From 975a5e9a24e971197baa9ea2d4479100977c9060 Mon Sep 17 00:00:00 2001
From: Howard Chu <hyc@openldap.org>
Date: Sat, 29 Dec 2001 04:48:00 +0000
Subject: [PATCH] Added dnPretty2/dnNormalize2 using preallocated destination
 berval

---
 servers/slapd/acl.c                  | 44 +++++++++---------
 servers/slapd/aclparse.c             | 17 +++----
 servers/slapd/back-bdb/modrdn.c      | 14 +++---
 servers/slapd/back-dnssrv/search.c   | 10 ++---
 servers/slapd/back-ldap/config.c     | 29 ++++++------
 servers/slapd/back-ldap/search.c     |  4 +-
 servers/slapd/back-ldbm/alias.c      |  9 ++--
 servers/slapd/back-ldbm/cache.c      |  8 ++--
 servers/slapd/back-ldbm/modrdn.c     | 20 ++++-----
 servers/slapd/back-ldbm/passwd.c     | 10 ++---
 servers/slapd/back-meta/attribute.c  |  4 +-
 servers/slapd/back-meta/back-meta.h  | 12 ++---
 servers/slapd/back-meta/bind.c       |  8 ++--
 servers/slapd/back-meta/candidates.c |  4 +-
 servers/slapd/back-meta/config.c     | 48 +++++++-------------
 servers/slapd/back-meta/conn.c       |  2 +-
 servers/slapd/back-meta/group.c      |  4 +-
 servers/slapd/back-meta/init.c       |  8 ++--
 servers/slapd/back-meta/search.c     | 26 ++++-------
 servers/slapd/back-monitor/init.c    | 42 +++++------------
 servers/slapd/back-passwd/search.c   |  7 ++-
 servers/slapd/bind.c                 |  5 +--
 servers/slapd/config.c               |  7 +--
 servers/slapd/dn.c                   | 67 +++++++++++++++++++---------
 servers/slapd/limits.c               | 18 ++++----
 servers/slapd/proto-slap.h           | 10 +++++
 servers/slapd/saslauthz.c            | 32 +++++--------
 servers/slapd/schema.c               |  6 +--
 servers/slapd/slap.h                 |  2 +-
 29 files changed, 215 insertions(+), 262 deletions(-)

diff --git a/servers/slapd/acl.c b/servers/slapd/acl.c
index ab257dc922..d9aa458a55 100644
--- a/servers/slapd/acl.c
+++ b/servers/slapd/acl.c
@@ -755,7 +755,7 @@ acl_mask(
 		if ( b->a_group_pat.bv_len && op->o_ndn.bv_len ) {
 			char buf[1024];
 			struct berval bv = {1024, buf };
-			struct berval *ndn = NULL;
+			struct berval ndn = {0, NULL };
 			int rc;
 
 			/* b->a_group is an unexpanded entry name, expanded it should be an 
@@ -765,19 +765,19 @@ acl_mask(
 			/* see if asker is listed in dnattr */
 			if ( b->a_group_style == ACL_STYLE_REGEX ) {
 				string_expand(&bv, b->a_group_pat.bv_val, e->e_ndn, matches);
-				if ( dnNormalize(NULL, &bv, &ndn) != LDAP_SUCCESS ) {
+				if ( dnNormalize2(NULL, &bv, &ndn) != LDAP_SUCCESS ) {
 					/* did not expand to a valid dn */
 					continue;
 				}
-				bv = *ndn;
+				bv = ndn;
 			} else {
 				bv = b->a_group_pat;
 			}
 
 			rc = backend_group(be, conn, op, e, &bv, &op->o_ndn,
 				b->a_group_oc, b->a_group_at);
-			if ( ndn )
-				ber_bvfree( ndn );
+			if ( ndn.bv_val )
+				free( ndn.bv_val );
 			if ( rc != 0 )
 			{
 				continue;
@@ -1208,7 +1208,7 @@ aci_set_gather (void *cookie, char *name, struct berval *attr)
 	AciSetCookie *cp = cookie;
 	struct berval **bvals = NULL;
 	char **vals = NULL;
-	struct berval bv, *ndn = NULL;
+	struct berval bv, ndn;
 	int i;
 
 	/* this routine needs to return the bervals instead of
@@ -1218,12 +1218,12 @@ aci_set_gather (void *cookie, char *name, struct berval *attr)
 
 	bv.bv_val = name;
 	bv.bv_len = strlen( name );
-	if (dnNormalize(NULL, &bv, &ndn) == LDAP_SUCCESS) {
+	if (dnNormalize2(NULL, &bv, &ndn) == LDAP_SUCCESS) {
 		const char *text;
 		AttributeDescription *desc = NULL;
 		if (slap_bv2ad(attr, &desc, &text) == LDAP_SUCCESS) {
 			backend_attribute(cp->be, NULL, NULL,
-				cp->e, ndn, desc, &bvals);
+				cp->e, &ndn, desc, &bvals);
 			if (bvals != NULL) {
 				for (i = 0; bvals[i] != NULL; i++) { }
 				vals = ch_calloc(i + 1, sizeof(char *));
@@ -1236,7 +1236,7 @@ aci_set_gather (void *cookie, char *name, struct berval *attr)
 				ber_bvecfree(bvals);
 			}
 		}
-		ber_bvfree(ndn);
+		free(ndn.bv_val);
 	}
 	return(vals);
 }
@@ -1258,7 +1258,7 @@ aci_match_set (
 	if (setref == 0) {
 		set = aci_bvstrdup(subj);
 	} else {
-		struct berval subjdn, *ndn = NULL;
+		struct berval subjdn, ndn = { 0, NULL };
 		struct berval setat;
 		struct berval **bvals;
 		const char *text;
@@ -1283,19 +1283,19 @@ aci_match_set (
 			setat.bv_len = sizeof(SLAPD_ACI_SET_ATTR)-1;
 		}
 		if ( setat.bv_val != NULL ) {
-			if ( dnNormalize(NULL, &subjdn, &ndn) == LDAP_SUCCESS
+			if ( dnNormalize2(NULL, &subjdn, &ndn) == LDAP_SUCCESS
 				&& slap_bv2ad(&setat, &desc, &text) == LDAP_SUCCESS )
 			{
 				backend_attribute(be, NULL, NULL, e,
-					ndn, desc, &bvals);
+					&ndn, desc, &bvals);
 				if ( bvals != NULL ) {
 					if ( bvals[0] != NULL )
 						set = ch_strdup(bvals[0]->bv_val);
 					ber_bvecfree(bvals);
 				}
 			}
-			if (ndn)
-				ber_bvfree(ndn);
+			if (ndn.bv_val)
+				free(ndn.bv_val);
 		}
 		ch_free(subjdn.bv_val);
 	}
@@ -1515,13 +1515,13 @@ aci_group_member (
 	grp_oc = oc_bvfind( &grpoc );
 
 	if (grp_oc != NULL && grp_ad != NULL ) {
-		struct berval *ndn = NULL;
+		struct berval ndn;
 		bv.bv_val = (char *)ch_malloc(1024);
 		bv.bv_len = 1024;
 		string_expand(&bv, subjdn, e->e_ndn, matches);
-		if ( dnNormalize(NULL, &bv, &ndn) == LDAP_SUCCESS ) {
-			rc = (backend_group(be, conn, op, e, &bv, &op->o_ndn, grp_oc, grp_ad) == 0);
-			ber_bvfree( ndn );
+		if ( dnNormalize2(NULL, &bv, &ndn) == LDAP_SUCCESS ) {
+			rc = (backend_group(be, conn, op, e, &ndn, &op->o_ndn, grp_oc, grp_ad) == 0);
+			free( ndn.bv_val );
 		}
 		ch_free(bv.bv_val);
 	}
@@ -1600,12 +1600,12 @@ aci_mask(
 		return(0);
 
