Remove smbldap_get_single_pstring() and all pstrings

from pdb_ldap.c. I don't have an LDAP passdb setup here,
so I'm going to need some help on testing this.
Jeremy.
(This used to be commit 00760451b6c2b65f3a8a9187789ca4f270b622a2)

2 files changed, 803 insertions, 462 deletions

diff --git a/source3/passdb/passdb.c b/source3/passdb/passdb.c
index e1e5967af3..a9dd90eda1 100644
--- a/source3/passdb/passdb.c
+++ b/source3/passdb/passdb.c
@@ -340,7 +340,7 @@ uint32 pdb_decode_acct_ctrl(const char *p)
  Routine to set 32 hex password characters from a 16 byte array.
 **************************************************************/
 
-void pdb_sethexpwd(char *p, const unsigned char *pwd, uint32 acct_ctrl)
+void pdb_sethexpwd(char p[33], const unsigned char *pwd, uint32 acct_ctrl)
 {
 	if (pwd != NULL) {
 		int i;
diff --git a/source3/passdb/pdb_ldap.c b/source3/passdb/pdb_ldap.c
index 0c60e3f63f..a3637bffd4 100644
--- a/source3/passdb/pdb_ldap.c
+++ b/source3/passdb/pdb_ldap.c
@@ -193,7 +193,7 @@ static NTSTATUS ldapsam_get_seq_num(struct pdb_methods *my_methods, time_t *seq_
 	TALLOC_CTX *mem_ctx;
 	char **values = NULL;
 	int rc, num_result, num_values, rid;
-	pstring suffix;
+	char *suffix = NULL;
 	fstring tok;
 	const char *p;
 	const char **attrs;
@@ -239,16 +239,25 @@ static NTSTATUS ldapsam_get_seq_num(struct pdb_methods *my_methods, time_t *seq_
 		/* csn=20050126161620Z#0000001#00#00000 */
 		attrs[0] = talloc_strdup(mem_ctx, "syncreplCookie");
 		attrs[1] = NULL;
-		pstr_sprintf( suffix, "cn=syncrepl%d,%s", rid, lp_ldap_suffix());
-
+		suffix = talloc_asprintf(mem_ctx,
+				"cn=syncrepl%d,%s", rid, lp_ldap_suffix());
+		if (!suffix) {
+			ntstatus = NT_STATUS_NO_MEMORY;
+			goto done;
+		}
 	} else {
 
 		/* provider contextCSN */
 		/* 20050126161620Z#000009#00#000000 */
 		attrs[0] = talloc_strdup(mem_ctx, "contextCSN");
 		attrs[1] = NULL;
-		pstr_sprintf( suffix, "cn=ldapsync,%s", lp_ldap_suffix());
+		suffix = talloc_asprintf(mem_ctx,
+				"cn=ldapsync,%s", lp_ldap_suffix());
 
+		if (!suffix) {
+			ntstatus = NT_STATUS_NO_MEMORY;
+			goto done;
+		}
 	}
 
 	rc = smbldap_search(ldap_state->smbldap_state, suffix,
@@ -320,13 +329,14 @@ static NTSTATUS ldapsam_get_seq_num(struct pdb_methods *my_methods, time_t *seq_
  Run the search by name.
 ******************************************************************/
 
-int ldapsam_search_suffix_by_name(struct ldapsam_privates *ldap_state, 
+int ldapsam_search_suffix_by_name(struct ldapsam_privates *ldap_state,
 					  const char *user,
 					  LDAPMessage ** result,
 					  const char **attr)
 {
-	pstring filter;
+	char *filter = NULL;
 	char *escape_user = escape_ldap_string_alloc(user);
+	int ret = -1;
 
 	if (!escape_user) {
 		return LDAP_NO_MEMORY;
@@ -336,37 +346,49 @@ int ldapsam_search_suffix_by_name(struct ldapsam_privates *ldap_state,
 	 * in the filter expression, replace %u with the real name
 	 * so in ldap filter, %u MUST exist :-)
 	 */
-	pstr_sprintf(filter, "(&%s%s)", "(uid=%u)", 
+	filter = talloc_asprintf(talloc_tos(), "(&%s%s)", "(uid=%u)",
 		get_objclass_filter(ldap_state->schema_ver));
-
-	/* 
+	if (!filter) {
+		return LDAP_NO_MEMORY;
+	}
+	/*
 	 * have to use this here because $ is filtered out
-	   * in pstring_sub
+	 * in string_sub
 	 */
-	
 
-	all_string_sub(filter, "%u", escape_user, sizeof(pstring));
+	filter = talloc_all_string_sub(talloc_tos(),
+				filter, "%u", escape_user);
+	if (!filter) {
+		return LDAP_NO_MEMORY;
+	}
 	SAFE_FREE(escape_user);
 
-	return smbldap_search_suffix(ldap_state->smbldap_state, filter, attr, result);
+	ret = smbldap_search_suffix(ldap_state->smbldap_state,
+			filter, attr, result);
+	TALLOC_FREE(filter);
+	return ret;
 }
 
 /*******************************************************************
  Run the search by rid.
 ******************************************************************/
 
-static int ldapsam_search_suffix_by_rid (struct ldapsam_privates *ldap_state, 
-					 uint32 rid, LDAPMessage ** result, 
+static int ldapsam_search_suffix_by_rid (struct ldapsam_privates *ldap_state,
+					 uint32 rid, LDAPMessage ** result,
 					 const char **attr)
 {
-	pstring filter;
+	char *filter = NULL;
 	int rc;
 
-	pstr_sprintf(filter, "(&(rid=%i)%s)", rid, 
+	filter = talloc_asprintf(talloc_tos(), "(&(rid=%i)%s)", rid,
 		get_objclass_filter(ldap_state->schema_ver));
-	
-	rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, attr, result);
-	
+	if (!filter) {
+		return LDAP_NO_MEMORY;
+	}
+
+	rc = smbldap_search_suffix(ldap_state->smbldap_state,
+			filter, attr, result);
+	TALLOC_FREE(filter);
 	return rc;
 }
 
