From b7555937cb3b26c4ff3217b66122a102094b20ea Mon Sep 17 00:00:00 2001
From: Quanah Gibson-Mount <quanah@openldap.org>
Date: Wed, 10 Sep 2008 18:32:11 +0000
Subject: [PATCH] ITS#5691

---
 CHANGES                            |  6 +++-
 libraries/librewrite/info.c        |  2 +-
 libraries/librewrite/map.c         | 56 ++++++++++++++++++++++++------
 libraries/librewrite/params.c      | 32 ++++++++---------
 libraries/librewrite/rule.c        | 13 ++++++-
 libraries/librewrite/session.c     | 22 +++++-------
 libraries/librewrite/subst.c       |  4 +++
 libraries/librewrite/var.c         | 10 +++++-
 libraries/librewrite/xmap.c        | 52 ++++++++++++++-------------
 servers/slapd/add.c                |  6 ++--
 servers/slapd/alock.c              | 16 +++++++--
 servers/slapd/back-dnssrv/search.c |  4 +--
 servers/slapd/back-meta/map.c      | 16 ++++-----
 servers/slapd/component.c          | 14 +++++---
 servers/slapd/filterentry.c        |  4 +--
 15 files changed, 167 insertions(+), 90 deletions(-)

diff --git a/CHANGES b/CHANGES
index b78919f198..6c57ee9277 100644
--- a/CHANGES
+++ b/CHANGES
@@ -3,6 +3,7 @@ OpenLDAP 2.4 Change Log
 OpenLDAP 2.4.12 Engineering
 	Fixed libldap TLS_CRLFILE (ITS#5677)
 	Fixed liblutil executables on Windows (ITS#5604)
+	Fixed librewrite memory handling (ITS#5691)
 	Fixed slapd aci performance (ITS#5636)
 	Fixed slapd aci's with sets (ITS#5627)
 	Fixed slapd attribute leak (ITS#5683)
@@ -11,6 +12,7 @@ OpenLDAP 2.4.12 Engineering
 	Fixed slapd dynacl mask handling (ITS#5637)
 	Fixed slapd firstComponentMatch normalization (ITS#5634)
 	Added slapd caseIgnoreListMatch (ITS#5608)
+	Fixed slapd memory handling (ITS#5691)
 	Fixed slapd objectClass canonicalization (ITS#5681)
 	Fixed slapd objectClass termination (ITS#5682)
 	Fixed slapd overlay control registration (ITS#5649)
@@ -20,9 +22,11 @@ OpenLDAP 2.4.12 Engineering
 	Fixed slapd syncrepl contextCSN detection (ITS#5675)
 	Fixed slapd syncrepl error logging (ITS#5618)
 	Fixed slapd-bdb entry return if attr not present (ITS#5650)
+	Fixed slapd-dnssrv memory handling (ITS#5691)
 	Fixed slapd-ldap,slapd-meta invalid filter behavior (ITS#5614)
-	Fixed slapd-meta quarantine behavior (ITS#5592)
+	Fixed slapd-meta memory handling (ITS#5691)
 	Fixed slapd-meta objectClass filtering (ITS#5647)
+	Fixed slapd-meta quarantine behavior (ITS#5592)
 	Fixed slapd-relay initialization (ITS#5643)
 	Fixed slapd-sql freeing of connection (ITS#5607)
 	Fixed slapd-sql fault on NULL fields (ITS#5653)
diff --git a/libraries/librewrite/info.c b/libraries/librewrite/info.c
index ad3d4866f1..4923ac726e 100644
--- a/libraries/librewrite/info.c
+++ b/libraries/librewrite/info.c
@@ -216,7 +216,7 @@ rewrite_session(
 
 		case REWRITE_MODE_COPY_INPUT:
 			*result = strdup( string );
-			rc = REWRITE_REGEXEC_OK;
+			rc = ( *result != NULL ) ? REWRITE_REGEXEC_OK : REWRITE_REGEXEC_ERR;
 			goto rc_return;
 
 		case REWRITE_MODE_USE_DEFAULT:
diff --git a/libraries/librewrite/map.c b/libraries/librewrite/map.c
index 9389313e20..ae83843868 100644
--- a/libraries/librewrite/map.c
+++ b/libraries/librewrite/map.c
@@ -88,6 +88,9 @@ rewrite_map_parse(
 	 */
 	l = p - string - 1;
 	s = calloc( sizeof( char ), l + 1 );
+	if ( s == NULL ) {
+		return NULL;
+	}
 	AC_MEMCPY( s, string, l );
 	s[ l ] = 0;
 