 	if (aci_strbvcmp( "access-id", &bv ) == 0) {
-		struct berval *ndn = NULL;
+		struct berval ndn;
 		rc = 1;
-		if ( dnNormalize(NULL, &sdn, &ndn) == LDAP_SUCCESS ) {
-			if (strcasecmp(op->o_ndn.bv_val, ndn->bv_val) != 0)
+		if ( dnNormalize2(NULL, &sdn, &ndn) == LDAP_SUCCESS ) {
+			if (strcasecmp(op->o_ndn.bv_val, ndn.bv_val) != 0)
 				rc = 0;
-			ber_bvfree(ndn);
+			free(ndn.bv_val);
 		}
 		return(rc);
 	}
diff --git a/servers/slapd/aclparse.c b/servers/slapd/aclparse.c
index 53f1daf418..2f86c9c4a0 100644
--- a/servers/slapd/aclparse.c
+++ b/servers/slapd/aclparse.c
@@ -221,11 +221,10 @@ parse_acl(
 			if( a->acl_dn_pat.bv_len != 0 ) {
 				if ( a->acl_dn_style != ACL_STYLE_REGEX )
 				{
-					struct berval *bv = NULL;
-					dnNormalize( NULL, &a->acl_dn_pat, &bv);
+					struct berval bv;
+					dnNormalize2( NULL, &a->acl_dn_pat, &bv);
 					free( a->acl_dn_pat.bv_val );
-					a->acl_dn_pat = *bv;
-					free( bv );
+					a->acl_dn_pat = bv;
 				} else {
 					int e = regcomp( &a->acl_dn_re, a->acl_dn_pat.bv_val,
 					                 REG_EXTENDED | REG_ICASE );
@@ -378,10 +377,7 @@ parse_acl(
 					}
 
 					if ( sty != ACL_STYLE_REGEX ) {
-						struct berval *ndn = NULL;
-						dnNormalize(NULL, &bv, &ndn);
-						b->a_dn_pat = *ndn;
-						free(ndn);
+						dnNormalize2(NULL, &bv, &b->a_dn_pat);
 						free(bv.bv_val);
 					} else {
 						b->a_dn_pat = bv;
@@ -473,11 +469,8 @@ parse_acl(
 						regtest(fname, lineno, bv.bv_val);
 						b->a_group_pat = bv;
 					} else {
-						struct berval *ndn = NULL;
 						ber_str2bv( right, 0, 0, &bv );
-						dnNormalize( NULL, &bv, &ndn );
-						b->a_group_pat = *ndn;
-						free(ndn);
+						dnNormalize2( NULL, &bv, &b->a_group_pat );
 					}
 
 					if (value && *value) {
diff --git a/servers/slapd/back-bdb/modrdn.c b/servers/slapd/back-bdb/modrdn.c
index c67b5a3180..db972ee0de 100644
--- a/servers/slapd/back-bdb/modrdn.c
+++ b/servers/slapd/back-bdb/modrdn.c
@@ -30,7 +30,7 @@ bdb_modrdn(
 	struct bdb_info *bdb = (struct bdb_info *) be->be_private;
 	AttributeDescription *children = slap_schema.si_ad_children;
 	struct berval	p_dn, p_ndn;
-	struct berval	new_dn = {0, NULL}, *new_ndn = NULL;
+	struct berval	new_dn = {0, NULL}, new_ndn = {0, NULL};
 	int		isroot = -1;
 	Entry		*e, *p = NULL;
 	Entry		*matched;
@@ -393,12 +393,12 @@ retry:	/* transaction retry */
 	/* Build target dn and make sure target entry doesn't exist already. */
 	build_new_dn( &new_dn, new_parent_dn, newrdn ); 
 
-	dnNormalize( NULL, &new_dn, &new_ndn );
+	dnNormalize2( NULL, &new_dn, &new_ndn );
 
 	Debug( LDAP_DEBUG_TRACE, "bdb_modrdn: new ndn=%s\n",
-		new_ndn, 0, 0 );
+		new_ndn.bv_val, 0, 0 );
 
-	rc = bdb_dn2id ( be, ltid, new_ndn, &id );
+	rc = bdb_dn2id ( be, ltid, &new_ndn, &id );
 	switch( rc ) {
 	case DB_LOCK_DEADLOCK:
 	case DB_LOCK_NOTGRANTED:
@@ -416,7 +416,7 @@ retry:	/* transaction retry */
 
 	Debug( LDAP_DEBUG_TRACE,
 		"bdb_modrdn: new ndn=%s does not exist\n",
-		new_ndn, 0, 0 );
+		new_ndn.bv_val, 0, 0 );
 
 	/* Get attribute type and attribute value of our new rdn, we will
 	 * need to add that to our new entry
@@ -574,7 +574,7 @@ retry:	/* transaction retry */
 	 * they can be individually freed later.
 	 */
 	e->e_name = new_dn;
-	e->e_nname = *new_ndn;
+	e->e_nname = new_ndn;
 
 	/* add new one */
 	rc = bdb_dn2id_add( be, ltid, np_ndn, e );
@@ -647,7 +647,7 @@ return_results:
 
 done:
 	if( new_dn.bv_val != NULL ) free( new_dn.bv_val );
-	if( new_ndn != NULL ) ber_bvfree( new_ndn );
+	if( new_ndn.bv_val != NULL ) free( new_ndn.bv_val );
 
 	/* LDAP v2 supporting correct attribute handling. */
 	if( new_rdn_types != NULL ) charray_free(new_rdn_types);
diff --git a/servers/slapd/back-dnssrv/search.c b/servers/slapd/back-dnssrv/search.c
index 2132c46ff9..fc1e1e0cd8 100644
--- a/servers/slapd/back-dnssrv/search.c
+++ b/servers/slapd/back-dnssrv/search.c
@@ -39,7 +39,7 @@ dnssrv_back_search(
 	char *hostlist = NULL;
 	char **hosts = NULL;
 	char *refdn;
-	struct berval *nrefdn = NULL;
+	struct berval nrefdn = { 0, NULL };
 	struct berval **urls = NULL;
 
 	assert( get_manageDSAit( op ) );
@@ -114,7 +114,7 @@ dnssrv_back_search(
 		bv.bv_val = refdn;
 		bv.bv_len = strlen( refdn );
 
-		rc = dnNormalize( NULL, &bv, &nrefdn );
+		rc = dnNormalize2( NULL, &bv, &nrefdn );
 		if( rc != LDAP_SUCCESS ) {
 			send_ldap_result( conn, op, LDAP_OTHER,
 				NULL, "DNS SRV problem processing manageDSAit control",
@@ -123,7 +123,7 @@ dnssrv_back_search(
 		}
 	}
 
-	if( strcmp( nrefdn->bv_val, ndn->bv_val ) != 0 ) {
+	if( strcmp( nrefdn.bv_val, ndn->bv_val ) != 0 ) {
 		/* requested dn is subordinate */
 
 		Debug( LDAP_DEBUG_TRACE,
@@ -221,8 +221,8 @@ dnssrv_back_search(
 			NULL, NULL, NULL, NULL );
 	}
 
-	free( refdn );
-	ber_bvfree( nrefdn );
+	if ( refdn ) free( refdn );
+	if ( nrefdn.bv_val ) free( nrefdn.bv_val );
 
 done:
 	if( domain != NULL ) ch_free( domain );
diff --git a/servers/slapd/back-ldap/config.c b/servers/slapd/back-ldap/config.c
index db33946cb8..89980aabe5 100644
--- a/servers/slapd/back-ldap/config.c
+++ b/servers/slapd/back-ldap/config.c
@@ -114,10 +114,10 @@ ldap_back_db_config(
 	/* dn massaging */
 	} else if ( strcasecmp( argv[0], "suffixmassage" ) == 0 ) {
 #ifndef ENABLE_REWRITE
-		struct berval *bd2;
+		struct berval *bd2, *nd2;
 #endif /* ENABLE_REWRITE */
 		BackendDB *tmp_be;
-		struct berval bdn, *ndn = NULL;
+		struct berval bdn, ndn;
 		