@@ -374,21 +396,27 @@ static int ldapsam_search_suffix_by_rid (struct ldapsam_privates *ldap_state,
  Run the search by SID.
 ******************************************************************/
 
-static int ldapsam_search_suffix_by_sid (struct ldapsam_privates *ldap_state, 
-					 const DOM_SID *sid, LDAPMessage ** result, 
-					 const char **attr)
+static int ldapsam_search_suffix_by_sid (struct ldapsam_privates *ldap_state,
+				 const DOM_SID *sid, LDAPMessage ** result,
+				 const char **attr)
 {
-	pstring filter;
+	char *filter = NULL;
 	int rc;
 	fstring sid_string;
 
-	pstr_sprintf(filter, "(&(%s=%s)%s)", 
-		get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID),
-		sid_to_string(sid_string, sid), 
+	filter = talloc_asprintf(talloc_tos(), "(&(%s=%s)%s)",
+		get_userattr_key2string(ldap_state->schema_ver,
+			LDAP_ATTR_USER_SID),
+		sid_to_string(sid_string, sid),
 		get_objclass_filter(ldap_state->schema_ver));
-		
-	rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, attr, result);
-	
+	if (!filter) {
+		return LDAP_NO_MEMORY;
+	}
+
+	rc = smbldap_search_suffix(ldap_state->smbldap_state,
+			filter, attr, result);
+
+	TALLOC_FREE(filter);
 	return rc;
 }
 
@@ -441,28 +469,32 @@ static int ldapsam_delete_entry(struct ldapsam_privates *priv,
 	if (ptr != NULL) {
 		ber_free(ptr, 0);
 	}
-	
+
 	smbldap_set_mod(&mods, LDAP_MOD_DELETE, "objectClass", objectclass);
 	talloc_autofree_ldapmod(mem_ctx, mods);
-	
+
 	return smbldap_modify(priv->smbldap_state, dn, mods);
 }
-		  
+
 static time_t ldapsam_get_entry_timestamp( struct ldapsam_privates *ldap_state, LDAPMessage * entry)
 {
-	pstring temp;	
+	char *temp;
 	struct tm tm;
 
-	if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
+	temp = smbldap_talloc_single_attribute(ldap_state->smbldap_state->ldap_struct, entry,
 			get_userattr_key2string(ldap_state->schema_ver,LDAP_ATTR_MOD_TIMESTAMP),
-			temp))
+			talloc_tos());
+	if (!temp) {
 		return (time_t) 0;
+	}
 
 	if ( !strptime(temp, "%Y%m%d%H%M%SZ", &tm)) {
 		DEBUG(2,("ldapsam_get_entry_timestamp: strptime failed on: %s\n",
 			(char*)temp));
+		TALLOC_FREE(temp);
 		return (time_t) 0;
 	}
+	TALLOC_FREE(temp);
 	tzset();
 	return timegm(&tm);
 }
@@ -472,100 +504,104 @@ static time_t ldapsam_get_entry_timestamp( struct ldapsam_privates *ldap_state,
  (Based on init_sam_from_buffer in pdb_tdb.c)
 *********************************************************************/
 
-static bool init_sam_from_ldap(struct ldapsam_privates *ldap_state, 
+static bool init_sam_from_ldap(struct ldapsam_privates *ldap_state,
 				struct samu * sampass,
 				LDAPMessage * entry)
 {
 	time_t  logon_time,
 			logoff_time,
 			kickoff_time,
-			pass_last_set_time, 
-			pass_can_change_time, 
+			pass_last_set_time,
+			pass_can_change_time,
 			pass_must_change_time,
 			ldap_entry_time,
 			bad_password_time;
-	pstring 	username, 
-			domain,
-			nt_username,
-			fullname,
-			homedir,
-			dir_drive,
-			logon_script,
-			profile_path,
-			acct_desc,
-			workstations;
-	char		munged_dial[2048];
-	uint32 		user_rid; 
+	char *username = NULL,
+			*domain = NULL,
+			*nt_username = NULL,
+			*fullname = NULL,
+			*homedir = NULL,
+			*dir_drive = NULL,
+			*logon_script = NULL,
+			*profile_path = NULL,
+			*acct_desc = NULL,
+			*workstations = NULL,
+			*munged_dial = NULL;
+	uint32 		user_rid;
 	uint8 		smblmpwd[LM_HASH_LEN],
 			smbntpwd[NT_HASH_LEN];
 	bool 		use_samba_attrs = True;
 	uint32 		acct_ctrl = 0;
 	uint16		logon_divs;
-	uint16 		bad_password_count = 0, 
+	uint16 		bad_password_count = 0,
 			logon_count = 0;
 	uint32 hours_len;
 	uint8 		hours[MAX_HOURS_LEN];
-	pstring temp;
+	char *temp = NULL;
 	LOGIN_CACHE	*cache_entry = NULL;
 	uint32 		pwHistLen;
-	pstring		tmpstring;
 	bool expand_explicit = lp_passdb_expand_explicit();
+	bool ret = false;
+	TALLOC_CTX *ctx = talloc_init("init_sam_from_ldap");
 
-	/*
-	 * do a little initialization
-	 */
-	username[0] 	= '\0';
-	domain[0] 	= '\0';
-	nt_username[0] 	= '\0';
-	fullname[0] 	= '\0';
-	homedir[0] 	= '\0';
-	dir_drive[0] 	= '\0';
-	logon_script[0] = '\0';
-	profile_path[0] = '\0';
-	acct_desc[0] 	= '\0';
-	munged_dial[0] 	= '\0';
-	workstations[0] = '\0';
-	 
-
+	if (!ctx) {
+		return false;
+	}
 	if (sampass == NULL || ldap_state == NULL || entry == NULL) {
 		DEBUG(0, ("init_sam_from_ldap: NULL parameters found!\n"));
-		return False;
+		goto fn_exit;
 	}
 
 	if (priv2ld(ldap_state) == NULL) {
 		DEBUG(0, ("init_sam_from_ldap: ldap_state->smbldap_state->"
 			  "ldap_struct is NULL!\n"));
-		return False;
+		goto fn_exit;
 	}
-	
-	if (!smbldap_get_single_pstring(priv2ld(ldap_state), entry, "uid",
-					username)) {
+
+	if (!(username = smbldap_talloc_single_attribute(priv2ld(ldap_state),
+					entry,
+					"uid",
+					ctx))) {
 		DEBUG(1, ("init_sam_from_ldap: No uid attribute found for "
 			  "this user!\n"));
-		return False;
+		goto fn_exit;
 	}
 
