].bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) {
                                /* don't bother accounting for stepping */
-                               nkeys += sa->sa_any[i]->bv_len -
+                               nkeys += sa->sa_any[i].bv_len -
                                        ( SLAP_INDEX_SUBSTR_MAXLEN - 1 );
                        }
                }
        }
 
-       if((flags & SLAP_INDEX_SUBSTR_FINAL) && sa->sa_final != NULL &&
-               sa->sa_final->bv_len >= SLAP_INDEX_SUBSTR_MINLEN )
+       if((flags & SLAP_INDEX_SUBSTR_FINAL) && sa->sa_final.bv_val != NULL &&
+               sa->sa_final.bv_len >= SLAP_INDEX_SUBSTR_MINLEN )
        {
                nkeys++;
        }
@@ -3092,21 +3068,21 @@ static int caseIgnoreIA5SubstringsFilter(
        digest.bv_val = HASHdigest;
        digest.bv_len = sizeof(HASHdigest);
 
-       slen = strlen( syntax->ssyn_oid );
-       mlen = strlen( mr->smr_oid );
+       slen = syntax->ssyn_oidlen;
+       mlen = mr->smr_oidlen;
 
-       keys = ch_malloc( sizeof( struct berval ) * (nkeys+1) );
+       keys = ch_malloc( sizeof( struct berval ) * (nkeys+1) );
        nkeys = 0;
 
-       if((flags & SLAP_INDEX_SUBSTR_INITIAL) && sa->sa_initial != NULL &&
-               sa->sa_initial->bv_len >= SLAP_INDEX_SUBSTR_MINLEN )
+       if((flags & SLAP_INDEX_SUBSTR_INITIAL) && sa->sa_initial.bv_val != NULL &&
+               sa->sa_initial.bv_len >= SLAP_INDEX_SUBSTR_MINLEN )
        {
                pre = SLAP_INDEX_SUBSTR_INITIAL_PREFIX;
-               value = ber_bvdup( sa->sa_initial );
-               ldap_pvt_str2upper( value->bv_val );
+               ber_dupbv( &value, &sa->sa_initial );
+               ldap_pvt_str2upper( value.bv_val );
 
-               klen = SLAP_INDEX_SUBSTR_MAXLEN < value->bv_len
-                       ? SLAP_INDEX_SUBSTR_MAXLEN : value->bv_len;
+               klen = SLAP_INDEX_SUBSTR_MAXLEN < value.bv_len
+                       ? SLAP_INDEX_SUBSTR_MAXLEN : value.bv_len;
 
                HASH_Init( &HASHcontext );
                if( prefix != NULL && prefix->bv_len > 0 ) {
@@ -3120,11 +3096,11 @@ static int caseIgnoreIA5SubstringsFilter(
                HASH_Update( &HASHcontext,
                        mr->smr_oid, mlen );
                HASH_Update( &HASHcontext,
-                       value->bv_val, klen );
+                       value.bv_val, klen );
                HASH_Final( HASHdigest, &HASHcontext );
 
-               ber_bvfree( value );
-               keys[nkeys++] = ber_bvdup( &digest );
+               free( value.bv_val );
+               ber_dupbv( &keys[nkeys++], &digest );
        }
 
        if((flags & SLAP_INDEX_SUBSTR_ANY) && sa->sa_any != NULL ) {
@@ -3132,16 +3108,16 @@ static int caseIgnoreIA5SubstringsFilter(
                pre = SLAP_INDEX_SUBSTR_PREFIX;
                klen = SLAP_INDEX_SUBSTR_MAXLEN;
 
-               for( i=0; sa->sa_any[i] != NULL; i++ ) {
-                       if( sa->sa_any[i]->bv_len < SLAP_INDEX_SUBSTR_MAXLEN ) {
+               for( i=0; sa->sa_any[i].bv_val != NULL; i++ ) {
+                       if( sa->sa_any[i].bv_len < SLAP_INDEX_SUBSTR_MAXLEN ) {
                                continue;
                        }
 
-                       value = ber_bvdup( sa->sa_any[i] );
-                       ldap_pvt_str2upper( value->bv_val );
+                       ber_dupbv( &value, &sa->sa_any[i] );
+                       ldap_pvt_str2upper( value.bv_val );
 