 		/*
 		 * syntax:
@@ -140,14 +140,13 @@ ldap_back_db_config(
 		
 		bdn.bv_val = argv[1];
 		bdn.bv_len = strlen(bdn.bv_val);
-		if ( dnNormalize( NULL, &bdn, &ndn ) != LDAP_SUCCESS ) {
+		if ( dnNormalize2( NULL, &bdn, &ndn ) != LDAP_SUCCESS ) {
 			fprintf( stderr, "%s: line %d: suffix DN %s is invalid\n",
 				fname, lineno, bdn.bv_val );
 			return( 1 );
 		}
-		tmp_be = select_backend( ndn, 0, 0 );
-		ber_bvfree( ndn );
-		ndn = NULL;
+		tmp_be = select_backend( &ndn, 0, 0 );
+		free( ndn.bv_val );
 		if ( tmp_be != NULL && tmp_be != be ) {
 			fprintf( stderr, "%s: line %d: suffix already in use"
 				       " by another backend in"
@@ -159,13 +158,13 @@ ldap_back_db_config(
 
 		bdn.bv_val = argv[2];
 		bdn.bv_len = strlen(bdn.bv_val);
-		if ( dnNormalize( NULL, &bdn, &ndn ) != LDAP_SUCCESS ) {
+		if ( dnNormalize2( NULL, &bdn, &ndn ) != LDAP_SUCCESS ) {
 			fprintf( stderr, "%s: line %d: suffix DN %s is invalid\n",
 				fname, lineno, bdn.bv_val );
 			return( 1 );
 		}
-		tmp_be = select_backend( ndn, 0, 0 );
-		ber_bvfree( ndn );
+		tmp_be = select_backend( &ndn, 0, 0 );
+		free( ndn.bv_val );
 		if ( tmp_be != NULL ) {
 			fprintf( stderr, "%s: line %d: massaged suffix"
 				       " already in use by another backend in" 
@@ -186,15 +185,15 @@ ldap_back_db_config(
 #else /* !ENABLE_REWRITE */
 		bd2 = ber_bvstrdup( argv[1] );
 		ber_bvecadd( &li->suffix_massage, bd2 );
-		ndn = NULL;
-		dnNormalize( NULL, bd2, &ndn );
-		ber_bvecadd( &li->suffix_massage, ndn );
+		nd2 = NULL;
+		dnNormalize( NULL, bd2, &nd2 );
+		ber_bvecadd( &li->suffix_massage, nd2 );
 		
 		bd2 = ber_bvstrdup( argv[2] );
 		ber_bvecadd( &li->suffix_massage, bd2 );
-		ndn = NULL;
-		dnNormalize( NULL, bd2, &ndn );
-		ber_bvecadd( &li->suffix_massage, ndn );
+		nd2 = NULL;
+		dnNormalize( NULL, bd2, &nd2 );
+		ber_bvecadd( &li->suffix_massage, nd2 );
 #endif /* !ENABLE_REWRITE */
 
 #ifdef ENABLE_REWRITE
diff --git a/servers/slapd/back-ldap/search.c b/servers/slapd/back-ldap/search.c
index 5192b01324..b3d1547f6f 100644
--- a/servers/slapd/back-ldap/search.c
+++ b/servers/slapd/back-ldap/search.c
@@ -418,9 +418,7 @@ ldap_send_entry(
 	ldap_back_dn_massage( li, &bdn, &ent.e_name, 0, 0 );
 #endif /* !ENABLE_REWRITE */
 
-	bv = NULL;
-	dnNormalize( NULL, &ent.e_name, &bv );
-	ent.e_nname = *bv;
+	dnNormalize2( NULL, &ent.e_name, &ent.e_nname );
 	ent.e_id = 0;
 	ent.e_attrs = 0;
 	ent.e_private = 0;
diff --git a/servers/slapd/back-ldbm/alias.c b/servers/slapd/back-ldbm/alias.c
index 36ae6869e2..c2d4354fe1 100644
--- a/servers/slapd/back-ldbm/alias.c
+++ b/servers/slapd/back-ldbm/alias.c
@@ -220,8 +220,7 @@ static char* get_alias_dn(
 	const char **errmsg )
 {	
 	int rc;
-	char *dn;
-	struct berval *ndn = NULL;
+	struct berval ndn;
 	Attribute *a;
 	AttributeDescription *aliasedObjectName
 		= slap_schema.si_ad_aliasedObjectName;
@@ -255,16 +254,14 @@ static char* get_alias_dn(
 		return NULL;
 	}
 
-	rc = dnNormalize( NULL, a->a_vals[0], &ndn );
+	rc = dnNormalize2( NULL, a->a_vals[0], &ndn );
 	if( rc != LDAP_SUCCESS ) {
 		*err = LDAP_ALIAS_PROBLEM;
 		*errmsg = "alias aliasedObjectName value is invalid";
 		return NULL;
 	}
 
-	dn = ndn->bv_val;
-	free( ndn );
-	return dn;
+	return ndn.bv_val;
 }
 
 static char* new_superior(
diff --git a/servers/slapd/back-ldbm/cache.c b/servers/slapd/back-ldbm/cache.c
index 3f03c66081..d35bce0739 100644
--- a/servers/slapd/back-ldbm/cache.c
+++ b/servers/slapd/back-ldbm/cache.c
@@ -576,20 +576,20 @@ cache_find_entry_dn2id(
 {
 	int rc;
 	struct berval bv;
-	struct berval *ndn = NULL;
+	struct berval ndn;
 	ID id;
 
 	bv.bv_val = dn;
 	bv.bv_len = strlen( dn );
 
-	rc = dnNormalize( NULL, &bv, &ndn );
+	rc = dnNormalize2( NULL, &bv, &ndn );
 	if( rc != LDAP_SUCCESS ) {
 		return NOID;
 	}
 
-	id = cache_find_entry_ndn2id( be, cache, ndn->bv_val );
+	id = cache_find_entry_ndn2id( be, cache, ndn.bv_val );
 
-	ber_bvfree( ndn );
+	free( ndn.bv_val );
 	return ( id );
 }
 
diff --git a/servers/slapd/back-ldbm/modrdn.c b/servers/slapd/back-ldbm/modrdn.c
index d62ca57599..067ec9e620 100644
--- a/servers/slapd/back-ldbm/modrdn.c
+++ b/servers/slapd/back-ldbm/modrdn.c
@@ -49,7 +49,7 @@ ldbm_back_modrdn(
 	AttributeDescription *children = slap_schema.si_ad_children;
 	struct ldbminfo	*li = (struct ldbminfo *) be->be_private;
 	struct berval	p_dn, p_ndn;
-	struct berval	new_dn = { 0, NULL}, *new_ndn = NULL;
+	struct berval	new_dn = { 0, NULL}, new_ndn = { 0, NULL };
 	Entry		*e, *p = NULL;
 	Entry		*matched;
 	int		isroot = -1;
@@ -462,14 +462,14 @@ ldbm_back_modrdn(
 	
 	/* Build target dn and make sure target entry doesn't exist already. */
 	build_new_dn( &new_dn, new_parent_dn, newrdn ); 
-	dnNormalize( NULL, &new_dn, &new_ndn );
+	dnNormalize2( NULL, &new_dn, &new_ndn );
 
 #ifdef NEW_LOGGING
 	LDAP_LOG(( "backend", LDAP_LEVEL_DETAIL1,
-		"ldbm_back_modrdn: new ndn=%s\n", new_ndn->bv_val ));
+		"ldbm_back_modrdn: new ndn=%s\n", new_ndn.bv_val ));
 #else
 	Debug( LDAP_DEBUG_TRACE, "ldbm_back_modrdn: new ndn=%s\n",
-	    new_ndn->bv_val, 0, 0 );
+	    new_ndn.bv_val, 0, 0 );
 #endif
 
 	/* check for abandon */
@@ -480,7 +480,7 @@ ldbm_back_modrdn(
 	}
 
 	ldap_pvt_thread_mutex_unlock( &op->o_abandonmutex );
-	if ( ( rc_id = dn2id ( be, new_ndn->bv_val, &id ) ) || id != NOID ) {
+	if ( ( rc_id = dn2id ( be, new_ndn.bv_val, &id ) ) || id != NOID ) {
 		/* if (rc_id) something bad happened to ldbm cache */
 		send_ldap_result( conn, op, 
 			rc_id ? LDAP_OPERATIONS_ERROR : LDAP_ALREADY_EXISTS,
@@ -490,11 +490,11 @@ ldbm_back_modrdn(
 
 #ifdef NEW_LOGGING
 	LDAP_LOG(( "backend", LDAP_LEVEL_INFO,
-		"ldbm_back_modrdn: new ndn (%s) does not exist\n", new_ndn ));
+		"ldbm_back_modrdn: new ndn (%s) does not exist\n", new_ndn.bv_val ));
 #else
 	Debug( LDAP_DEBUG_TRACE,
 	    "ldbm_back_modrdn: new ndn=%s does not exist\n",
-	    new_ndn, 0, 0 );
+	    new_ndn.bv_val, 0, 0 );
 #endif
 