 	DEBUG(2, ("init_sam_from_ldap: Entry found for user: %s\n", username));
 
-	pstrcpy(nt_username, username);
+	nt_username = talloc_strdup(ctx, username);
+	if (!nt_username) {
+		goto fn_exit;
+	}
+
+	domain = talloc_strdup(ctx, ldap_state->domain_name);
+	if (!domain) {
+		goto fn_exit;
+	}
 
-	pstrcpy(domain, ldap_state->domain_name);
-	
 	pdb_set_username(sampass, username, PDB_SET);
 
 	pdb_set_domain(sampass, domain, PDB_DEFAULT);
 	pdb_set_nt_username(sampass, nt_username, PDB_SET);
 
 	/* deal with different attributes between the schema first */
-	
+
 	if ( ldap_state->schema_ver == SCHEMAVER_SAMBASAMACCOUNT ) {
-		if (smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry, 
-				get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID), temp)) {
+		if ((temp = smbldap_talloc_single_attribute(
+				ldap_state->smbldap_state->ldap_struct,
+				entry,
+				get_userattr_key2string(ldap_state->schema_ver,
+					LDAP_ATTR_USER_SID),
+				ctx))!=NULL) {
 			pdb_set_user_sid_from_string(sampass, temp, PDB_SET);
 		}
 	} else {
-		if (smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
-				get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_RID), temp)) {
+		if ((temp = smbldap_talloc_single_attribute(
+				ldap_state->smbldap_state->ldap_struct,
+				entry,
+				get_userattr_key2string(ldap_state->schema_ver,
+					LDAP_ATTR_USER_RID),
+				ctx))!=NULL) {
 			user_rid = (uint32)atol(temp);
 			pdb_set_user_sid_from_rid(sampass, user_rid, PDB_SET);
 		}
@@ -573,58 +609,81 @@ static bool init_sam_from_ldap(struct ldapsam_privates *ldap_state,
 
 	if (pdb_get_init_flags(sampass,PDB_USERSID) == PDB_DEFAULT) {
 		DEBUG(1, ("init_sam_from_ldap: no %s or %s attribute found for this user %s\n", 
-			get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID),
-			get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_RID),
+			get_userattr_key2string(ldap_state->schema_ver,
+				LDAP_ATTR_USER_SID),
+			get_userattr_key2string(ldap_state->schema_ver,
+				LDAP_ATTR_USER_RID),
 			username));
 		return False;
 	}
 
-	if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry, 
-			get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_LAST_SET), temp)) {
-		/* leave as default */
-	} else {
+	temp = smbldap_talloc_single_attribute(
+			ldap_state->smbldap_state->ldap_struct,
+			entry,
+			get_userattr_key2string(ldap_state->schema_ver,
+				LDAP_ATTR_PWD_LAST_SET),
+			ctx);
+	if (temp) {
 		pass_last_set_time = (time_t) atol(temp);
-		pdb_set_pass_last_set_time(sampass, pass_last_set_time, PDB_SET);
+		pdb_set_pass_last_set_time(sampass,
+				pass_last_set_time, PDB_SET);
 	}
 
-	if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry, 
-			get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_TIME), temp)) {
-		/* leave as default */
-	} else {
+	temp = smbldap_talloc_single_attribute(
+			ldap_state->smbldap_state->ldap_struct,
+			entry,
+			get_userattr_key2string(ldap_state->schema_ver,
+				LDAP_ATTR_LOGON_TIME),
+			ctx);
+	if (temp) {
 		logon_time = (time_t) atol(temp);
 		pdb_set_logon_time(sampass, logon_time, PDB_SET);
 	}
 
-	if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry, 
-			get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGOFF_TIME), temp)) {
-		/* leave as default */
-	} else {
+	temp = smbldap_talloc_single_attribute(
+			ldap_state->smbldap_state->ldap_struct,
+			entry,
+			get_userattr_key2string(ldap_state->schema_ver,
+				LDAP_ATTR_LOGOFF_TIME),
+			ctx);
+	if (temp) {
 		logoff_time = (time_t) atol(temp);
 		pdb_set_logoff_time(sampass, logoff_time, PDB_SET);
 	}
 
-	if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry, 
-			get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_KICKOFF_TIME), temp)) {
-		/* leave as default */
-	} else {
+	temp = smbldap_talloc_single_attribute(
+			ldap_state->smbldap_state->ldap_struct,
+			entry,
+			get_userattr_key2string(ldap_state->schema_ver,
+				LDAP_ATTR_KICKOFF_TIME),
+			ctx);
+	if (temp) {
 		kickoff_time = (time_t) atol(temp);
 		pdb_set_kickoff_time(sampass, kickoff_time, PDB_SET);
 	}
 
-	if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry, 
-			get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_CAN_CHANGE), temp)) {
-		/* leave as default */
-	} else {
+	temp = smbldap_talloc_single_attribute(
+			ldap_state->smbldap_state->ldap_struct,
+			entry,
+			get_userattr_key2string(ldap_state->schema_ver,
+				LDAP_ATTR_PWD_CAN_CHANGE),
+			ctx);
+	if (temp) {
 		pass_can_change_time = (time_t) atol(temp);
-		pdb_set_pass_can_change_time(sampass, pass_can_change_time, PDB_SET);
+		pdb_set_pass_can_change_time(sampass,
+				pass_can_change_time, PDB_SET);
 	}
 
-	if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry, 
-			get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_MUST_CHANGE), temp)) {	
-		/* leave as default */
-	} else {
+	temp = smbldap_talloc_single_attribute(
+			ldap_state->smbldap_state->ldap_struct,
+			entry,
+			get_userattr_key2string(ldap_state->schema_ver,
+				LDAP_ATTR_PWD_MUST_CHANGE),
+			ctx);
+	if (temp) {
 		pass_must_change_time = (time_t) atol(temp);
-		pdb_set_pass_must_change_time(sampass, pass_must_change_time, PDB_SET);
+		pdb_set_pass_must_change_time(sampass,
+				pass_must_change_time, PDB_SET);
 	}
 