@@ -231,6 +234,10 @@ rewrite_map_parse(
 		 */
 		map->lm_type = REWRITE_MAP_SUBCONTEXT;
 		map->lm_name = strdup( s + 1 );
+		if ( map->lm_name == NULL ) {
+			rc = -1;
+			goto cleanup;
+		}
 		map->lm_data = rewrite_context_find( info, s + 1 );
 		if ( map->lm_data == NULL ) {
 			rc = -1;
@@ -266,6 +273,10 @@ rewrite_map_parse(
 				map->lm_name = strdup( s + 1 );
 			}
 		}
+		if ( map->lm_name == NULL ) {
+			rc = -1;
+			goto cleanup;
+		}
 		break;
 	
 	/*
@@ -279,6 +290,10 @@ rewrite_map_parse(
 			map->lm_type = REWRITE_MAP_GET_OP_VAR;
 			map->lm_name = strdup( s + 1 );
 		}
+		if ( map->lm_name == NULL ) {
+			rc = -1;
+			goto cleanup;
+		}
 		break;
 	
 	/*
@@ -287,6 +302,10 @@ rewrite_map_parse(
 	case REWRITE_OPERATOR_PARAM_GET:		/* '$' */
 		map->lm_type = REWRITE_MAP_GET_PARAM;
 		map->lm_name = strdup( s + 1 );
+		if ( map->lm_name == NULL ) {
+			rc = -1;
+			goto cleanup;
+		}
 		break;
 	
 	/*
@@ -295,6 +314,10 @@ rewrite_map_parse(
 	default:
 		map->lm_type = REWRITE_MAP_BUILTIN;
 		map->lm_name = strdup( s );
+		if ( map->lm_name == NULL ) {
+			rc = -1;
+			goto cleanup;
+		}
 		map->lm_data = rewrite_builtin_map_find( info, s );
 		if ( map->lm_data == NULL ) {
 			rc = -1;
@@ -372,11 +395,16 @@ rewrite_map_apply(
 		rc = rewrite_var_set( &op->lo_vars, map->lm_name,
 				key->bv_val, 1 )
 			? REWRITE_SUCCESS : REWRITE_ERR;
-		if ( map->lm_type == REWRITE_MAP_SET_OP_VAR ) {
-			val->bv_val = strdup( "" );
-		} else {
-			val->bv_val = strdup( key->bv_val );
-			val->bv_len = key->bv_len;
+		if ( rc == REWRITE_SUCCESS ) {
+			if ( map->lm_type == REWRITE_MAP_SET_OP_VAR ) {
+				val->bv_val = strdup( "" );
+			} else {
+				val->bv_val = strdup( key->bv_val );
+				val->bv_len = key->bv_len;
+			}
+			if ( val->bv_val == NULL ) {
+				rc = REWRITE_ERR;
+			}
 		}
 		break;
 	
@@ -389,6 +417,9 @@ rewrite_map_apply(
 		} else {
 			val->bv_val = strdup( var->lv_value.bv_val );
 			val->bv_len = var->lv_value.bv_len;
+			if ( val->bv_val == NULL ) {
+				rc = REWRITE_ERR;
+			}
 		}
 		break;	
 	}
@@ -401,11 +432,16 @@ rewrite_map_apply(
 		}
 		rc = rewrite_session_var_set( info, op->lo_cookie, 
 				map->lm_name, key->bv_val );
-		if ( map->lm_type == REWRITE_MAP_SET_SESN_VAR ) {
-			val->bv_val = strdup( "" );
-		} else {
-			val->bv_val = strdup( key->bv_val );
-			val->bv_len = key->bv_len;
+		if ( rc == REWRITE_SUCCESS ) {
+			if ( map->lm_type == REWRITE_MAP_SET_SESN_VAR ) {
+				val->bv_val = strdup( "" );
+			} else {
+				val->bv_val = strdup( key->bv_val );
+				val->bv_len = key->bv_len;
+			}
+			if ( val->bv_val == NULL ) {
+				rc = REWRITE_ERR;
+			}
 		}
 		break;
 