 
@@ -751,9 +751,9 @@ ldbm_back_modrdn(
 	free( e->e_dn );
 	free( e->e_ndn );
 	e->e_name = new_dn;
-	e->e_nname = *new_ndn;
+	e->e_nname = new_ndn;
 	new_dn.bv_val = NULL;
-	new_ndn = NULL;
+	new_ndn.bv_val = NULL;
 
 	/* add new one */
 	if ( dn2id_add( be, e->e_ndn, e->e_id ) != 0 ) {
@@ -801,7 +801,7 @@ ldbm_back_modrdn(
 
 return_results:
 	if( new_dn.bv_val != NULL ) free( new_dn.bv_val );
-	if( new_ndn != NULL ) ber_bvfree( new_ndn );
+	if( new_ndn.bv_val != NULL ) free( new_ndn.bv_val );
 
 	/* LDAP v2 supporting correct attribute handling. */
 	if( new_rdn_types != NULL ) charray_free( new_rdn_types );
diff --git a/servers/slapd/back-ldbm/passwd.c b/servers/slapd/back-ldbm/passwd.c
index 2a6ed75a28..69b496b130 100644
--- a/servers/slapd/back-ldbm/passwd.c
+++ b/servers/slapd/back-ldbm/passwd.c
@@ -39,7 +39,7 @@ ldbm_back_exop_passwd(
 	struct berval *new = NULL;
 
 	struct berval dn;
-	struct berval *ndn = NULL;
+	struct berval ndn;
 
 	assert( reqoid != NULL );
 	assert( strcmp( LDAP_EXOP_X_MODIFY_PASSWD, reqoid ) == 0 );
@@ -102,13 +102,13 @@ ldbm_back_exop_passwd(
 		goto done;
 	}
 
-	rc = dnNormalize( NULL, &dn, &ndn );
+	rc = dnNormalize2( NULL, &dn, &ndn );
 	if( rc != LDAP_SUCCESS ) {
 		*text = "Invalid DN";
 		goto done;
 	}
 
-	e = dn2entry_w( be, ndn->bv_val, NULL );
+	e = dn2entry_w( be, ndn.bv_val, NULL );
 	if( e == NULL ) {
 		*text = "could not locate authorization entry";
 		rc = LDAP_NO_SUCH_OBJECT;
@@ -187,8 +187,8 @@ done:
 		ber_bvfree( hash );
 	}
 
-	if( ndn != NULL ) {
-		ber_bvfree( ndn );
+	if( ndn.bv_val != NULL ) {
+		free( ndn.bv_val );
 	}
 
 	return rc;
diff --git a/servers/slapd/back-meta/attribute.c b/servers/slapd/back-meta/attribute.c
index 441f0d0e84..b9fcb365ba 100644
--- a/servers/slapd/back-meta/attribute.c
+++ b/servers/slapd/back-meta/attribute.c
@@ -147,8 +147,8 @@ meta_back_attribute(
 		return 1;
 	}
 
-	rc = ldap_bind_s( ld, li->targets[ candidate ]->binddn->bv_val,
-			li->targets[ candidate ]->bindpw->bv_val, LDAP_AUTH_SIMPLE );
+	rc = ldap_bind_s( ld, li->targets[ candidate ]->binddn.bv_val,
+			li->targets[ candidate ]->bindpw.bv_val, LDAP_AUTH_SIMPLE );
 	if ( rc != LDAP_SUCCESS) {
 		return 1;
 	}
diff --git a/servers/slapd/back-meta/back-meta.h b/servers/slapd/back-meta/back-meta.h
index 0c99d1e4f5..d5e11af56e 100644
--- a/servers/slapd/back-meta/back-meta.h
+++ b/servers/slapd/back-meta/back-meta.h
@@ -113,13 +113,13 @@ struct metaconn {
 
 struct metatarget {
 	char			*uri;
-	struct berval		*psuffix;	/* pretty suffix */
-	struct berval		*suffix;	/* normalized suffix */
-	struct berval		*binddn;
-	struct berval		*bindpw;
+	struct berval		psuffix;	/* pretty suffix */
+	struct berval		suffix;		/* normalized suffix */
+	struct berval		binddn;
+	struct berval		bindpw;
 
-	struct berval           *pseudorootdn;
-	struct berval           *pseudorootpw;
+	struct berval           pseudorootdn;
+	struct berval           pseudorootpw;
 
 	struct rewrite_info	*rwinfo;
 
diff --git a/servers/slapd/back-meta/bind.c b/servers/slapd/back-meta/bind.c
index 4551173ddd..b2f38977ee 100644
--- a/servers/slapd/back-meta/bind.c
+++ b/servers/slapd/back-meta/bind.c
@@ -166,10 +166,10 @@ meta_back_bind(
 #endif /* !NEW_LOGGING */
 		}
 
-		if ( isroot && li->targets[ i ]->pseudorootdn != NULL ) {
-			realdn = li->targets[ i ]->pseudorootdn;
-			realndn = li->targets[ i ]->pseudorootdn;
-			realcred = li->targets[ i ]->pseudorootpw;
+		if ( isroot && li->targets[ i ]->pseudorootdn.bv_val != NULL ) {
+			realdn = &li->targets[ i ]->pseudorootdn;
+			realndn = &li->targets[ i ]->pseudorootdn;
+			realcred = &li->targets[ i ]->pseudorootpw;
 			realmethod = LDAP_AUTH_SIMPLE;
 		}
 		
diff --git a/servers/slapd/back-meta/candidates.c b/servers/slapd/back-meta/candidates.c
index 330f5b8746..1c2fb8d58f 100644
--- a/servers/slapd/back-meta/candidates.c
+++ b/servers/slapd/back-meta/candidates.c
@@ -139,7 +139,7 @@ meta_back_count_candidates(
 	assert( li->ntargets != 0 );
 
 	for ( i = 0; i < li->ntargets; ++i ) {
-		if ( meta_back_is_candidate( li->targets[ i ]->suffix, ndn ) ) {
+		if ( meta_back_is_candidate( &li->targets[ i ]->suffix, ndn ) ) {
 			++cnt;
 		}
 	}
@@ -187,7 +187,7 @@ meta_back_select_unique_candidate(
 	}
 
 	for ( i = 0; i < li->ntargets; ++i ) {
-		if ( meta_back_is_candidate( li->targets[ i ]->suffix, ndn ) ) {
+		if ( meta_back_is_candidate( &li->targets[ i ]->suffix, ndn ) ) {
 			return i;
 		}
 	}
diff --git a/servers/slapd/back-meta/config.c b/servers/slapd/back-meta/config.c
index a21c8d56c9..72f557d08f 100644
--- a/servers/slapd/back-meta/config.c
+++ b/servers/slapd/back-meta/config.c
@@ -202,7 +202,8 @@ meta_back_db_config(
 		dn.bv_val = ludp->lud_dn;
 		dn.bv_len = strlen( ludp->lud_dn );
 
-		rc = dnPretty( NULL, &dn, &pdn );
+		rc = dnPrettyNormal( NULL, &dn, &li->targets[ i ]->psuffix,
+			&li->targets[ i ]->suffix );
 		if( rc != LDAP_SUCCESS ) {
 			fprintf( stderr, "%s: line %d: "
 					"target '%s' DN is invalid\n",
@@ -210,18 +211,6 @@ meta_back_db_config(
 			return( 1 );
 		}
 