 	/* recommend that 'gecos' and 'displayName' should refer to the same
@@ -633,98 +692,142 @@ static bool init_sam_from_ldap(struct ldapsam_privates *ldap_state,
 	 * that fits your needs; using cn then displayName rather than 'userFullName'
 	 */
 
-	if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
-			get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_DISPLAY_NAME), fullname)) {
-		if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
-				get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_CN), fullname)) {
-			/* leave as default */
-		} else {
+	fullname = smbldap_talloc_single_attribute(
+			ldap_state->smbldap_state->ldap_struct,
+			entry,
+			get_userattr_key2string(ldap_state->schema_ver,
+				LDAP_ATTR_DISPLAY_NAME),
+			ctx);
+	if (fullname) {
+		pdb_set_fullname(sampass, fullname, PDB_SET);
+	} else {
+		fullname = smbldap_talloc_single_attribute(
+				ldap_state->smbldap_state->ldap_struct,
+				entry,
+				get_userattr_key2string(ldap_state->schema_ver,
+					LDAP_ATTR_CN),
+				ctx);
+		if (fullname) {
 			pdb_set_fullname(sampass, fullname, PDB_SET);
 		}
-	} else {
-		pdb_set_fullname(sampass, fullname, PDB_SET);
 	}
 
-	if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry, 
-			get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_HOME_DRIVE), dir_drive)) 
-	{
-		pdb_set_dir_drive( sampass, lp_logon_drive(), PDB_DEFAULT );
-	} else {
+	dir_drive = smbldap_talloc_single_attribute(
+			ldap_state->smbldap_state->ldap_struct,
+			entry,
+			get_userattr_key2string(ldap_state->schema_ver,
+				LDAP_ATTR_HOME_DRIVE),
+			ctx);
+	if (dir_drive) {
 		pdb_set_dir_drive(sampass, dir_drive, PDB_SET);
+	} else {
+		pdb_set_dir_drive( sampass, lp_logon_drive(), PDB_DEFAULT );
 	}
 
-	if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
-			get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_HOME_PATH), homedir)) 
-	{
-		pdb_set_homedir( sampass, 
-			talloc_sub_basic(sampass, username, domain,
-					 lp_logon_home()),
-			PDB_DEFAULT );
-	} else {
-		pstrcpy( tmpstring, homedir );
+	homedir = smbldap_talloc_single_attribute(
+			ldap_state->smbldap_state->ldap_struct,
+			entry,
+			get_userattr_key2string(ldap_state->schema_ver,
+				LDAP_ATTR_HOME_PATH),
+			ctx);
+	if (homedir) {
 		if (expand_explicit) {
-			standard_sub_basic( username, domain, tmpstring,
-					    sizeof(tmpstring) );
+			homedir = talloc_sub_basic(ctx,
+						username,
+						domain,
+						homedir);
+			if (!homedir) {
+				goto fn_exit;
+			}
 		}
-		pdb_set_homedir(sampass, tmpstring, PDB_SET);
+		pdb_set_homedir(sampass, homedir, PDB_SET);
+	} else {
+		pdb_set_homedir(sampass,
+			talloc_sub_basic(ctx, username, domain,
+					 lp_logon_home()),
+			PDB_DEFAULT);
 	}
 
-	if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
-			get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_SCRIPT), logon_script)) 
-	{
-		pdb_set_logon_script( sampass, 
-			talloc_sub_basic(sampass, username, domain,
-					 lp_logon_script()), 
-			PDB_DEFAULT );
-	} else {
-		pstrcpy( tmpstring, logon_script );
+	logon_script = smbldap_talloc_single_attribute(
+			ldap_state->smbldap_state->ldap_struct,
+			entry,
+			get_userattr_key2string(ldap_state->schema_ver,
+				LDAP_ATTR_LOGON_SCRIPT),
+			ctx);
+	if (logon_script) {
 		if (expand_explicit) {
-			standard_sub_basic( username, domain, tmpstring,
-					    sizeof(tmpstring) );
+			logon_script = talloc_sub_basic(ctx,
+						username,
+						domain,
+						logon_script);
+			if (!logon_script) {
+				goto fn_exit;
+			}
 		}
-		pdb_set_logon_script(sampass, tmpstring, PDB_SET);
+		pdb_set_logon_script(sampass, logon_script, PDB_SET);
+	} else {
+		pdb_set_logon_script(sampass,
+			talloc_sub_basic(ctx, username, domain,
+					 lp_logon_script()),
+			PDB_DEFAULT );
 	}
 
-	if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
-			get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PROFILE_PATH), profile_path)) 
-	{
-		pdb_set_profile_path( sampass, 
-			talloc_sub_basic( sampass, username, domain,
-					  lp_logon_path()),
-			PDB_DEFAULT );
-	} else {
-		pstrcpy( tmpstring, profile_path );
+	profile_path = smbldap_talloc_single_attribute(
+			ldap_state->smbldap_state->ldap_struct,
+			entry,
+			get_userattr_key2string(ldap_state->schema_ver,
+				LDAP_ATTR_PROFILE_PATH),
+			ctx);
+	if (profile_path) {
 		if (expand_explicit) {
-			standard_sub_basic( username, domain, tmpstring,
-					    sizeof(tmpstring) );
+			profile_path = talloc_sub_basic(ctx,
+						username,
+						domain,
+						profile_path);
+			if (!profile_path) {
+				goto fn_exit;
+			}
 		}
-		pdb_set_profile_path(sampass, tmpstring, PDB_SET);
+		pdb_set_profile_path(sampass, profile_path, PDB_SET);
+	} else {
+		pdb_set_profile_path(sampass,
+			talloc_sub_basic(ctx, username, domain,
+					  lp_logon_path()),
+			PDB_DEFAULT );
 	}
 
