char    *user = NULL;
 
        LDAP           *ld = NULL;
-       struct berval *bv = NULL;
+       struct berval bv = {0};
+       BerElement  *ber = NULL;
 
        int id, code = LDAP_OTHER;
        LDAPMessage *res;
        char    *retoid = NULL;
        struct berval *retdata = NULL;
 
-    prog = lutil_progname( "ldappasswd", argc, argv );
+       prog = lutil_progname( "ldappasswd", argc, argv );
 
        /* LDAPv3 only */
        version = LDAP_VERSION3;
 
        if( user != NULL || oldpw != NULL || newpw != NULL ) {
                /* build change password control */
-               BerElement *ber = ber_alloc_t( LBER_USE_DER );
+               ber = ber_alloc_t( LBER_USE_DER );
 
                if( ber == NULL ) {
                        perror( "ber_alloc_t" );
 
                ber_printf( ber, /*{*/ "N}" );
 
-               rc = ber_flatten( ber, &bv );
+               rc = ber_flatten2( ber, &bv, 0 );
 
                if( rc < 0 ) {
-                       perror( "ber_flatten" );
+                       perror( "ber_flatten2" );
                        ldap_unbind( ld );
                        return EXIT_FAILURE;
                }
-
-               ber_free( ber, 1 );
        }
 
        if ( not ) {
        }
 
        rc = ldap_extended_operation( ld,
-               LDAP_EXOP_MODIFY_PASSWD, bv, 
+               LDAP_EXOP_MODIFY_PASSWD, bv.bv_val ? &bv : NULL, 
                NULL, NULL, &id );
 
-       ber_bvfree( bv );
+       ber_free( ber, 1 );
 
        if( rc != LDAP_SUCCESS ) {
                ldap_perror( ld, "ldap_extended_operation" );
        if( retdata != NULL ) {
                ber_tag_t tag;
                char *s;
-               BerElement *ber = ber_init( retdata );
+               ber = ber_init( retdata );
 
                if( ber == NULL ) {
                        perror( "ber_init" );
 
        FILE            *fp = NULL;
        int                     rc, i, first;
        LDAP            *ld = NULL;
-       BerElement      *ber = NULL;
-       struct berval   *sebvalp = NULL, *vrbvalp = NULL;
-       struct berval   *prbvalp = NULL;
+       BerElement      *seber = NULL, *vrber = NULL, *prber = NULL;
 
        npagedresponses = npagedentries = npagedreferences =
                npagedextended = npagedpartial = 0;
 
 #ifdef LDAP_CONTROL_SUBENTRIES
                if ( subentries ) {
-               if (( ber = ber_alloc_t(LBER_USE_DER)) == NULL ) {
+               if (( seber = ber_alloc_t(LBER_USE_DER)) == NULL ) {
                                return EXIT_FAILURE;
                        }
 
-                       err = ber_printf( ber, "{b}", abs(subentries) == 1 ? 0 : 1 );
+                       err = ber_printf( seber, "{b}", abs(subentries) == 1 ? 0 : 1 );
                if ( err == LBER_ERROR ) {
-                               ber_free( ber, 1 );
+                               ber_free( seber, 1 );
                                fprintf( stderr, "Subentries control encoding error!\n" );
                                return EXIT_FAILURE;
                        }
 
-                       if ( ber_flatten( ber, &sebvalp ) == LBER_ERROR ) {
+                       if ( ber_flatten2( seber, &c[i].ldctl_value, 0 ) == LBER_ERROR ) {
                                return EXIT_FAILURE;
                        }
 
                        c[i].ldctl_oid = LDAP_CONTROL_SUBENTRIES;
-                       c[i].ldctl_value=(*sebvalp);
                        c[i].ldctl_iscritical = subentries < 1;
                        i++;
                }
 #endif
 
                if ( valuesReturnFilter ) {
-               if (( ber = ber_alloc_t(LBER_USE_DER)) == NULL ) {
+               if (( vrber = ber_alloc_t(LBER_USE_DER)) == NULL ) {
                                return EXIT_FAILURE;
                        }
 
-               if ( ( err = ldap_put_vrFilter( ber, vrFilter ) ) == -1 ) {
-                               ber_free( ber, 1 );
+               if ( ( err = ldap_put_vrFilter( vrber, vrFilter ) ) == -1 ) {
+                               ber_free( vrber, 1 );
                                fprintf( stderr, "Bad ValuesReturnFilter: %s\n", vrFilter );
                                return EXIT_FAILURE;
                        }
 
-                       if ( ber_flatten( ber, &vrbvalp ) == LBER_ERROR ) {
+                       if ( ber_flatten2( vrber, &c[i].ldctl_value, 0 ) == LBER_ERROR ) {
                                return EXIT_FAILURE;
                        }
 