-		rc = dnNormalize( NULL, &dn, &ndn );
-		if( rc != LDAP_SUCCESS ) {
-			fprintf( stderr, "%s: line %d: "
-					"target '%s' DN is invalid\n",
-					fname, lineno, argv[ 1 ] );
-			ber_bvfree( ndn );
-			return( 1 );
-		}
-
-		li->targets[ i ]->psuffix = pdn;
-		li->targets[ i ]->suffix = ndn;
-
 		li->targets[ i ]->uri = ch_strdup( argv[ 1 ] );
 		last = strstr( li->targets[ i ]->uri, ludp->lud_dn );
 		assert( last != NULL );
@@ -231,7 +220,7 @@ meta_back_db_config(
 		 * uri MUST be a branch of suffix!
 		 */
 #if 0 /* too strict a constraint */
-		if ( select_backend( li->targets[ i ]->suffix, 0, 0 ) != be ) {
+		if ( select_backend( &li->targets[ i ]->suffix, 0, 0 ) != be ) {
 			fprintf( stderr,
 	"%s: line %d: <naming context> of URI does not refer to current backend"
 	" in \"uri <protocol>://<server>[:port]/<naming context>\" line\n",
@@ -242,7 +231,7 @@ meta_back_db_config(
 		/*
 		 * uri MUST be a branch of a suffix!
 		 */
-		if ( select_backend( li->targets[ i ]->suffix, 0, 0 ) == NULL ) {
+		if ( select_backend( &li->targets[ i ]->suffix, 0, 0 ) == NULL ) {
 			fprintf( stderr,
 	"%s: line %d: <naming context> of URI does not resolve to a backend"
 	" in \"uri <protocol>://<server>[:port]/<naming context>\" line\n",
@@ -259,8 +248,8 @@ meta_back_db_config(
 		 * or worked out, at least, in some manner
 		 */
 		for ( j = 0; j < i-1; j++ ) {
-			if ( strcmp( li->targets[ i ]->suffix->bv_val,
-					li->targets[ j ]->suffix->bv_val ) == 0 ) {
+			if ( strcmp( li->targets[ i ]->suffix.bv_val,
+					li->targets[ j ]->suffix.bv_val ) == 0 ) {
 				fprintf( stderr,
 	"%s: line %d: naming context \"%s\" already used"
 	" in \"uri <protocol>://<server>[:port]/<naming context>\" line\n",
@@ -274,7 +263,7 @@ meta_back_db_config(
 
 		fprintf(stderr, "%s: line %d: URI \"%s\", suffix \"%s\"\n",
 			fname, lineno, li->targets[ i ]->uri, 
-			li->targets[ i ]->psuffix->bv_val );
+			li->targets[ i ]->psuffix.bv_val );
 		
 	/* default target directive */
 	} else if ( strcasecmp( argv[ 0 ], "default-target" ) == 0 ) {
@@ -347,15 +336,13 @@ meta_back_db_config(
 
 		dn.bv_val = argv[ 1 ];
 		dn.bv_len = strlen( argv[ 1 ] );
-		if ( dnNormalize( NULL, &dn, &ndn ) != LDAP_SUCCESS ) {
+		if ( dnNormalize2( NULL, &dn, &li->targets[ i ]->binddn ) != LDAP_SUCCESS ) {
 			fprintf( stderr, "%s: line %d: "
 					"bind DN '%s' is invalid\n",
 					fname, lineno, argv[ 1 ] );
 			return( 1 );
 		}
 
-		li->targets[ i ]->binddn = ndn;
-
 	/* password to use for meta_back_group */
 	} else if ( strcasecmp( argv[ 0 ], "bindpw" ) == 0 ) {
 		int 		i = li->ntargets-1;
@@ -394,15 +381,13 @@ meta_back_db_config(
 
 		dn.bv_val = argv[ 1 ];
 		dn.bv_len = strlen( argv[ 1 ] );
-		if ( dnNormalize( NULL, &dn, &ndn ) != LDAP_SUCCESS ) {
+		if ( dnNormalize2( NULL, &dn, &li->targets[ i ]->pseudorootdn ) != LDAP_SUCCESS ) {
 			fprintf( stderr, "%s: line %d: "
 					"pseudoroot DN '%s' is invalid\n",
 					fname, lineno, argv[ 1 ] );
 			return( 1 );
 		}
 
-		li->targets[ i ]->pseudorootdn = ndn;
-
 	/* password to use as pseudo-root */
 	} else if ( strcasecmp( argv[ 0 ], "pseudorootpw" ) == 0 ) {
 		int 		i = li->ntargets-1;
@@ -425,7 +410,7 @@ meta_back_db_config(
 	} else if ( strcasecmp( argv[ 0 ], "suffixmassage" ) == 0 ) {
 		BackendDB 	*tmp_be;
 		int 		i = li->ntargets-1;
-		struct berval	dn, *ndn = NULL;
+		struct berval	dn, ndn;
 
 		if ( i < 0 ) {
 			fprintf( stderr,
@@ -454,15 +439,15 @@ meta_back_db_config(
 
 		dn.bv_val = argv[ 1 ];
 		dn.bv_len = strlen( argv[ 1 ] );
-		if ( dnNormalize( NULL, &dn, &ndn ) != LDAP_SUCCESS ) {
+		if ( dnNormalize2( NULL, &dn, &ndn ) != LDAP_SUCCESS ) {
 			fprintf( stderr, "%s: line %d: "
 					"suffix '%s' is invalid\n",
 					fname, lineno, argv[ 1 ] );
 			return 1;
 		}
 		
-		tmp_be = select_backend( ndn, 0, 0 );
-		ber_bvfree( ndn );
+		tmp_be = select_backend( &ndn, 0, 0 );
+		free( ndn.bv_val );
 		if ( tmp_be != NULL && tmp_be != be ) {
 			fprintf( stderr, 
 	"%s: line %d: suffix already in use by another backend in"
@@ -473,16 +458,15 @@ meta_back_db_config(
 
 		dn.bv_val = argv[ 2 ];
 		dn.bv_len = strlen( argv[ 2 ] );
-		ndn = NULL;
-		if ( dnNormalize( NULL, &dn, &ndn ) != LDAP_SUCCESS ) {
+		if ( dnNormalize2( NULL, &dn, &ndn ) != LDAP_SUCCESS ) {
 			fprintf( stderr, "%s: line %d: "
 					"massaged suffix '%s' is invalid\n",
 					fname, lineno, argv[ 2 ] );
 			return 1;
 		}
 		
-		tmp_be = select_backend( ndn, 0, 0 );
-		ber_bvfree( ndn );
+		tmp_be = select_backend( &ndn, 0, 0 );
+		free( ndn.bv_val );
 		if ( tmp_be != NULL ) {
 			fprintf( stderr,
 	"%s: line %d: massaged suffix already in use by another backend in" 
diff --git a/servers/slapd/back-meta/conn.c b/servers/slapd/back-meta/conn.c
index e2d814ace6..b4da761c37 100644
--- a/servers/slapd/back-meta/conn.c
+++ b/servers/slapd/back-meta/conn.c
@@ -477,7 +477,7 @@ meta_back_getconn(
 	} else {
 		for ( i = 0; i < li->ntargets; i++ ) {
 			if ( i == cached 
-		|| meta_back_is_candidate( li->targets[ i ]->suffix, ndn ) ) {
+		|| meta_back_is_candidate( &li->targets[ i ]->suffix, ndn ) ) {
 
 				/*
 				 * The target is activated; if needed, it is
diff --git a/servers/slapd/back-meta/group.c b/servers/slapd/back-meta/group.c
index 5fa6526ad5..bc2d633927 100644
--- a/servers/slapd/back-meta/group.c
+++ b/servers/slapd/back-meta/group.c
@@ -238,8 +238,8 @@ meta_back_group(
 		goto cleanup;
 	}
 
-	rc = ldap_bind_s( ld, li->targets[ candidate ]->binddn->bv_val,
-			li->targets[ candidate ]->bindpw->bv_val, 
+	rc = ldap_bind_s( ld, li->targets[ candidate ]->binddn.bv_val,
+			li->targets[ candidate ]->bindpw.bv_val, 
 			LDAP_AUTH_SIMPLE );
 	if ( rc != LDAP_SUCCESS ) {
 		goto cleanup;
diff --git a/servers/slapd/back-meta/init.c b/servers/slapd/back-meta/init.c
index a68519eeab..0598fac873 100644
--- a/servers/slapd/back-meta/init.c
+++ b/servers/slapd/back-meta/init.c
@@ -181,11 +181,11 @@ target_free(
 	if ( lt->uri ) {
 		free( lt->uri );
 	}
-	if ( lt->psuffix ) {
-		ber_bvfree( lt->psuffix );
+	if ( lt->psuffix.bv_val ) {
+		free( lt->psuffix.bv_val );
 	}
-	if ( lt->suffix ) {
-		ber_bvfree( lt->suffix );
+	if ( lt->suffix.bv_val ) {
+		free( lt->suffix.bv_val );
 	}
 	if ( lt->binddn ) {
 		ber_bvfree( lt->binddn );
diff --git a/servers/slapd/back-meta/search.c b/servers/slapd/back-meta/search.c
index d6723cc2b6..b88b87c7ab 100644
--- a/servers/slapd/back-meta/search.c
+++ b/servers/slapd/back-meta/search.c
@@ -217,7 +217,7 @@ meta_back_search(
 		/*
 		 * modifies the base according to the scope, if required
 		 */
-		suffixlen = li->targets[ i ]->suffix->bv_len;
+		suffixlen = li->targets[ i ]->suffix.bv_len;
 		if ( suffixlen > nbase->bv_len ) {
 			switch ( scope ) {
 			case LDAP_SCOPE_SUBTREE:
@@ -227,9 +227,9 @@ meta_back_search(
 				 * illegal bases may be turned into 
 				 * the suffix of the target.
 				 */
-				if ( dnIsSuffix( li->targets[ i ]->suffix,
+				if ( dnIsSuffix( &li->targets[ i ]->suffix,
 						nbase ) ) {
-					realbase = li->targets[ i ]->suffix->bv_val;
+					realbase = li->targets[ i ]->suffix.bv_val;
 				} else {
 					/*
 					 * this target is no longer candidate
@@ -240,15 +240,15 @@ meta_back_search(
 				break;
 