-	if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry, 
-		get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_DESC), acct_desc)) 
-	{
-		/* leave as default */
-	} else {
+	acct_desc = smbldap_talloc_single_attribute(
+			ldap_state->smbldap_state->ldap_struct,
+			entry,
+			get_userattr_key2string(ldap_state->schema_ver,
+				LDAP_ATTR_DESC),
+			ctx);
+	if (acct_desc) {
 		pdb_set_acct_desc(sampass, acct_desc, PDB_SET);
 	}
 
-	if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry, 
-		get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_WKS), workstations)) {
-		/* leave as default */;
-	} else {
+	workstations = smbldap_talloc_single_attribute(
+			ldap_state->smbldap_state->ldap_struct,
+			entry,
+			get_userattr_key2string(ldap_state->schema_ver,
+				LDAP_ATTR_USER_WKS),
+			ctx);
+	if (workstations) {
 		pdb_set_workstations(sampass, workstations, PDB_SET);
 	}
 
-	if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, 
-		get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_MUNGED_DIAL), munged_dial, sizeof(munged_dial))) {
-		/* leave as default */;
-	} else {
+	munged_dial = smbldap_talloc_single_attribute(
+			ldap_state->smbldap_state->ldap_struct,
+			entry,
+			get_userattr_key2string(ldap_state->schema_ver,
+				LDAP_ATTR_MUNGED_DIAL),
+			ctx);
+	if (munged_dial) {
 		pdb_set_munged_dial(sampass, munged_dial, PDB_SET);
 	}
-	
+
 	/* FIXME: hours stuff should be cleaner */
-	
+
 	logon_divs = 168;
 	hours_len = 21;
 	memset(hours, 0xff, hours_len);
@@ -733,7 +836,7 @@ static bool init_sam_from_ldap(struct ldapsam_privates *ldap_state,
 		char *user_dn;
 		size_t pwd_len;
 		char clear_text_pw[512];
-   
+
 		/* Make call to Novell eDirectory ldap extension to get clear text password.
 			NOTE: This will only work if we have an SSL connection to eDirectory. */
 		user_dn = smbldap_get_dn(ldap_state->smbldap_state->ldap_struct, entry);
@@ -764,25 +867,33 @@ static bool init_sam_from_ldap(struct ldapsam_privates *ldap_state,
 	}
 
 	if (use_samba_attrs) {
-		if (!smbldap_get_single_pstring (ldap_state->smbldap_state->ldap_struct, entry, 
-			get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LMPW), temp)) {
-			/* leave as default */
-		} else {
+		temp = smbldap_talloc_single_attribute(
+				ldap_state->smbldap_state->ldap_struct,
+				entry,
+				get_userattr_key2string(ldap_state->schema_ver,
+					LDAP_ATTR_LMPW),
+				ctx);
+		if (temp) {
 			pdb_gethexpwd(temp, smblmpwd);
 			memset((char *)temp, '\0', strlen(temp)+1);
-			if (!pdb_set_lanman_passwd(sampass, smblmpwd, PDB_SET))
-				return False;
+			if (!pdb_set_lanman_passwd(sampass, smblmpwd, PDB_SET)) {
+				goto fn_exit;
+			}
 			ZERO_STRUCT(smblmpwd);
 		}
 
-		if (!smbldap_get_single_pstring (ldap_state->smbldap_state->ldap_struct, entry,
-			get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_NTPW), temp)) {
-			/* leave as default */
-		} else {
+		temp = smbldap_talloc_single_attribute(
+				ldap_state->smbldap_state->ldap_struct,
+				entry,
+				get_userattr_key2string(ldap_state->schema_ver,
+					LDAP_ATTR_NTPW),
+				ctx);
+		if (temp) {
 			pdb_gethexpwd(temp, smbntpwd);
 			memset((char *)temp, '\0', strlen(temp)+1);
-			if (!pdb_set_nt_passwd(sampass, smbntpwd, PDB_SET))
-				return False;
+			if (!pdb_set_nt_passwd(sampass, smbntpwd, PDB_SET)) {
+				goto fn_exit;
+			}
 			ZERO_STRUCT(smbntpwd);
 		}
 	}
@@ -793,31 +904,42 @@ static bool init_sam_from_ldap(struct ldapsam_privates *ldap_state,
 	if (pwHistLen > 0){
 		uint8 *pwhist = NULL;
 		int i;
-		char history_string[MAX_PW_HISTORY_LEN*64];
+		char *history_string = TALLOC_ARRAY(ctx, char,
+						MAX_PW_HISTORY_LEN*64);
+
+		if (!history_string) {
+			goto fn_exit;
+		}
 
 		pwHistLen = MIN(pwHistLen, MAX_PW_HISTORY_LEN);
 
-		if ((pwhist = SMB_MALLOC_ARRAY(uint8, pwHistLen * PW_HISTORY_ENTRY_LEN)) == NULL){
-			DEBUG(0, ("init_sam_from_ldap: malloc failed!\n"));
-			return False;
+		if ((pwhist = TALLOC_ARRAY(ctx, uint8,
+					pwHistLen * PW_HISTORY_ENTRY_LEN)) ==
+				NULL){
+			DEBUG(0, ("init_sam_from_ldap: talloc failed!\n"));
+			goto fn_exit;
 		}
 		memset(pwhist, '\0', pwHistLen * PW_HISTORY_ENTRY_LEN);
 
-		if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry,
-						  get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_HISTORY),
-						  history_string, sizeof(history_string))) {
-			/* leave as default - zeros */
-		} else {
-			bool hex_failed = False;
+		if (smbldap_get_single_attribute(
+				ldap_state->smbldap_state->ldap_struct,
+				entry,
+				get_userattr_key2string(ldap_state->schema_ver,
+					LDAP_ATTR_PWD_HISTORY),
+				history_string,
+				MAX_PW_HISTORY_LEN*64)) {
+			bool hex_failed = false;
 			for (i = 0; i < pwHistLen; i++){
 				/* Get the 16 byte salt. */
-				if (!pdb_gethexpwd(&history_string[i*64], &pwhist[i*PW_HISTORY_ENTRY_LEN])) {
-					hex_failed = True;
+				if (!pdb_gethexpwd(&history_string[i*64],
+					&pwhist[i*PW_HISTORY_ENTRY_LEN])) {
+					hex_failed = true;
 					break;
 				}
 				/* Get the 16 byte MD5 hash of salt+passwd. */
 				if (!pdb_gethexpwd(&history_string[(i*64)+32],
-						&pwhist[(i*PW_HISTORY_ENTRY_LEN)+PW_HISTORY_SALT_LEN])) {
+					&pwhist[(i*PW_HISTORY_ENTRY_LEN)+
+						PW_HISTORY_SALT_LEN])) {
 					hex_failed = True;
 					break;
 				}
@@ -829,58 +951,75 @@ static bool init_sam_from_ldap(struct ldapsam_privates *ldap_state,
 			}
 		}
 		if (!pdb_set_pw_history(sampass, pwhist, pwHistLen, PDB_SET)){
-			SAFE_FREE(pwhist);
-			return False;
+			goto fn_exit;
 		}
-		SAFE_FREE(pwhist);
 	}
 