                        for(j=0;
-                               j <= value->bv_len - SLAP_INDEX_SUBSTR_MAXLEN;
+                               j <= value.bv_len - SLAP_INDEX_SUBSTR_MAXLEN;
                                j += SLAP_INDEX_SUBSTR_STEP )
                        {
                                HASH_Init( &HASHcontext );
@@ -3156,25 +3132,25 @@ static int caseIgnoreIA5SubstringsFilter(
                                HASH_Update( &HASHcontext,
                                        mr->smr_oid, mlen );
                                HASH_Update( &HASHcontext,
-                                       &value->bv_val[j], klen );
+                                       &value.bv_val[j], klen );
                                HASH_Final( HASHdigest, &HASHcontext );
 
-                               keys[nkeys++] = ber_bvdup( &digest );
+                               ber_dupbv( &keys[nkeys++], &digest );
                        }
 
-                       ber_bvfree( value );
+                       free( value.bv_val );
                }
        }
 
-       if((flags & SLAP_INDEX_SUBSTR_FINAL) && sa->sa_final != NULL &&
-               sa->sa_final->bv_len >= SLAP_INDEX_SUBSTR_MINLEN )
+       if((flags & SLAP_INDEX_SUBSTR_FINAL) && sa->sa_final.bv_val != NULL &&
+               sa->sa_final.bv_len >= SLAP_INDEX_SUBSTR_MINLEN )
        {
                pre = SLAP_INDEX_SUBSTR_FINAL_PREFIX;
-               value = ber_bvdup( sa->sa_final );
-               ldap_pvt_str2upper( value->bv_val );
+               ber_dupbv( &value, &sa->sa_final );
+               ldap_pvt_str2upper( value.bv_val );
 
-               klen = SLAP_INDEX_SUBSTR_MAXLEN < value->bv_len
-                       ? SLAP_INDEX_SUBSTR_MAXLEN : value->bv_len;
+               klen = SLAP_INDEX_SUBSTR_MAXLEN < value.bv_len
+                       ? SLAP_INDEX_SUBSTR_MAXLEN : value.bv_len;
 
                HASH_Init( &HASHcontext );
                if( prefix != NULL && prefix->bv_len > 0 ) {
@@ -3188,15 +3164,15 @@ static int caseIgnoreIA5SubstringsFilter(
                HASH_Update( &HASHcontext,
                        mr->smr_oid, mlen );
                HASH_Update( &HASHcontext,
-                       &value->bv_val[value->bv_len-klen], klen );
+                       &value.bv_val[value.bv_len-klen], klen );
                HASH_Final( HASHdigest, &HASHcontext );
 
-               ber_bvfree( value );
-               keys[nkeys++] = ber_bvdup( &digest );
+               free( value.bv_val );
+               ber_dupbv( &keys[nkeys++], &digest );
        }
 
        if( nkeys > 0 ) {
-               keys[nkeys] = NULL;
+               keys[nkeys].bv_val = NULL;
                *keysp = keys;
        } else {
                ch_free( keys );
@@ -3226,17 +3202,15 @@ static int
 numericStringNormalize(
        Syntax *syntax,
        struct berval *val,
-       struct berval **normalized )
+       struct berval *normalized )
 {
        /* removal all spaces */
-       struct berval *newval;
        char *p, *q;
 
-       newval = ch_malloc( sizeof( struct berval ) );
-       newval->bv_val = ch_malloc( val->bv_len + 1 );
+       normalized->bv_val = ch_malloc( val->bv_len + 1 );
 
        p = val->bv_val;
-       q = newval->bv_val;
+       q = normalized->bv_val;
 
        while ( *p ) {
                if ( ASCII_SPACE( *p ) ) {
@@ -3248,13 +3222,12 @@ numericStringNormalize(
        }
 
        /* we should have copied no more then is in val */
-       assert( (q - newval->bv_val) <= (p - val->bv_val) );
+       assert( (q - normalized->bv_val) <= (p - val->bv_val) );
 
        /* null terminate */
        *q = '\0';
 
-       newval->bv_len = q - newval->bv_val;
-       *normalized = newval;
+       normalized->bv_len = q - normalized->bv_val;
 
        return LDAP_SUCCESS;
 }
@@ -3296,13 +3269,9 @@ objectIdentifierFirstComponentMatch(
                rc = objectIdentifierMatch( &match, flags, syntax, mr, &oid, asserted );
 