diff --git a/libraries/librewrite/params.c b/libraries/librewrite/params.c
index 30e7657419..a75d31bc87 100644
--- a/libraries/librewrite/params.c
+++ b/libraries/librewrite/params.c
@@ -32,6 +32,7 @@ rewrite_param_set(
 )
 {
 	struct rewrite_var *var;
+	int rc = REWRITE_SUCCESS;
 
 	assert( info != NULL );
 	assert( name != NULL );
@@ -47,21 +48,20 @@ rewrite_param_set(
 		free( var->lv_value.bv_val );
 		var->lv_value.bv_val = strdup( value );
 		var->lv_value.bv_len = strlen( value );
+
 	} else {
 		var = rewrite_var_insert( &info->li_params, name, value );
-		if ( var == NULL ) {
-#ifdef USE_REWRITE_LDAP_PVT_THREADS
-			ldap_pvt_thread_rdwr_wunlock( &info->li_params_mutex );
-#endif /* USE_REWRITE_LDAP_PVT_THREADS */
-			return REWRITE_ERR;
-		}
+	}
+
+	if ( var == NULL || var->lv_value.bv_val == NULL ) {
+		rc = REWRITE_ERR;
 	}
 	
 #ifdef USE_REWRITE_LDAP_PVT_THREADS
 	ldap_pvt_thread_rdwr_wunlock( &info->li_params_mutex );
 #endif /* USE_REWRITE_LDAP_PVT_THREADS */
 
-	return REWRITE_SUCCESS;
+	return rc;
 }
 
 /*
@@ -75,6 +75,7 @@ rewrite_param_get(
 )
 {
 	struct rewrite_var *var;
+	int rc = REWRITE_SUCCESS;
 
 	assert( info != NULL );
 	assert( name != NULL );
@@ -88,22 +89,19 @@ rewrite_param_get(
 #endif /* USE_REWRITE_LDAP_PVT_THREADS */
 	
 	var = rewrite_var_find( info->li_params, name );
-	if ( var == NULL ) {
-		
-#ifdef USE_REWRITE_LDAP_PVT_THREADS
-		ldap_pvt_thread_rdwr_runlock( &info->li_params_mutex );
-#endif /* USE_REWRITE_LDAP_PVT_THREADS */
-		
-		return REWRITE_ERR;
-	} else {
+	if ( var != NULL ) {
 		value->bv_val = strdup( var->lv_value.bv_val );
 		value->bv_len = var->lv_value.bv_len;
 	}
+
+	if ( var == NULL || value->bv_val == NULL ) {
+		rc = REWRITE_ERR;
+	}
 	
 #ifdef USE_REWRITE_LDAP_PVT_THREADS
-        ldap_pvt_thread_rdwr_runlock( &info->li_params_mutex );
+	ldap_pvt_thread_rdwr_runlock( &info->li_params_mutex );
 #endif /* USE_REWRITE_LDAP_PVT_THREADS */
-	
+
 	return REWRITE_SUCCESS;
 }
 
diff --git a/libraries/librewrite/rule.c b/libraries/librewrite/rule.c
index 6a00d7b43f..276fbca319 100644
--- a/libraries/librewrite/rule.c
+++ b/libraries/librewrite/rule.c
@@ -336,7 +336,6 @@ rewrite_rule_compile(
 	 * REGEX compilation (luckily I don't need to take care of this ...)
 	 */
 	if ( regcomp( &rule->lr_regex, ( char * )pattern, flags ) != 0 ) {
-		free( rule );
 		goto fail;
 	}
 	
@@ -346,6 +345,12 @@ rewrite_rule_compile(
 	rule->lr_pattern = strdup( pattern );
 	rule->lr_subststring = strdup( result );
 	rule->lr_flagstring = strdup( flagstring );
+	if ( rule->lr_pattern == NULL
+		|| rule->lr_subststring == NULL
+		|| rule->lr_flagstring == NULL )
+	{
+		goto fail;
+	}
 	