 			case LDAP_SCOPE_ONELEVEL:
-				if ( is_one_level_rdn( li->targets[ i ]->suffix->bv_val,
+				if ( is_one_level_rdn( li->targets[ i ]->suffix.bv_val,
 						suffixlen - nbase->bv_len - 1 ) 
-			&& dnIsSuffix( li->targets[ i ]->suffix, nbase ) ) {
+			&& dnIsSuffix( &li->targets[ i ]->suffix, nbase ) ) {
 					/*
 					 * if there is exactly one level,
 					 * make the target suffix the new
 					 * base, and make scope "base"
 					 */
-					realbase = li->targets[ i ]->suffix->bv_val;
+					realbase = li->targets[ i ]->suffix.bv_val;
 					realscope = LDAP_SCOPE_BASE;
 					break;
 				} /* else continue with the next case */
@@ -585,7 +585,7 @@ meta_send_entry(
 	struct berval 		*bv;
 	const char 		*text;
 	char 			*dn, *edn = NULL;
-	struct berval		tdn, *pdn = NULL, *ndn = NULL;
+	struct berval		tdn;
 
 	struct metasingleconn *lsc = lc->conns[ target ];
 
@@ -626,18 +626,8 @@ meta_send_entry(
 
 	tdn.bv_val = edn;
 	tdn.bv_len = strlen( edn );
-	if ( dnPretty( NULL, &tdn, &pdn ) != LDAP_SUCCESS ) {
 
-	}
-
-	if ( dnNormalize( NULL, &tdn, &ndn ) != LDAP_SUCCESS ) {
-
-	}
-
-	ent.e_name = *pdn;
-	free( pdn );
-	ent.e_nname = *ndn;
-	free( ndn );
+	dnPrettyNormal( NULL, &tdn, &ent.e_name, &ent.e_nname );
 
 	/*
 	 * cache dn
diff --git a/servers/slapd/back-monitor/init.c b/servers/slapd/back-monitor/init.c
index 0b9e500ca7..652bcfc7d9 100644
--- a/servers/slapd/back-monitor/init.c
+++ b/servers/slapd/back-monitor/init.c
@@ -283,15 +283,15 @@ monitor_back_db_init(
 	e_tmp = NULL;
 	for ( i = 0; monitor_subsys[ i ].mss_name != NULL; i++ ) {
 		int 		len = strlen( monitor_subsys[ i ].mss_name );
-		struct berval	dn, *pdn;
+		struct berval	dn;
 		int		rc;
 
 		dn.bv_len = len + sizeof( "cn=" ) - 1;
 		dn.bv_val = ch_calloc( sizeof( char ), dn.bv_len + 1 );
 		strcpy( dn.bv_val, "cn=" );
 		strcat( dn.bv_val, monitor_subsys[ i ].mss_name );
-		pdn = NULL;
-		rc = dnPretty( NULL, &dn, &pdn );
+		rc = dnPretty2( NULL, &dn, &monitor_subsys[ i ].mss_rdn );
+		free( dn.bv_val );
 		if ( rc != LDAP_SUCCESS ) {
 #ifdef NEW_LOGGING
 			LDAP_LOG(( "operation", LDAP_LEVEL_CRIT,
@@ -302,35 +302,16 @@ monitor_back_db_init(
 				"monitor RDN \"%s\" is invalid\n", 
 				dn.bv_val, 0, 0 );
 #endif
-			free( dn.bv_val );
 			return( -1 );
 		}
-		free( dn.bv_val );
-		monitor_subsys[ i ].mss_rdn = pdn;
 
 		dn.bv_len += sizeof( SLAPD_MONITOR_DN ); /* 1 for the , */
 		dn.bv_val = ch_calloc( sizeof( char ), dn.bv_len + 1 );
 		strcpy( dn.bv_val , monitor_subsys[ i ].mss_rdn->bv_val );
 		strcat( dn.bv_val, "," SLAPD_MONITOR_DN );
-		pdn = NULL;
-		rc = dnPretty( NULL, &dn, &pdn );
-		if ( rc != LDAP_SUCCESS ) {
-#ifdef NEW_LOGGING
-			LDAP_LOG(( "operation", LDAP_LEVEL_CRIT,
-				"monitor DN \"%s\" is invalid\n", 
-				dn.bv_val ));
-#else
-			Debug( LDAP_DEBUG_ANY,
-				"monitor DN \"%s\" is invalid\n", 
-				dn.bv_val, 0, 0 );
-#endif
-			free( dn.bv_val );
-			return( -1 );
-		}
-		monitor_subsys[ i ].mss_dn = pdn;
-
-		pdn = NULL;
-		dnNormalize( NULL, &dn, &pdn );
+		rc = dnPrettyNormal( NULL, &dn, &monitor_subsys[ i ].mss_dn,
+			&monitor_subsys[ i ].mss_ndn );
+		free( dn.bv_val );
 		if ( rc != LDAP_SUCCESS ) {
 #ifdef NEW_LOGGING
 			LDAP_LOG(( "operation", LDAP_LEVEL_CRIT,
@@ -341,11 +322,8 @@ monitor_back_db_init(
 				"monitor DN \"%s\" is invalid\n", 
 				dn.bv_val, 0, 0 );
 #endif
-			free( dn.bv_val );
 			return( -1 );
 		}
-		free( dn.bv_val );
-		monitor_subsys[ i ].mss_ndn = pdn;
 
 		snprintf( buf, sizeof( buf ),
 				"dn: %s\n"
@@ -478,13 +456,13 @@ monitor_back_open(
 	BackendDB		*be;
 	struct monitorsubsys	*ms;
 	struct berval dn = { sizeof(SLAPD_MONITOR_DN)-1, SLAPD_MONITOR_DN };
-	struct berval *ndn = NULL;
+	struct berval ndn;
 	int rc;
 
 	/*
 	 * adds the monitor backend
 	 */
-	rc = dnNormalize( NULL, &dn, &ndn );
+	rc = dnNormalize2( NULL, &dn, &ndn );
 	if( rc != LDAP_SUCCESS ) {
 #ifdef NEW_LOGGING
 		LDAP_LOG(( "operation", LDAP_LEVEL_CRIT,
@@ -497,8 +475,8 @@ monitor_back_open(
 		return( -1 );
 	}
 
-	be = select_backend( ndn , 0, 0 );
-	ber_bvfree( ndn );
+	be = select_backend( &ndn , 0, 0 );
+	free( ndn.bv_val );
 
 	if ( be == NULL ) {
 #ifdef NEW_LOGGING
diff --git a/servers/slapd/back-passwd/search.c b/servers/slapd/back-passwd/search.c
index 30d1cd69f8..ed1e44b57d 100644
--- a/servers/slapd/back-passwd/search.c
+++ b/servers/slapd/back-passwd/search.c
@@ -246,7 +246,7 @@ pw2entry( Backend *be, struct passwd *pw, char *rdn )
 	Entry		*e;
 	struct berval	val;
 	struct berval	*vals[2];
-	struct berval	*bv = NULL;
+	struct berval	bv;
 
 	int rc;
 	const char *text;
@@ -279,7 +279,7 @@ pw2entry( Backend *be, struct passwd *pw, char *rdn )
 	sprintf( val.bv_val, "uid=%s,%s",
 		pw->pw_name, be->be_suffix[0]->bv_val );
 