        } else {
-               char *stored = ch_malloc( oid.bv_len + 1 );
-               AC_MEMCPY( stored, oid.bv_val, oid.bv_len );
-               stored[oid.bv_len] = '\0';
-
                if ( !strcmp( syntax->ssyn_oid, SLAP_SYNTAX_MATCHINGRULES_OID ) ) {
-                       MatchingRule *asserted_mr = mr_find( asserted->bv_val );
-                       MatchingRule *stored_mr = mr_find( stored );
+                       MatchingRule *asserted_mr = mr_bvfind( asserted );
+                       MatchingRule *stored_mr = mr_bvfind( &oid );
 
                        if( asserted_mr == NULL ) {
                                rc = SLAPD_COMPARE_UNDEFINED;
@@ -3313,8 +3282,8 @@ objectIdentifierFirstComponentMatch(
                } else if ( !strcmp( syntax->ssyn_oid,
                        SLAP_SYNTAX_ATTRIBUTETYPES_OID ) )
                {
-                       AttributeType *asserted_at = at_find( asserted->bv_val );
-                       AttributeType *stored_at = at_find( stored );
+                       AttributeType *asserted_at = at_bvfind( asserted );
+                       AttributeType *stored_at = at_bvfind( &oid );
 
                        if( asserted_at == NULL ) {
                                rc = SLAPD_COMPARE_UNDEFINED;
@@ -3325,8 +3294,8 @@ objectIdentifierFirstComponentMatch(
                } else if ( !strcmp( syntax->ssyn_oid,
                        SLAP_SYNTAX_OBJECTCLASSES_OID ) )
                {
-                       ObjectClass *asserted_oc = oc_find( asserted->bv_val );
-                       ObjectClass *stored_oc = oc_find( stored );
+                       ObjectClass *asserted_oc = oc_bvfind( asserted );
+                       ObjectClass *stored_oc = oc_bvfind( &oid );
 
                        if( asserted_oc == NULL ) {
                                rc = SLAPD_COMPARE_UNDEFINED;
@@ -3334,8 +3303,6 @@ objectIdentifierFirstComponentMatch(
                                match = asserted_oc != stored_oc;
                        }
                }
-
-               ch_free( stored );
        }
 
 #ifdef NEW_LOGGING
@@ -3506,7 +3473,7 @@ dn_openssl2ldap(X509_NAME *name)
 static int
 certificateExactConvert(
        struct berval * in,
-       struct berval ** out )
+       struct berval * out )
 {
        X509 *xcert;
        unsigned char *p = in->bv_val;
@@ -3552,13 +3519,12 @@ certificateExactConvert(
 
        X509_free(xcert);
 
-       *out = ch_malloc(sizeof(struct berval));
-       (*out)->bv_len = serial->bv_len + 3 + issuer_dn->bv_len + 1;
-       (*out)->bv_val = ch_malloc((*out)->bv_len);
-       p = (*out)->bv_val;
+       out->bv_len = serial->bv_len + issuer_dn->bv_len + sizeof(" $ ");
+       out->bv_val = ch_malloc(out->bv_len);
+       p = out->bv_val;
        AC_MEMCPY(p, serial->bv_val, serial->bv_len);
        p += serial->bv_len;
-       AC_MEMCPY(p, " $ ", 3);
+       AC_MEMCPY(p, " $ ", sizeof(" $ ")-1);
        p += 3;
        AC_MEMCPY(p, issuer_dn->bv_val, issuer_dn->bv_len);
        p += issuer_dn->bv_len;
@@ -3567,11 +3533,11 @@ certificateExactConvert(
 #ifdef NEW_LOGGING
        LDAP_LOG(( "schema", LDAP_LEVEL_ENTRY,
                   "certificateExactConvert: \n %s\n",
-                  (*out)->bv_val));
+                  out->bv_val));
 #else
        Debug( LDAP_DEBUG_ARGS, "certificateExactConvert "
                "\n\t\"%s\"\n",
-               (*out)->bv_val, NULL, NULL );
+               out->bv_val, NULL, NULL );
 #endif
 
        ber_bvfree(serial);
@@ -3609,7 +3575,7 @@ serial_and_issuer_parse(
 
        bv.bv_len = end-begin+1;
        bv.bv_val = begin;
-       *serial = ber_bvdup(&bv);
+       *serial = ber_dupbv(NULL, &bv);
 
        /* now extract the issuer, remember p was at the dollar sign */
        begin = p+1;
@@ -3718,27 +3684,27 @@ static int certificateExactIndexer(
        Syntax *syntax,
        MatchingRule *mr,
        struct berval *prefix,
-       struct berval **values,
-       struct berval ***keysp )
+       BVarray values,
+       BVarray *keysp )
 {
        int i;
-       struct berval **keys;
+       BVarray keys;
        X509 *xcert;
        unsigned char *p;
        struct berval * serial;
 