 	/*
 	 * Load compiled data into rule
@@ -368,6 +373,12 @@ rewrite_rule_compile(
 	return REWRITE_SUCCESS;
 
 fail:
+	if ( rule ) {
+		if ( rule->lr_pattern ) free( rule->lr_pattern );
+		if ( rule->lr_subststring ) free( rule->lr_subststring );
+		if ( rule->lr_flagstring ) free( rule->lr_flagstring );
+		free( rule );
+	}
 	destroy_actions( first_action );
 	free( subst );
 	return REWRITE_ERR;
diff --git a/libraries/librewrite/session.c b/libraries/librewrite/session.c
index b7c54ea7e7..beadbf0561 100644
--- a/libraries/librewrite/session.c
+++ b/libraries/librewrite/session.c
@@ -256,6 +256,7 @@ rewrite_session_var_get(
 {
 	struct rewrite_session *session;
 	struct rewrite_var *var;
+	int rc = REWRITE_SUCCESS;
 
 	assert( info != NULL );
 	assert( cookie != NULL );
@@ -279,27 +280,22 @@ rewrite_session_var_get(
 #endif /* USE_REWRITE_LDAP_PVT_THREADS */
 	
 	var = rewrite_var_find( session->ls_vars, name );
-	if ( var == NULL ) {
-		
-#ifdef USE_REWRITE_LDAP_PVT_THREADS
-	        ldap_pvt_thread_rdwr_runlock( &session->ls_vars_mutex );
-#endif /* USE_REWRITE_LDAP_PVT_THREADS */
-
-		rewrite_session_return( info, session );
-
-		return REWRITE_ERR;
-	} else {
+	if ( var != NULL ) {
 		value->bv_val = strdup( var->lv_value.bv_val );
 		value->bv_len = var->lv_value.bv_len;
 	}
-	
+
+	if ( var == NULL || value->bv_val == NULL ) {
+		rc = REWRITE_ERR;
+	}
+
 #ifdef USE_REWRITE_LDAP_PVT_THREADS
         ldap_pvt_thread_rdwr_runlock( &session->ls_vars_mutex );
 #endif /* USE_REWRITE_LDAP_PVT_THREADS */
 
 	rewrite_session_return( info, session );
-	
-	return REWRITE_SUCCESS;
+
+	return rc;
 }
 
 static void
diff --git a/libraries/librewrite/subst.c b/libraries/librewrite/subst.c
index 4af1406d5a..a2c15368a5 100644
--- a/libraries/librewrite/subst.c
+++ b/libraries/librewrite/subst.c
@@ -193,6 +193,10 @@ rewrite_subst_compile(
 		subs_len += l;
 		subs[ nsub ].bv_len = l;
 		subs[ nsub ].bv_val = malloc( l + 1 );
+		if ( subs[ nsub ].bv_val == NULL ) {
+			free( subs );
+			goto cleanup;
+		}
 		AC_MEMCPY( subs[ nsub ].bv_val, begin, l );
 		subs[ nsub ].bv_val[ l ] = '\0';
 	} else {
diff --git a/libraries/librewrite/var.c b/libraries/librewrite/var.c
index 0f4b3cf3ee..26459335ee 100644
--- a/libraries/librewrite/var.c
+++ b/libraries/librewrite/var.c
@@ -123,7 +123,11 @@ rewrite_var_replace(
 		int flags
 )
 {
-	ber_len_t	len = strlen( value );
+	ber_len_t	len;
+
+	assert( value != NULL );
+
+	len = strlen( value );
 
 	if ( var->lv_flags & REWRITE_VAR_COPY_VALUE ) {
 		if ( flags & REWRITE_VAR_COPY_VALUE ) {
@@ -151,6 +155,10 @@ rewrite_var_replace(
 		}
 	}
 