-	if (!smbldap_get_single_pstring (ldap_state->smbldap_state->ldap_struct, entry,
-			get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_ACB_INFO), temp)) {
-		acct_ctrl |= ACB_NORMAL;
-	} else {
+	temp = smbldap_talloc_single_attribute(
+			ldap_state->smbldap_state->ldap_struct,
+			entry,
+			get_userattr_key2string(ldap_state->schema_ver,
+				LDAP_ATTR_ACB_INFO),
+			ctx);
+	if (temp) {
 		acct_ctrl = pdb_decode_acct_ctrl(temp);
 
-		if (acct_ctrl == 0)
+		if (acct_ctrl == 0) {
 			acct_ctrl |= ACB_NORMAL;
+		}
 
 		pdb_set_acct_ctrl(sampass, acct_ctrl, PDB_SET);
+	} else {
+		acct_ctrl |= ACB_NORMAL;
 	}
 
 	pdb_set_hours_len(sampass, hours_len, PDB_SET);
 	pdb_set_logon_divs(sampass, logon_divs, PDB_SET);
 
-	if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
-			get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_BAD_PASSWORD_COUNT), temp)) {
-			/* leave as default */
-	} else {
+	temp = smbldap_talloc_single_attribute(
+			ldap_state->smbldap_state->ldap_struct,
+			entry,
+			get_userattr_key2string(ldap_state->schema_ver,
+				LDAP_ATTR_BAD_PASSWORD_COUNT),
+			ctx);
+	if (temp) {
 		bad_password_count = (uint32) atol(temp);
-		pdb_set_bad_password_count(sampass, bad_password_count, PDB_SET);
+		pdb_set_bad_password_count(sampass,
+				bad_password_count, PDB_SET);
 	}
 
-	if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry, 
-			get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_BAD_PASSWORD_TIME), temp)) {
-		/* leave as default */
-	} else {
+	temp = smbldap_talloc_single_attribute(
+			ldap_state->smbldap_state->ldap_struct,
+			entry,
+			get_userattr_key2string(ldap_state->schema_ver,
+				LDAP_ATTR_BAD_PASSWORD_TIME),
+			ctx);
+	if (temp) {
 		bad_password_time = (time_t) atol(temp);
 		pdb_set_bad_password_time(sampass, bad_password_time, PDB_SET);
 	}
 
 
-	if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
-			get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_COUNT), temp)) {
-			/* leave as default */
-	} else {
+	temp = smbldap_talloc_single_attribute(
+			ldap_state->smbldap_state->ldap_struct,
+			entry,
+			get_userattr_key2string(ldap_state->schema_ver,
+				LDAP_ATTR_LOGON_COUNT),
+			ctx);
+	if (temp) {
 		logon_count = (uint32) atol(temp);
 		pdb_set_logon_count(sampass, logon_count, PDB_SET);
 	}
 
 	/* pdb_set_unknown_6(sampass, unknown6, PDB_SET); */
 
-	if(!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
-		get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_HOURS), temp)) {
-			/* leave as default */
-	} else {
+	temp = smbldap_talloc_single_attribute(
+			ldap_state->smbldap_state->ldap_struct,
+			entry,
+			get_userattr_key2string(ldap_state->schema_ver,
+				LDAP_ATTR_LOGON_HOURS),
+			ctx);
+	if (temp) {
 		pdb_gethexhours(temp, hours);
 		memset((char *)temp, '\0', strlen(temp) +1);
 		pdb_set_hours(sampass, hours, PDB_SET);
@@ -888,8 +1027,12 @@ static bool init_sam_from_ldap(struct ldapsam_privates *ldap_state,
 	}
 
 	if (lp_parm_bool(-1, "ldapsam", "trusted", False)) {
-		if (smbldap_get_single_pstring(priv2ld(ldap_state), entry,
-					       "uidNumber", temp)) {
+		temp = smbldap_talloc_single_attribute(
+				priv2ld(ldap_state),
+				entry,
+				"uidNumber",
+				ctx);
+		if (temp) {
 			/* We've got a uid, feed the cache */
 			uid_t uid = strtoul(temp, NULL, 10);
 			store_uid_sid_cache(pdb_get_user_sid(sampass), uid);
@@ -897,43 +1040,52 @@ static bool init_sam_from_ldap(struct ldapsam_privates *ldap_state,
 	}
 
 	/* check the timestamp of the cache vs ldap entry */
-	if (!(ldap_entry_time = ldapsam_get_entry_timestamp(ldap_state, 
-							    entry)))
-		return True;
+	if (!(ldap_entry_time = ldapsam_get_entry_timestamp(ldap_state,
+							    entry))) {
+		ret = true;
+		goto fn_exit;
+	}
 
 	/* see if we have newer updates */
 	if (!(cache_entry = login_cache_read(sampass))) {
 		DEBUG (9, ("No cache entry, bad count = %u, bad time = %u\n",
 			   (unsigned int)pdb_get_bad_password_count(sampass),
 			   (unsigned int)pdb_get_bad_password_time(sampass)));
-		return True;
+		ret = true;
+		goto fn_exit;
 	}
 