        /* we should have at least one value at this point */
-       assert( values != NULL && values[0] != NULL );
+       assert( values != NULL && values[0].bv_val != NULL );
 
-       for( i=0; values[i] != NULL; i++ ) {
+       for( i=0; values[i].bv_val != NULL; i++ ) {
                /* empty -- just count them */
        }
 
-       keys = ch_malloc( sizeof( struct berval ) * (i+1) );
+       keys = ch_malloc( sizeof( struct berval ) * (i+1) );
 
-       for( i=0; values[i] != NULL; i++ ) {
-               p = values[i]->bv_val;
-               xcert = d2i_X509(NULL, &p, values[i]->bv_len);
+       for( i=0; values[i].bv_val != NULL; i++ ) {
+               p = values[i].bv_val;
+               xcert = d2i_X509(NULL, &p, values[i].bv_len);
                if ( !xcert ) {
 #ifdef NEW_LOGGING
                        LDAP_LOG(( "schema", LDAP_LEVEL_ENTRY,
@@ -3763,16 +3729,16 @@ static int certificateExactIndexer(
 #ifdef NEW_LOGGING
                LDAP_LOG(( "schema", LDAP_LEVEL_ENTRY,
                           "certificateExactIndexer: returning: %s\n",
-                          keys[i]->bv_val));
+                          keys[i].bv_val));
 #else
                Debug( LDAP_DEBUG_ARGS, "certificateExactIndexer: "
                       "returning: %s\n",
-                      keys[i]->bv_val,
+                      keys[i].bv_val,
                       NULL, NULL );
 #endif
        }
 
-       keys[i] = NULL;
+       keys[i].bv_val = NULL;
        *keysp = keys;
        return LDAP_SUCCESS;
 }
@@ -3786,9 +3752,9 @@ static int certificateExactFilter(
        MatchingRule *mr,
        struct berval *prefix,
        void * assertValue,
-       struct berval ***keysp )
+       BVarray *keysp )
 {
-       struct berval **keys;
+       BVarray keys;
        struct berval *asserted_serial;
        struct berval *asserted_issuer_dn;
 
@@ -3796,9 +3762,9 @@ static int certificateExactFilter(
                                &asserted_serial,
                                &asserted_issuer_dn);
 
-       keys = ch_malloc( sizeof( struct berval ) * 2 );
+       keys = ch_malloc( sizeof( struct berval ) * 2 );
        integerNormalize( syntax, asserted_serial, &keys[0] );
-       keys[1] = NULL;
+       keys[1].bv_val = NULL;
        *keysp = keys;
 
        ber_bvfree(asserted_serial);
@@ -3976,9 +3942,8 @@ static int
 utcTimeNormalize(
        Syntax *syntax,
        struct berval *val,
-       struct berval **normalized )
+       struct berval *normalized )
 {
-       struct berval *out;
        int parts[9], rc;
 
        rc = check_time_syntax(val, 1, parts);
@@ -3986,23 +3951,15 @@ utcTimeNormalize(
                return rc;
        }
 
-       *normalized = NULL;
-       out = ch_malloc( sizeof(struct berval) );
-       if( out == NULL ) {
-               return LBER_ERROR_MEMORY;
-       }
-
-       out->bv_val = ch_malloc( 14 );
-       if ( out->bv_val == NULL ) {
-               ch_free( out );
+       normalized->bv_val = ch_malloc( 14 );
+       if ( normalized->bv_val == NULL ) {
                return LBER_ERROR_MEMORY;
        }
 
-       sprintf( out->bv_val, "%02d%02d%02d%02d%02d%02dZ",
+       sprintf( normalized->bv_val, "%02d%02d%02d%02d%02d%02dZ",
                parts[1], parts[2] + 1, parts[3] + 1,
                parts[4], parts[5], parts[6] );
-       out->bv_len = 13;
-       *normalized = out;
+       normalized->bv_len = 13;
 
        return LDAP_SUCCESS;
 }
@@ -4031,9 +3988,8 @@ static int
 generalizedTimeNormalize(
        Syntax *syntax,
        struct berval *val,
-       struct berval **normalized )
+       struct berval *normalized )
 {
-       struct berval *out;
        int parts[9], rc;
 
        rc = check_time_syntax(val, 0, parts);
@@ -4041,23 +3997,15 @@ generalizedTimeNormalize(
                return rc;
        }
 