-                       ber_free( ber, 1 );
-
                        c[i].ldctl_oid = LDAP_CONTROL_VALUESRETURNFILTER;
-                       c[i].ldctl_value=(*vrbvalp);
                        c[i].ldctl_iscritical = valuesReturnFilter > 1;
                        i++;
                }
 
                if ( pagedResults ) {
-                       if (( ber = ber_alloc_t(LBER_USE_DER)) == NULL ) {
+                       if (( prber = ber_alloc_t(LBER_USE_DER)) == NULL ) {
                                return EXIT_FAILURE;
                        }
 
-                       ber_printf( ber, "{iO}", pageSize, &cookie );
-                       if ( ber_flatten( ber, &prbvalp ) == LBER_ERROR ) {
+                       ber_printf( prber, "{iO}", pageSize, &cookie );
+                       if ( ber_flatten2( prber, &c[i].ldctl_value, 0 ) == LBER_ERROR ) {
                                return EXIT_FAILURE;
                        }
                        
-                       ber_free( ber, 1 );
-
                        c[i].ldctl_oid = LDAP_CONTROL_PAGEDRESULTS;
-                       c[i].ldctl_value=(*prbvalp);
                        c[i].ldctl_iscritical = pagedResults > 1;
                        i++;
                }
 
                tool_server_controls( ld, c, i );
 
-               ber_bvfree( sebvalp );
-               ber_bvfree( vrbvalp );
-               ber_bvfree( prbvalp );
+               ber_free( seber, 1 );
+               ber_free( vrber, 1 );
+               ber_free( prber, 1 );
        }
        
        if ( verbose ) {
 
        LDAPControl **ctrlp )
 {
        LDAPControl *ctrl;
-       struct berval *bvalp;
 
        assert( requestOID != NULL );
        assert( ber != NULL );
                return LDAP_NO_MEMORY;
        }
 
-       if ( ber_flatten( ber, &bvalp ) == -1 ) {
+       if ( ber_flatten2( ber, &ctrl->ldctl_value, 1 ) == -1 ) {
                LDAP_FREE( ctrl );
                return LDAP_NO_MEMORY;
        }
 
-       ctrl->ldctl_value = *bvalp;
-       ber_memfree( bvalp );
-
        ctrl->ldctl_oid = LDAP_STRDUP( requestOID );
        ctrl->ldctl_iscritical = iscritical;
 
 
 static int filter2ber( char *filter )
 {
        int rc;
-       struct berval *bv = NULL;
+       struct berval bv = {0};
        BerElement *ber;
 
        printf( "Filter: %s\n", filter );
                return EXIT_FAILURE;
        }
 
-       rc = ber_flatten( ber, &bv );
+       rc = ber_flatten2( ber, &bv, 0 );
        if( rc < 0 ) {
-               perror( "ber_flatten" );
+               perror( "ber_flatten2" );
                return EXIT_FAILURE;
        }
 
-       printf( "BER encoding (len=%ld):\n", (long) bv->bv_len );
-       ber_bprint( bv->bv_val, bv->bv_len );
+       printf( "BER encoding (len=%ld):\n", (long) bv.bv_len );
+       ber_bprint( bv.bv_val, bv.bv_len );
 
-       ber_free( ber, 0 );
-       ber_bvfree( bv );
+       ber_free( ber, 1 );
 
        return EXIT_SUCCESS;
 }
 
        int                             *msgidp )
 {
        int rc;
-       struct berval *bv = NULL;
+       struct berval bv = {0};
+       BerElement *ber = NULL;
 
        assert( ld != NULL );
        assert( LDAP_VALID( ld ) );
 
        if( user != NULL || oldpw != NULL || newpw != NULL ) {
                /* build change password control */
-               BerElement *ber = ber_alloc_t( LBER_USE_DER );
+               ber = ber_alloc_t( LBER_USE_DER );
 
                if( ber == NULL ) {
                        ld->ld_errno = LDAP_NO_MEMORY;
 
                ber_printf( ber, /*{*/ "N}" );
 
-               rc = ber_flatten( ber, &bv );
-
-               ber_free( ber, 1 );
+               rc = ber_flatten2( ber, &bv, 0 );
 
                if( rc < 0 ) {
                        ld->ld_errno = LDAP_ENCODING_ERROR;
        }
        
        rc = ldap_extended_operation( ld, LDAP_EXOP_MODIFY_PASSWD,
-               bv, sctrls, cctrls, msgidp );
+               bv.bv_val ? &bv : NULL, sctrls, cctrls, msgidp );
+
+       ber_free( ber, 1 );
 
        return rc;
 }