-	rc = dnNormalize( NULL, &val, &bv );
+	rc = dnNormalize2( NULL, &val, &bv );
 	if( rc != LDAP_SUCCESS ) {
 		free( val.bv_val );
 		return NULL;
@@ -287,8 +287,7 @@ pw2entry( Backend *be, struct passwd *pw, char *rdn )
 
 	e = (Entry *) ch_calloc( 1, sizeof(Entry) );
 	e->e_name = val;
-	e->e_nname = *bv;
-	free( bv );
+	e->e_nname = bv;
 
 	e->e_attrs = NULL;
 
diff --git a/servers/slapd/bind.c b/servers/slapd/bind.c
index 7a8d3b6e78..737046be18 100644
--- a/servers/slapd/bind.c
+++ b/servers/slapd/bind.c
@@ -284,11 +284,8 @@ do_bind(
 		if( rc == LDAP_SUCCESS ) {
 			conn->c_dn.bv_val = edn;
 			if( edn != NULL ) {
-				struct berval *cndn;
 				conn->c_dn.bv_len = strlen( edn );
-				dnNormalize( NULL, &conn->c_dn, &cndn );
-				conn->c_ndn = *cndn;
-				free( cndn );
+				dnNormalize2( NULL, &conn->c_dn, &conn->c_ndn );
 			}
 			conn->c_authmech = conn->c_sasl_bind_mech;
 			conn->c_sasl_bind_mech = NULL;
diff --git a/servers/slapd/config.c b/servers/slapd/config.c
index ffaaadf66a..11a295c59d 100644
--- a/servers/slapd/config.c
+++ b/servers/slapd/config.c
@@ -1843,14 +1843,14 @@ read_config( const char *fname )
 #endif
 
 			} else {
-				struct berval dn, *ndn = NULL;
+				struct berval dn;
 
 				if ( load_ucdata( NULL ) < 0 ) return 1;
 
 				dn.bv_val = cargv[1];
 				dn.bv_len = strlen( cargv[1] );
 
-				rc = dnNormalize( NULL, &dn, &ndn );
+				rc = dnNormalize2( NULL, &dn, &be->be_update_ndn );
 				if( rc != LDAP_SUCCESS ) {
 #ifdef NEW_LOGGING
 					LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
@@ -1863,9 +1863,6 @@ read_config( const char *fname )
 #endif
 					return 1;
 				}
-
-				be->be_update_ndn = *ndn;
-				free( ndn );
 			}
 
 		} else if ( strcasecmp( cargv[0], "updateref" ) == 0 ) {
diff --git a/servers/slapd/dn.c b/servers/slapd/dn.c
index d1eca3f263..ac93304a96 100644
--- a/servers/slapd/dn.c
+++ b/servers/slapd/dn.c
@@ -303,14 +303,30 @@ dnNormalize(
 	struct berval *val,
 	struct berval **normalized )
 {
-	struct berval *out = NULL;
-
-	Debug( LDAP_DEBUG_TRACE, ">>> dnNormalize: <%s>\n", val->bv_val, 0, 0 );
+	struct berval *out;
+	int rc;
+
+	assert( normalized && *normalized == NULL );
+
+	out = ch_malloc( sizeof( struct berval ) );
+	rc = dnNormalize2( syntax, val, out );
+	if ( rc != LDAP_SUCCESS )
+		free( out );
+	else
+		*normalized = out;
+	return rc;
+}
 
+int
+dnNormalize2(
+	Syntax *syntax,
+	struct berval *val,
+	struct berval *out )
+{
 	assert( val );
-	assert( normalized );
+	assert( out );
 
-	assert( *normalized == NULL );
+	Debug( LDAP_DEBUG_TRACE, ">>> dnNormalize: <%s>\n", val->bv_val, 0, 0 );
 
 	if ( val->bv_len != 0 ) {
 		LDAPDN		*dn = NULL;
@@ -335,23 +351,19 @@ dnNormalize(
 		/*
 		 * Back to string representation
 		 */
-		out = ch_malloc( sizeof(struct berval));
-
 		rc = ldap_dn2bv( dn, out, LDAP_DN_FORMAT_LDAPV3 );
 
 		ldap_dnfree( dn );
 
 		if ( rc != LDAP_SUCCESS ) {
-			free( out );
 			return LDAP_INVALID_SYNTAX;
 		}
 	} else {
-		out = ber_bvdup( val );
+		ber_dupbv( out, val );
 	}
 
 	Debug( LDAP_DEBUG_TRACE, "<<< dnNormalize: <%s>\n", out->bv_val, 0, 0 );
 
-	*normalized = out;
 	return LDAP_SUCCESS;
 }
 
@@ -364,13 +376,30 @@ dnPretty(
 	struct berval *val,
 	struct berval **pretty)
 {
-	struct berval *out = NULL;
-
-	Debug( LDAP_DEBUG_TRACE, ">>> dnPretty: <%s>\n", val->bv_val, 0, 0 );
+	struct berval *out;
+	int rc;
+
+	assert( pretty && *pretty == NULL );
+
+	out = ch_malloc( sizeof( struct berval ) );
+	rc = dnPretty2( syntax, val, out );
+	if ( rc != LDAP_SUCCESS )
+		free( out );
+	else
+		*pretty = out;
+	return rc;
+}
 
+int
+dnPretty2(
+	Syntax *syntax,
+	struct berval *val,
+	struct berval *out)
+{
 	assert( val );
-	assert( pretty );
-	assert( *pretty == NULL );
+	assert( out );
+
+	Debug( LDAP_DEBUG_TRACE, ">>> dnPretty: <%s>\n", val->bv_val, 0, 0 );
 
 	if ( val->bv_len != 0 ) {
 		LDAPDN		*dn = NULL;
@@ -394,26 +423,20 @@ dnPretty(
 		/* RE: the default is the form that is used as
 		 * an internal representation; the pretty form
 		 * is a variant */
-
-		out = ch_malloc( sizeof(struct berval));
-
 		rc = ldap_dn2bv( dn, out,
 			LDAP_DN_FORMAT_LDAPV3 | LDAP_DN_PRETTY );
 
 		ldap_dnfree( dn );
 
 		if ( rc != LDAP_SUCCESS ) {
-			free( out );
 			return LDAP_INVALID_SYNTAX;
 		}
 	} else {
-		out = ber_bvdup( val );
+		ber_dupbv( out, val );
 	}
 
 	Debug( LDAP_DEBUG_TRACE, "<<< dnPretty: <%s>\n", out->bv_val, 0, 0 );
 
-	*pretty = out;
-
 	return LDAP_SUCCESS;
 }
 
diff --git a/servers/slapd/limits.c b/servers/slapd/limits.c
index c7070504d4..86becec362 100644
--- a/servers/slapd/limits.c
+++ b/servers/slapd/limits.c
@@ -40,7 +40,7 @@ get_limits(
 			if ( ndn->bv_len == 0 ) {
 				break;
 			}
-			if ( strcmp( lm[0]->lm_dn_pat->bv_val, ndn->bv_val ) == 0 ) {
+			if ( strcmp( lm[0]->lm_dn_pat.bv_val, ndn->bv_val ) == 0 ) {
 				*limit = &lm[0]->lm_limits;
 				return( 0 );
 			}
@@ -55,7 +55,7 @@ get_limits(
 				break;
 			}
 
-			d = ndn->bv_len - lm[0]->lm_dn_pat->bv_len;
+			d = ndn->bv_len - lm[0]->lm_dn_pat.bv_len;
 			/* ndn shorter than dn_pat */
 			if ( d < 0 ) {
 				break;
@@ -76,7 +76,7 @@ get_limits(
 			}
 
 			/* in case of (sub)match ... */
-			if ( strcmp( lm[0]->lm_dn_pat->bv_val, &ndn->bv_val[d] ) == 0 ) {
+			if ( strcmp( lm[0]->lm_dn_pat.bv_val, &ndn->bv_val[d] ) == 0 ) {
 				/* check for exactly one rdn in case of ONE */
 				if ( lm[0]->lm_type == SLAP_LIMITS_ONE ) {
 					/*
@@ -157,9 +157,8 @@ add_limits(
 			struct berval bv;
 			bv.bv_val = (char *) pattern;
 			bv.bv_len = strlen( pattern );
-			lm->lm_dn_pat = NULL;
 