-       *normalized = NULL;
-       out = ch_malloc( sizeof(struct berval) );
-       if( out == NULL ) {
+       normalized->bv_val = ch_malloc( 16 );
+       if ( normalized->bv_val == NULL ) {
                return LBER_ERROR_MEMORY;
        }
 
-       out->bv_val = ch_malloc( 16 );
-       if ( out->bv_val == NULL ) {
-               ch_free( out );
-               return LBER_ERROR_MEMORY;
-       }
-
-       sprintf( out->bv_val, "%02d%02d%02d%02d%02d%02d%02dZ",
+       sprintf( normalized->bv_val, "%02d%02d%02d%02d%02d%02d%02dZ",
                parts[0], parts[1], parts[2] + 1, parts[3] + 1,
                parts[4], parts[5], parts[6] );
-       out->bv_len = 15;
-       *normalized = out;
+       normalized->bv_len = 15;
 
        return LDAP_SUCCESS;
 }
@@ -4081,7 +4029,7 @@ nisNetgroupTripleValidate(
                return LDAP_INVALID_SYNTAX;
        }
 
-       for ( p++; ( p < e ) && ( *p != ')' ); p++ ) {
+       for ( p++; ( p < e ) && ( *p != /*'('*/ ')' ); p++ ) {
                if ( *p == ',' ) {
                        commas++;
                        if ( commas > 2 ) {
@@ -4165,15 +4113,18 @@ static struct syntax_defs_rec {
        slap_syntax_transform_func *sd_str2ber;
 #endif
 } syntax_defs[] = {
-       {"( 1.3.6.1.4.1.1466.115.121.1.1 DESC 'ACI Item' " X_BINARY X_NOT_H_R ")",
+       {"( 1.3.6.1.4.1.1466.115.121.1.1 DESC 'ACI Item' "
+               X_BINARY X_NOT_H_R ")",
                SLAP_SYNTAX_BINARY|SLAP_SYNTAX_BER, NULL, NULL, NULL},
        {"( 1.3.6.1.4.1.1466.115.121.1.2 DESC 'Access Point' " X_NOT_H_R ")",
                0, NULL, NULL, NULL},
        {"( 1.3.6.1.4.1.1466.115.121.1.3 DESC 'Attribute Type Description' )",
                0, NULL, NULL, NULL},
-       {"( 1.3.6.1.4.1.1466.115.121.1.4 DESC 'Audio' " X_NOT_H_R ")",
+       {"( 1.3.6.1.4.1.1466.115.121.1.4 DESC 'Audio' "
+               X_NOT_H_R ")",
                SLAP_SYNTAX_BLOB, blobValidate, NULL, NULL},
-       {"( 1.3.6.1.4.1.1466.115.121.1.5 DESC 'Binary' " X_NOT_H_R ")",
+       {"( 1.3.6.1.4.1.1466.115.121.1.5 DESC 'Binary' "
+               X_NOT_H_R ")",
                SLAP_SYNTAX_BER, berValidate, NULL, NULL},
        {"( 1.3.6.1.4.1.1466.115.121.1.6 DESC 'Bit String' )",
                0, bitStringValidate, bitStringNormalize, NULL },
@@ -4191,7 +4142,7 @@ static struct syntax_defs_rec {
        {"( 1.3.6.1.4.1.1466.115.121.1.11 DESC 'Country String' )",
                0, countryStringValidate, IA5StringNormalize, NULL},
        {"( 1.3.6.1.4.1.1466.115.121.1.12 DESC 'Distinguished Name' )",
-               0, dnValidate, dnNormalize, dnPretty},
+               0, dnValidate, dnNormalize2, dnPretty2},
        {"( 1.3.6.1.4.1.1466.115.121.1.13 DESC 'Data Quality' )",
                0, NULL, NULL, NULL},
        {"( 1.3.6.1.4.1.1466.115.121.1.14 DESC 'Delivery Method' )",
@@ -4254,6 +4205,9 @@ static struct syntax_defs_rec {
                0, NULL, NULL, NULL},
        {"( 1.3.6.1.4.1.1466.115.121.1.44 DESC 'Printable String' )",
                0, printableStringValidate, IA5StringNormalize, NULL},
+       {"( 1.3.6.1.4.1.1466.115.121.1.45 DESC 'SubtreeSpecification' "
+               X_BINARY X_NOT_H_R ")",
+               SLAP_SYNTAX_BINARY|SLAP_SYNTAX_BER, NULL, NULL, NULL},
        {"( 1.3.6.1.4.1.1466.115.121.1.49 DESC 'Supported Algorithm' "
                X_BINARY X_NOT_H_R ")",
                SLAP_SYNTAX_BINARY|SLAP_SYNTAX_BER, berValidate, NULL, NULL},
@@ -4298,9 +4252,11 @@ static struct syntax_defs_rec {
                UTF8StringValidate /* THIS WILL CHANGE FOR NEW ACI SYNTAX */,
                NULL, NULL},
 