+	if ( var->lv_value.bv_val == NULL ) {
+		return -1;
+	}
+
 	var->lv_value.bv_len = len;
 
 	return 0;
diff --git a/libraries/librewrite/xmap.c b/libraries/librewrite/xmap.c
index 686498dc32..f8aa216997 100644
--- a/libraries/librewrite/xmap.c
+++ b/libraries/librewrite/xmap.c
@@ -74,6 +74,10 @@ rewrite_xmap_parse(
 	if ( strncasecmp(s, "xpasswd", 7 ) == 0 ) {
 		map->lm_type = REWRITE_MAP_XPWDMAP;
 		map->lm_name = strdup( "xpasswd" );
+		if ( map->lm_name == NULL ) {
+			free( map );
+			return NULL;
+		}
 
 		assert( s[7] == '}' );
 		*currpos = s + 8;
@@ -123,6 +127,10 @@ rewrite_xmap_parse(
 
 		l = p - s - c;
 		filename = calloc( sizeof( char ), l + 1 );
+		if ( filename == NULL ) {
+			free( map );
+			return NULL;
+		}
 		AC_MEMCPY( filename, s + c, l );
 		filename[ l ] = '\0';
 		
@@ -177,6 +185,10 @@ rewrite_xmap_parse(
 		 */
 		l = p - s - c;
 		url = calloc( sizeof( char ), l + 3 );
+		if ( url == NULL ) {
+			free( map );
+			return NULL;
+		}
 		AC_MEMCPY( url, s + c, l );
 		url[ l ] = '\0';
 
@@ -269,15 +281,6 @@ rewrite_xmap_apply(
 			int l = strlen( pwd->pw_gecos );
 			
 			val->bv_val = strdup( pwd->pw_gecos );
-			if ( val->bv_val == NULL ) {
-
-#ifdef USE_REWRITE_LDAP_PVT_THREADS
-		                ldap_pvt_thread_mutex_unlock( &xpasswd_mutex );
-#endif /* USE_REWRITE_LDAP_PVT_THREADS */
-
-				rc = REWRITE_ERR;
-				break;
-			}
 			val->bv_len = l;
 		} else
 #endif /* HAVE_STRUCT_PASSWD_PW_GECOS */
@@ -289,7 +292,10 @@ rewrite_xmap_apply(
 #ifdef USE_REWRITE_LDAP_PVT_THREADS
 		ldap_pvt_thread_mutex_unlock( &xpasswd_mutex );
 #endif /* USE_REWRITE_LDAP_PVT_THREADS */
-			
+
+		if ( val->bv_val == NULL ) {
+			rc = REWRITE_ERR;
+		}
 		break;
 	}
 #endif /* HAVE_GETPWNAM*/
@@ -400,31 +406,27 @@ rewrite_xmap_apply(
 		}
 		if ( attrsonly == 1 ) {
 			val->bv_val = ldap_get_dn( ld, entry );
-			if ( val->bv_val == NULL ) {
-				ldap_msgfree( res );
-                                ldap_unbind( ld );
-                                rc = REWRITE_ERR;
-                                goto rc_return;
-                        }
+
 		} else {
 			values = ldap_get_values( ld, entry,
 					lud->lud_attrs[0] );
-			if ( values == NULL ) {
-				ldap_msgfree( res );
-				ldap_unbind( ld );
-				rc = REWRITE_ERR;
-				goto rc_return;
+			if ( values != NULL ) {
+				val->bv_val = strdup( values[ 0 ] );
+				ldap_value_free( values );
 			}
-			val->bv_val = strdup( values[ 0 ] );
-			ldap_value_free( values );
 		}
-		val->bv_len = strlen( val->bv_val );
 
 		ldap_msgfree( res );
 		ldap_unbind( ld );
 		
+		if ( val->bv_val == NULL ) {
+			rc = REWRITE_ERR;
+			goto rc_return;
+		}
+		val->bv_len = strlen( val->bv_val );
+
 		rc = REWRITE_SUCCESS;
-	}
+	} break;
 	}
 
 rc_return:;
diff --git a/servers/slapd/add.c b/servers/slapd/add.c
index 2561152d0b..43c1b4d9ff 100644
--- a/servers/slapd/add.c
+++ b/servers/slapd/add.c
@@ -531,7 +531,7 @@ slap_entry2mods(
 
 	while ( a_new != NULL ) {
 		a_new_desc = a_new->a_desc;
-		mod = (Modifications *) malloc( sizeof( Modifications ));
+		mod = (Modifications *) ch_malloc( sizeof( Modifications ));
 		
 		mod->sml_op = LDAP_MOD_REPLACE;
 		mod->sml_flags = 0;
@@ -541,7 +541,7 @@ slap_entry2mods(
 		count = a_new->a_numvals;
 		mod->sml_numvals = a_new->a_numvals;
 