-	DEBUG(7, ("ldap time is %u, cache time is %u, bad time = %u\n", 
-		  (unsigned int)ldap_entry_time, (unsigned int)cache_entry->entry_timestamp, 
+	DEBUG(7, ("ldap time is %u, cache time is %u, bad time = %u\n",
+		  (unsigned int)ldap_entry_time,
+		  (unsigned int)cache_entry->entry_timestamp,
 		  (unsigned int)cache_entry->bad_password_time));
 
 	if (ldap_entry_time > cache_entry->entry_timestamp) {
 		/* cache is older than directory , so
-		   we need to delete the entry but allow the 
+		   we need to delete the entry but allow the
 		   fields to be written out */
 		login_cache_delentry(sampass);
 	} else {
 		/* read cache in */
-		pdb_set_acct_ctrl(sampass, 
-				  pdb_get_acct_ctrl(sampass) | 
+		pdb_set_acct_ctrl(sampass,
+				  pdb_get_acct_ctrl(sampass) |
 				  (cache_entry->acct_ctrl & ACB_AUTOLOCK),
 				  PDB_SET);
-		pdb_set_bad_password_count(sampass, 
-					   cache_entry->bad_password_count, 
+		pdb_set_bad_password_count(sampass,
+					   cache_entry->bad_password_count,
 					   PDB_SET);
-		pdb_set_bad_password_time(sampass, 
-					  cache_entry->bad_password_time, 
+		pdb_set_bad_password_time(sampass,
+					  cache_entry->bad_password_time,
 					  PDB_SET);
 	}
 
+	ret = true;
+
+  fn_exit:
+
+	TALLOC_FREE(ctx);
 	SAFE_FREE(cache_entry);
-	return True;
+	return ret;
 }
 
 /**********************************************************************
@@ -941,13 +1093,13 @@ static bool init_sam_from_ldap(struct ldapsam_privates *ldap_state,
  (Based on init_buffer_from_sam in pdb_tdb.c)
 *********************************************************************/
 
-static bool init_ldap_from_sam (struct ldapsam_privates *ldap_state, 
+static bool init_ldap_from_sam (struct ldapsam_privates *ldap_state,
 				LDAPMessage *existing,
 				LDAPMod *** mods, struct samu * sampass,
 				bool (*need_update)(const struct samu *,
 						    enum pdb_elements))
 {
-	pstring temp;
+	char *temp = NULL;
 	uint32 rid;
 
 	if (mods == NULL || sampass == NULL) {
@@ -957,7 +1109,7 @@ static bool init_ldap_from_sam (struct ldapsam_privates *ldap_state,
 
 	*mods = NULL;
 
-	/* 
+	/*
 	 * took out adding "objectclass: sambaAccount"
 	 * do this on a per-mod basis
 	 */
@@ -978,31 +1130,34 @@ static bool init_ldap_from_sam (struct ldapsam_privates *ldap_state,
 	if (need_update(sampass, PDB_USERSID)) {
 		fstring sid_string;
 		const DOM_SID *user_sid = pdb_get_user_sid(sampass);
-		
+
 		switch ( ldap_state->schema_ver ) {
 			case SCHEMAVER_SAMBAACCOUNT:
 				if (!sid_peek_check_rid(&ldap_state->domain_sid, user_sid, &rid)) {
 					DEBUG(1, ("init_ldap_from_sam: User's SID (%s) is not for this domain (%s), cannot add to LDAP!\n", 
-						  sid_string_static(user_sid), 
+						  sid_string_static(user_sid),
 						  sid_string_static(&ldap_state->domain_sid)));
 					return False;
 				}
-				slprintf(temp, sizeof(temp) - 1, "%i", rid);
+				if (asprintf(&temp, "%i", rid) < 0) {
+					return false;
+				}
 				smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
 					get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_RID), 
 					temp);
+				SAFE_FREE(temp);
 				break;
-				
+
 			case SCHEMAVER_SAMBASAMACCOUNT:
 				smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
 					get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID), 
-					sid_to_string(sid_string, user_sid));				      
+					sid_to_string(sid_string, user_sid));
 				break;
-				
+
 			default:
 				DEBUG(0,("init_ldap_from_sam: unknown schema version specified\n"));
 				break;
-		}		
+		}
 	}
 
 	/* we don't need to store the primary group RID - so leaving it
@@ -1011,7 +1166,7 @@ static bool init_ldap_from_sam (struct ldapsam_privates *ldap_state,
 	if (need_update(sampass, PDB_GROUPSID)) {
 		fstring sid_string;
 		const DOM_SID *group_sid = pdb_get_group_sid(sampass);
-		
+
 		switch ( ldap_state->schema_ver ) {
 			case SCHEMAVER_SAMBAACCOUNT:
 				if (!sid_peek_check_rid(&ldap_state->domain_sid, group_sid, &rid)) {
@@ -1021,28 +1176,31 @@ static bool init_ldap_from_sam (struct ldapsam_privates *ldap_state,
 					return False;
 				}
 
-				slprintf(temp, sizeof(temp) - 1, "%i", rid);
+				if (asprintf(&temp, "%i", rid) < 0) {
+					return false;
+				}
 				smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
 					get_userattr_key2string(ldap_state->schema_ver, 
 					LDAP_ATTR_PRIMARY_GROUP_RID), temp);
+				SAFE_FREE(temp);
 				break;
-				
+
 			case SCHEMAVER_SAMBASAMACCOUNT:
 				smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
 					get_userattr_key2string(ldap_state->schema_ver, 
 					LDAP_ATTR_PRIMARY_GROUP_SID), sid_to_string(sid_string, group_sid));
 				break;
-				
+
 			default:
 				DEBUG(0,("init_ldap_from_sam: unknown schema version specified\n"));
 				break;
 		}
-		
+
 	}
-	
+
 	/* displayName, cn, and gecos should all be the same
 	 *  most easily accomplished by giving them the same OID
-	 *  gecos isn't set here b/c it should be handled by the 
+	 *  gecos isn't set here b/c it should be handled by the
 	 *  add-user script
 	 *  We change displayName only and fall back to cn if
 	 *  it does not exist.
@@ -1062,17 +1220,17 @@ static bool init_ldap_from_sam (struct ldapsam_privates *ldap_state,
 		smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
 			get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_WKS), 
 			pdb_get_workstations(sampass));
-	
+
 	if (need_update(sampass, PDB_MUNGEDDIAL))
 		smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
 			get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_MUNGED_DIAL), 
 			pdb_get_munged_dial(sampass));
-	
+
 	if (need_update(sampass, PDB_SMBHOME))
 		smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
 			get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_HOME_PATH), 
 			pdb_get_homedir(sampass));
-			
+
 	if (need_update(sampass, PDB_DRIVE))
 		smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
 			get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_HOME_DRIVE), 
@@ -1088,43 +1246,58 @@ static bool init_ldap_from_sam (struct ldapsam_privates *ldap_state,
 			get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PROFILE_PATH), 
 			pdb_get_profile_path(sampass));
 