+#ifdef SLAPD_AUTHPASSWD
        /* needs updating */
        {"( 1.3.6.1.4.1.4203.666.2.2 DESC 'OpenLDAP authPassword' )",
                SLAP_SYNTAX_HIDE, NULL, NULL, NULL},
+#endif
 
        /* OpenLDAP Void Syntax */
        {"( 1.3.6.1.4.1.4203.1.1.1 DESC 'OpenLDAP void' )" ,
@@ -4348,7 +4304,7 @@ static struct mrule_defs_rec {
         */
        {"( " directoryStringApproxMatchOID " NAME 'directoryStringApproxMatch' "
                "SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )",
-               SLAP_MR_EQUALITY_APPROX | SLAP_MR_EXT,
+               SLAP_MR_HIDE | SLAP_MR_EQUALITY_APPROX | SLAP_MR_EXT,
                NULL, NULL,
                directoryStringApproxMatch,
                directoryStringApproxIndexer, 
@@ -4357,7 +4313,7 @@ static struct mrule_defs_rec {
 
        {"( " IA5StringApproxMatchOID " NAME 'IA5StringApproxMatch' "
                "SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )",
-               SLAP_MR_EQUALITY_APPROX | SLAP_MR_EXT,
+               SLAP_MR_HIDE | SLAP_MR_EQUALITY_APPROX | SLAP_MR_EXT,
                NULL, NULL,
                IA5StringApproxMatch,
                IA5StringApproxIndexer, 
@@ -4597,6 +4553,7 @@ static struct mrule_defs_rec {
                caseExactIA5SubstringsFilter,
                NULL},
 
+#ifdef SLAPD_AUTHPASSWD
        /* needs updating */
        {"( 1.3.6.1.4.1.4203.666.4.1 NAME 'authPasswordMatch' "
                "SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )",
@@ -4604,6 +4561,7 @@ static struct mrule_defs_rec {
                NULL, NULL,
                authPasswordMatch, NULL, NULL,
                NULL},
+#endif
 
        {"( 1.3.6.1.4.1.4203.666.4.2 NAME 'OpenLDAPaciMatch' "
                "SYNTAX 1.3.6.1.4.1.4203.666.2.1 )",
@@ -4630,7 +4588,7 @@ static struct mrule_defs_rec {
 };
 
 int
-schema_init( void )
+slap_schema_init( void )
 {
        int             res;
        int             i;
@@ -4652,7 +4610,7 @@ schema_init( void )
                );
 
                if ( res ) {
-                       fprintf( stderr, "schema_init: Error registering syntax %s\n",
+                       fprintf( stderr, "slap_schema_init: Error registering syntax %s\n",
                                 syntax_defs[i].sd_desc );
                        return LDAP_OTHER;
                }
@@ -4661,7 +4619,7 @@ schema_init( void )
        for ( i=0; mrule_defs[i].mrd_desc != NULL; i++ ) {
                if( mrule_defs[i].mrd_usage == SLAP_MR_NONE ) {
                        fprintf( stderr,
-                               "schema_init: Ingoring unusable matching rule %s\n",
+                               "slap_schema_init: Ingoring unusable matching rule %s\n",
                                 mrule_defs[i].mrd_desc );
                        continue;
                }
@@ -4678,18 +4636,21 @@ schema_init( void )
 
                if ( res ) {
                        fprintf( stderr,
-                               "schema_init: Error registering matching rule %s\n",
+                               "slap_schema_init: Error registering matching rule %s\n",
                                 mrule_defs[i].mrd_desc );
                        return LDAP_OTHER;
                }
        }
+
+       res = slap_schema_load();
        schema_init_done = 1;
-       return LDAP_SUCCESS;
+       return res;
 }
 
 void
 schema_destroy( void )
 {
+       oidm_destroy();
        oc_destroy();
        at_destroy();
        mr_destroy();