-		mod->sml_values = (struct berval*) malloc(
+		mod->sml_values = (struct berval*) ch_malloc(
 			(count+1) * sizeof( struct berval) );
 
 		/* see slap_mods_check() comments...
@@ -549,7 +549,7 @@ slap_entry2mods(
 		 * in this case, mod->sml_nvalues must be left NULL.
 		 */
 		if ( a_new->a_vals != a_new->a_nvals ) {
-			mod->sml_nvalues = (struct berval*) malloc(
+			mod->sml_nvalues = (struct berval*) ch_malloc(
 				(count+1) * sizeof( struct berval) );
 		} else {
 			mod->sml_nvalues = NULL;
diff --git a/servers/slapd/alock.c b/servers/slapd/alock.c
index a5377a560d..3d091bf60f 100644
--- a/servers/slapd/alock.c
+++ b/servers/slapd/alock.c
@@ -24,6 +24,7 @@
 #if SLAPD_BDB || SLAPD_HDB
 
 #include "alock.h"
+#include "lutil.h"
 
 #include <ac/stdlib.h>
 #include <ac/string.h>
@@ -239,6 +240,9 @@ alock_read_slot ( alock_info_t * info,
 
 	if (slot_data->al_appname) free (slot_data->al_appname);
 	slot_data->al_appname = calloc (1, ALOCK_MAX_APPNAME);
+	if (slot_data->al_appname == NULL) {
+		return -1;
+	}
 	strncpy (slot_data->al_appname, (char *)slotbuf+32, ALOCK_MAX_APPNAME-1);
 	(slot_data->al_appname) [ALOCK_MAX_APPNAME-1] = '\0';
 
@@ -335,6 +339,7 @@ alock_open ( alock_info_t * info,
 	char * filename;
 	int res, max_slot;
 	int dirty_count, live_count, nosave;
+	char *ptr;
 
 	assert (info != NULL);
 	assert (appname != NULL);
@@ -345,12 +350,19 @@ alock_open ( alock_info_t * info,
 	slot_data.al_stamp = time(NULL);
 	slot_data.al_pid = getpid();
 	slot_data.al_appname = calloc (1, ALOCK_MAX_APPNAME);
+	if (slot_data.al_appname == NULL) {
+		return ALOCK_UNSTABLE;
+	}
 	strncpy (slot_data.al_appname, appname, ALOCK_MAX_APPNAME-1);
 	slot_data.al_appname [ALOCK_MAX_APPNAME-1] = '\0';
 
 	filename = calloc (1, strlen (envdir) + strlen ("/alock") + 1);
-	strcpy (filename, envdir);
-	strcat (filename, "/alock");
+	if (filename == NULL ) {
+		free (slot_data.al_appname);
+		return ALOCK_UNSTABLE;
+	}
+	ptr = lutil_strcopy(filename, envdir);
+	lutil_strcopy(ptr, "/alock");
 	info->al_fd = open (filename, O_CREAT|O_RDWR, 0666);
 	free (filename);
 	if (info->al_fd < 0) {
diff --git a/servers/slapd/back-dnssrv/search.c b/servers/slapd/back-dnssrv/search.c
index d6360aedc0..c18b65cbb0 100644
--- a/servers/slapd/back-dnssrv/search.c
+++ b/servers/slapd/back-dnssrv/search.c
@@ -169,9 +169,9 @@ dnssrv_back_search(
 		AttributeDescription *ad_objectClass
 			= slap_schema.si_ad_objectClass;
 		AttributeDescription *ad_ref = slap_schema.si_ad_ref;
-		e.e_name.bv_val = strdup( op->o_req_dn.bv_val );
+		e.e_name.bv_val = ch_strdup( op->o_req_dn.bv_val );
 		e.e_name.bv_len = op->o_req_dn.bv_len;
-		e.e_nname.bv_val = strdup( op->o_req_ndn.bv_val );
+		e.e_nname.bv_val = ch_strdup( op->o_req_ndn.bv_val );
 		e.e_nname.bv_len = op->o_req_ndn.bv_len;
 
