( sizeof ( (m)->dn_data ) / sizeof( *(m)->dn_data ) )
 #define MATCHES_VALMAXCOUNT(m)                                         \
        ( sizeof ( (m)->val_data ) / sizeof( *(m)->val_data ) )
-#define MATCHES_MEMSET(m) {                                    \
+#define MATCHES_MEMSET(m) do {                                 \
        memset( (m)->dn_data, '\0', sizeof( (m)->dn_data ) );   \
        memset( (m)->val_data, '\0', sizeof( (m)->val_data ) ); \
        (m)->dn_count = MATCHES_DNMAXCOUNT( (m) );              \
                                 * an API update
                                 */
                                (void)da->da_mask( da->da_private, op, e, desc,
-                                       val, matches.dn_count, matches.dn_data, 
+                                       val, matches->dn_count, matches->dn_data, 
                                        &grant, &deny ); 
 
                                tgrant |= grant;
 
 /*
  * acl.c
  */
-typedef struct AclRegexMatches {        
-       int dn_count;
-        regmatch_t dn_data[MAXREMATCHES];
-       int val_count;
-        regmatch_t val_data[MAXREMATCHES];
-} AclRegexMatches;
-
 LDAP_SLAPD_F (int) access_allowed_mask LDAP_P((
        Operation *op,
        Entry *e, AttributeDescription *desc, struct berval *val,
 
 #define ACL_STATE_INIT { NULL, NULL, NULL, \
        ACL_STATE_NOT_RECORDED, 0, 0, 0 }
 
+typedef struct AclRegexMatches {        
+       int dn_count;
+        regmatch_t dn_data[MAXREMATCHES];
+       int val_count;
+        regmatch_t val_data[MAXREMATCHES];
+} AclRegexMatches;
+
 /*
  * Backend-info
  * represents a backend