-			rc = dnNormalize( NULL, &bv, &lm->lm_dn_pat );
+			rc = dnNormalize2( NULL, &bv, &lm->lm_dn_pat );
 			if ( rc != LDAP_SUCCESS ) {
 				ch_free( lm );
 				return( -1 );
@@ -170,10 +169,10 @@ add_limits(
 	case SLAP_LIMITS_REGEX:
 	case SLAP_LIMITS_UNDEFINED:
 		lm->lm_type = SLAP_LIMITS_REGEX;
-		lm->lm_dn_pat = ber_bvstrdup( pattern );
-		if ( regcomp( &lm->lm_dn_regex, lm->lm_dn_pat->bv_val, 
+		ber_str2bv( pattern, 0, 1, &lm->lm_dn_pat );
+		if ( regcomp( &lm->lm_dn_regex, lm->lm_dn_pat.bv_val, 
 					REG_EXTENDED | REG_ICASE ) ) {
-			ber_bvfree( lm->lm_dn_pat );
+			free( lm->lm_dn_pat.bv_val );
 			ch_free( lm );
 			return( -1 );
 		}
@@ -182,7 +181,8 @@ add_limits(
 	case SLAP_LIMITS_ANONYMOUS:
 	case SLAP_LIMITS_USERS:
 		lm->lm_type = type;
-		lm->lm_dn_pat = NULL;
+		lm->lm_dn_pat.bv_val = NULL;
+		lm->lm_dn_pat.bv_len = 0;
 		break;
 	}
 
diff --git a/servers/slapd/proto-slap.h b/servers/slapd/proto-slap.h
index af7e2bac69..2a2f2d530b 100644
--- a/servers/slapd/proto-slap.h
+++ b/servers/slapd/proto-slap.h
@@ -357,11 +357,21 @@ LDAP_SLAPD_F (int) dnNormalize LDAP_P((
 	struct berval *val, 
 	struct berval **normalized ));
 
+LDAP_SLAPD_F (int) dnNormalize2 LDAP_P((
+	Syntax *syntax, 
+	struct berval *val, 
+	struct berval *normalized ));
+
 LDAP_SLAPD_F (int) dnPretty LDAP_P(( 
 	Syntax *syntax, 
 	struct berval *val, 
 	struct berval **pretty ));
 
+LDAP_SLAPD_F (int) dnPretty2 LDAP_P(( 
+	Syntax *syntax, 
+	struct berval *val, 
+	struct berval *pretty ));
+
 LDAP_SLAPD_F (int) dnPrettyNormal LDAP_P(( 
 	Syntax *syntax, 
 	struct berval *val, 
diff --git a/servers/slapd/saslauthz.c b/servers/slapd/saslauthz.c
index 0420c893c1..ca64be45dd 100644
--- a/servers/slapd/saslauthz.c
+++ b/servers/slapd/saslauthz.c
@@ -30,7 +30,7 @@
 int slap_parseURI( char *uri, struct berval *searchbase, int *scope, Filter **filter )
 {
 	char *start, *end;
-	struct berval bv, *nbase = NULL;
+	struct berval bv;
 	int rc;
 
 
@@ -57,11 +57,9 @@ int slap_parseURI( char *uri, struct berval *searchbase, int *scope, Filter **fi
 		 * will have to make this right.
 		 */
 is_dn:		bv.bv_len = 1;
-		rc = dnNormalize( NULL, &bv, &nbase );
+		rc = dnNormalize2( NULL, &bv, searchbase );
 		if (rc == LDAP_SUCCESS) {
 			*scope = LDAP_SCOPE_BASE;
-			*searchbase = *nbase;
-			free( nbase );
 		}
 		return( rc );
 	}
@@ -82,21 +80,14 @@ is_dn:		bv.bv_len = 1;
 	bv.bv_val = start;
 	if( end == NULL ) {
 		bv.bv_len = 1;
-		rc = dnNormalize( NULL, &bv, &nbase );
-		if (rc == LDAP_SUCCESS) {
-			*searchbase = *nbase;
-			free( nbase );
-		}
-		return( rc );
+		return dnNormalize2( NULL, &bv, searchbase );
 	}
 	*end = '\0';
 	bv.bv_len = end - start;
-	rc = dnNormalize( NULL, &bv, &nbase );
+	rc = dnNormalize2( NULL, &bv, searchbase );
 	*end = '?';
 	if (rc != LDAP_SUCCESS)
 		return( rc );
-	*searchbase = *nbase;
-	free( nbase );
 
 	/* Skip the attrs */
 	start = end+1;
@@ -314,7 +305,7 @@ char *slap_sasl2dn( char *saslname )
 	char *uri=NULL;
 	struct berval searchbase = {0, NULL};
 	struct berval dn = {0, NULL};
-	struct berval *ndn = NULL;
+	struct berval ndn;
 	int rc, scope;
 	Backend *be;
 	Filter *filter=NULL;
@@ -397,15 +388,14 @@ char *slap_sasl2dn( char *saslname )
 	dn.bv_val = ldap_get_dn( client, msg );
 	dn.bv_len = dn.bv_val ? strlen( dn.bv_val ) : 0;
 	if( dn.bv_val ) {
-		rc = dnNormalize( NULL, &dn, &ndn );
+		rc = dnNormalize2( NULL, &dn, &ndn );
 		ldap_memfree( dn.bv_val );
 		if( rc != LDAP_SUCCESS ) {
 			dn.bv_val = NULL;
 			dn.bv_len = 0;
 			goto FINISHED;
 		}
-		dn = *ndn;
-		free( ndn );
+		dn = ndn;
 	}
 
 FINISHED:
@@ -519,15 +509,15 @@ int slap_sasl_match( char *rule, char *assertDN, char *authc )
 		dn.bv_val = ldap_get_dn( client, msg );
 
 		if( dn.bv_val ) {
-			struct berval *ndn = NULL;
+			struct berval ndn;
 			dn.bv_len = strlen( dn.bv_val );
-			rc = dnNormalize( NULL, &dn, &ndn );
+			rc = dnNormalize2( NULL, &dn, &ndn );
 			ldap_memfree( dn.bv_val );
 			if( rc != LDAP_SUCCESS ) {
 				goto CONCLUDED;
 			}
-			rc = strcmp( ndn->bv_val, assertDN );
-			ber_bvfree( ndn );
+			rc = strcmp( ndn.bv_val, assertDN );
+			free( ndn.bv_val );
 			if( rc == 0 ) {
 				rc = LDAP_SUCCESS;
 				goto CONCLUDED;
diff --git a/servers/slapd/schema.c b/servers/slapd/schema.c
index 7337bee924..5925b14e8e 100644
--- a/servers/slapd/schema.c
+++ b/servers/slapd/schema.c
@@ -28,7 +28,7 @@ schema_info( Entry **entry, const char **text )
 		= slap_schema.si_ad_objectClass;
 
 	Entry		*e;
-	struct berval	val, *ndn = NULL;
+	struct berval	val;
 	struct berval	*vals[2];
 
 	vals[0] = &val;
@@ -38,9 +38,7 @@ schema_info( Entry **entry, const char **text )
 
 	e->e_attrs = NULL;
 	ber_str2bv( SLAPD_SCHEMA_DN, sizeof(SLAPD_SCHEMA_DN)-1, 1, &e->e_name);
-	(void) dnNormalize( NULL, &e->e_name, &ndn );
-	e->e_nname = *ndn;
-	free( ndn );
+	(void) dnNormalize2( NULL, &e->e_name, &e->e_nname );
 	e->e_private = NULL;
 
 	val.bv_val = "LDAPsubentry";
diff --git a/servers/slapd/slap.h b/servers/slapd/slap.h
index 724470f861..bff8f8ac03 100644
--- a/servers/slapd/slap.h
+++ b/servers/slapd/slap.h
@@ -895,7 +895,7 @@ struct slap_limits {
 	 * normalized DN for EXACT, BASE, ONE, SUBTREE, CHILDREN;
 	 * pattern for REGEX; NULL for ANONYMOUS, USERS
 	 */
-	struct berval *lm_dn_pat;
+	struct berval lm_dn_pat;
 
 	struct slap_limits_set	lm_limits;
 };
-- 
2.39.5