 		e.e_attrs = NULL;
diff --git a/servers/slapd/back-meta/map.c b/servers/slapd/back-meta/map.c
index 45e1358e0a..dce679122f 100644
--- a/servers/slapd/back-meta/map.c
+++ b/servers/slapd/back-meta/map.c
@@ -333,7 +333,7 @@ ldap_back_int_filter_map_rewrite(
 
 		fstr->bv_len = atmp.bv_len + vtmp.bv_len
 			+ ( sizeof("(=)") - 1 );
-		fstr->bv_val = malloc( fstr->bv_len + 1 );
+		fstr->bv_val = ch_malloc( fstr->bv_len + 1 );
 
 		snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s=%s)",
 			atmp.bv_val, vtmp.bv_len ? vtmp.bv_val : "" );
@@ -350,7 +350,7 @@ ldap_back_int_filter_map_rewrite(
 
 		fstr->bv_len = atmp.bv_len + vtmp.bv_len
 			+ ( sizeof("(>=)") - 1 );
-		fstr->bv_val = malloc( fstr->bv_len + 1 );
+		fstr->bv_val = ch_malloc( fstr->bv_len + 1 );
 
 		snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s>=%s)",
 			atmp.bv_val, vtmp.bv_len ? vtmp.bv_val : "" );
@@ -367,7 +367,7 @@ ldap_back_int_filter_map_rewrite(
 
 		fstr->bv_len = atmp.bv_len + vtmp.bv_len
 			+ ( sizeof("(<=)") - 1 );
-		fstr->bv_val = malloc( fstr->bv_len + 1 );
+		fstr->bv_val = ch_malloc( fstr->bv_len + 1 );
 
 		snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s<=%s)",
 			atmp.bv_val, vtmp.bv_len ? vtmp.bv_val : "" );
@@ -384,7 +384,7 @@ ldap_back_int_filter_map_rewrite(
 
 		fstr->bv_len = atmp.bv_len + vtmp.bv_len
 			+ ( sizeof("(~=)") - 1 );
-		fstr->bv_val = malloc( fstr->bv_len + 1 );
+		fstr->bv_val = ch_malloc( fstr->bv_len + 1 );
 
 		snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s~=%s)",
 			atmp.bv_val, vtmp.bv_len ? vtmp.bv_val : "" );
@@ -402,7 +402,7 @@ ldap_back_int_filter_map_rewrite(
 		/* cannot be a DN ... */
 
 		fstr->bv_len = atmp.bv_len + ( STRLENOF( "(=*)" ) );
-		fstr->bv_val = malloc( fstr->bv_len + 128 ); /* FIXME: why 128 ? */
+		fstr->bv_val = ch_malloc( fstr->bv_len + 128 ); /* FIXME: why 128 ? */
 
 		snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s=*)",
 			atmp.bv_val );
@@ -462,7 +462,7 @@ ldap_back_int_filter_map_rewrite(
 		}
 
 		fstr->bv_len = atmp.bv_len + ( STRLENOF( "(=*)" ) );
-		fstr->bv_val = malloc( fstr->bv_len + 1 );
+		fstr->bv_val = ch_malloc( fstr->bv_len + 1 );
 
 		snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s=*)",
 			atmp.bv_val );
@@ -472,7 +472,7 @@ ldap_back_int_filter_map_rewrite(
 	case LDAP_FILTER_OR:
 	case LDAP_FILTER_NOT:
 		fstr->bv_len = STRLENOF( "(%)" );
-		fstr->bv_val = malloc( fstr->bv_len + 128 );	/* FIXME: why 128? */
+		fstr->bv_val = ch_malloc( fstr->bv_len + 128 );	/* FIXME: why 128? */
 
 		snprintf( fstr->bv_val, fstr->bv_len + 1, "(%c)",
 			f->f_choice == LDAP_FILTER_AND ? '&' :
@@ -517,7 +517,7 @@ ldap_back_int_filter_map_rewrite(
 			( f->f_mr_dnattrs ? STRLENOF( ":dn" ) : 0 ) +
 			( !BER_BVISEMPTY( &f->f_mr_rule_text ) ? f->f_mr_rule_text.bv_len + 1 : 0 ) +
 			vtmp.bv_len + ( STRLENOF( "(:=)" ) );
-		fstr->bv_val = malloc( fstr->bv_len + 1 );
+		fstr->bv_val = ch_malloc( fstr->bv_len + 1 );
 
 		snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s%s%s%s:=%s)",
 			atmp.bv_val,
diff --git a/servers/slapd/component.c b/servers/slapd/component.c
index 56054bb5fc..d950e2ae8a 100644
--- a/servers/slapd/component.c
+++ b/servers/slapd/component.c
@@ -491,7 +491,10 @@ get_componentId( Operation *op, ComponentAssertionValue* cav,
 	if ( op ) {
 		*cid = op->o_tmpalloc( sizeof( ComponentId ), op->o_tmpmemctx );
 	} else {
-		*cid = malloc( sizeof( ComponentId ) );
+		*cid = SLAP_MALLOC( sizeof( ComponentId ) );
+	}
+	if (*cid == NULL) {
+		return LDAP_NO_MEMORY;
 	}
 	**cid = _cid;
 	return LDAP_SUCCESS;
@@ -564,7 +567,7 @@ get_component_reference(
 		ca_comp_ref = op->o_tmpalloc( sizeof( ComponentReference ),
 			op->o_tmpmemctx );
 	} else {
-		ca_comp_ref = malloc( sizeof( ComponentReference ) );
+		ca_comp_ref = SLAP_MALLOC( sizeof( ComponentReference ) );
 	}
 
 	if ( !ca_comp_ref ) return LDAP_NO_MEMORY;
@@ -951,7 +954,7 @@ get_item( Operation *op, ComponentAssertionValue* cav, ComponentAssertion** ca,
 	if ( op )
 		_ca = op->o_tmpalloc( sizeof( ComponentAssertion ), op->o_tmpmemctx );
 	else
-		_ca = malloc( sizeof( ComponentAssertion ) );
+		_ca = SLAP_MALLOC( sizeof( ComponentAssertion ) );
 
 	if ( !_ca ) return LDAP_NO_MEMORY;
 
@@ -1170,7 +1173,10 @@ parse_comp_filter( Operation* op, ComponentAssertionValue* cav,
 		if ( op ) {
 			*filt = op->o_tmpalloc( sizeof(f), op->o_tmpmemctx );
 		} else {
-			*filt = malloc( sizeof(f) );
+			*filt = SLAP_MALLOC( sizeof(f) );
+		}
+		if ( *filt == NULL ) {
+			return LDAP_NO_MEMORY;
 		}
 		**filt = f;
 	}
diff --git a/servers/slapd/filterentry.c b/servers/slapd/filterentry.c
index 93c78e75de..68bcca86bf 100644
--- a/servers/slapd/filterentry.c
+++ b/servers/slapd/filterentry.c
@@ -220,7 +220,7 @@ static int test_mra_filter(
 					num_attr_vals++;
 
 					/* following malloced will be freed by comp_tree_free () */
-					a->a_comp_data = malloc( sizeof( ComponentData ) +
+					a->a_comp_data = SLAP_MALLOC( sizeof( ComponentData ) +
 						sizeof( ComponentSyntaxInfo* )*num_attr_vals );
 
 					if ( !a->a_comp_data ) return LDAP_NO_MEMORY;
@@ -716,7 +716,7 @@ test_ava_filter(
 			num_attr_vals++;/* for NULL termination */
 
 			/* following malloced will be freed by comp_tree_free () */
-			a->a_comp_data = malloc( sizeof( ComponentData ) + sizeof( ComponentSyntaxInfo* )*num_attr_vals );
+			a->a_comp_data = SLAP_MALLOC( sizeof( ComponentData ) + sizeof( ComponentSyntaxInfo* )*num_attr_vals );
 
 			if ( !a->a_comp_data ) {
 				return LDAP_NO_MEMORY;
-- 
2.39.5