-	slprintf(temp, sizeof(temp) - 1, "%li", pdb_get_logon_time(sampass));
+	if (asprintf(&temp, "%li", pdb_get_logon_time(sampass)) < 0) {
+		return false;
+	}
 	if (need_update(sampass, PDB_LOGONTIME))
 		smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
 			get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_TIME), temp);
+	SAFE_FREE(temp);
 
-	slprintf(temp, sizeof(temp) - 1, "%li", pdb_get_logoff_time(sampass));
+	if (asprintf(&temp, "%li", pdb_get_logoff_time(sampass)) < 0) {
+		return false;
+	}
 	if (need_update(sampass, PDB_LOGOFFTIME))
 		smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
 			get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGOFF_TIME), temp);
+	SAFE_FREE(temp);
 
-	slprintf (temp, sizeof (temp) - 1, "%li", pdb_get_kickoff_time(sampass));
+	if (asprintf(&temp, "%li", pdb_get_kickoff_time(sampass)) < 0) {
+		return false;
+	}
 	if (need_update(sampass, PDB_KICKOFFTIME))
 		smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
 			get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_KICKOFF_TIME), temp);
+	SAFE_FREE(temp);
 
-	slprintf (temp, sizeof (temp) - 1, "%li", pdb_get_pass_can_change_time_noncalc(sampass));
+	if (asprintf(&temp, "%li", pdb_get_pass_can_change_time_noncalc(sampass)) < 0) {
+		return false;
+	}
 	if (need_update(sampass, PDB_CANCHANGETIME))
 		smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
 			get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_CAN_CHANGE), temp);
+	SAFE_FREE(temp);
 
-	slprintf (temp, sizeof (temp) - 1, "%li", pdb_get_pass_must_change_time(sampass));
+	if (asprintf(&temp, "%li", pdb_get_pass_must_change_time(sampass)) < 0) {
+		return false;
+	}
 	if (need_update(sampass, PDB_MUSTCHANGETIME))
 		smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
 			get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_MUST_CHANGE), temp);
-
+	SAFE_FREE(temp);
 
 	if ((pdb_get_acct_ctrl(sampass)&(ACB_WSTRUST|ACB_SVRTRUST|ACB_DOMTRUST))
 			|| (lp_ldap_passwd_sync()!=LDAP_PASSWD_SYNC_ONLY)) {
 
 		if (need_update(sampass, PDB_LMPASSWD)) {
-			const uchar *lm_pw =  pdb_get_lanman_passwd(sampass);
+			const uchar *lm_pw = pdb_get_lanman_passwd(sampass);
 			if (lm_pw) {
-				pdb_sethexpwd(temp, lm_pw,
+				char pwstr[34];
+				pdb_sethexpwd(pwstr, lm_pw,
 					      pdb_get_acct_ctrl(sampass));
 				smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
 						 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LMPW), 
-						 temp);
+						 pwstr);
 			} else {
 				smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
 						 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LMPW), 
@@ -1132,13 +1305,14 @@ static bool init_ldap_from_sam (struct ldapsam_privates *ldap_state,
 			}
 		}
 		if (need_update(sampass, PDB_NTPASSWD)) {
-			const uchar *nt_pw =  pdb_get_nt_passwd(sampass);
+			const uchar *nt_pw = pdb_get_nt_passwd(sampass);
 			if (nt_pw) {
-				pdb_sethexpwd(temp, nt_pw,
+				char pwstr[34];
+				pdb_sethexpwd(pwstr, nt_pw,
 					      pdb_get_acct_ctrl(sampass));
 				smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
 						 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_NTPW), 
-						 temp);
+						 pwstr);
 			} else {
 				smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
 						 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_NTPW), 
@@ -1147,52 +1321,64 @@ static bool init_ldap_from_sam (struct ldapsam_privates *ldap_state,
 		}
 
 		if (need_update(sampass, PDB_PWHISTORY)) {
+			char *pwstr = NULL;
 			uint32 pwHistLen = 0;
 			pdb_get_account_policy(AP_PASSWORD_HISTORY, &pwHistLen);
+
+			pwstr = SMB_MALLOC_ARRAY(char, 1024);
+			if (!pwstr) {
+				return false;
+			}
 			if (pwHistLen == 0) {
 				/* Remove any password history from the LDAP store. */
-				memset(temp, '0', 64); /* NOTE !!!! '0' *NOT '\0' */
-				temp[64] = '\0';
+				memset(pwstr, '0', 64); /* NOTE !!!! '0' *NOT '\0' */
+				pwstr[64] = '\0';
 			} else {
-				int i; 
+				int i;
 				uint32 currHistLen = 0;
 				const uint8 *pwhist = pdb_get_pw_history(sampass, &currHistLen);
 				if (pwhist != NULL) {
-					/* We can only store (sizeof(pstring)-1)/64 password history entries. */
-					pwHistLen = MIN(pwHistLen, ((sizeof(temp)-1)/64));
+					/* We can only store (1024-1/64 password history entries. */
+					pwHistLen = MIN(pwHistLen, ((1024-1)/64));
 					for (i=0; i< pwHistLen && i < currHistLen; i++) {
 						/* Store the salt. */
-						pdb_sethexpwd(&temp[i*64], &pwhist[i*PW_HISTORY_ENTRY_LEN], 0);
+						pdb_sethexpwd(&pwstr[i*64], &pwhist[i*PW_HISTORY_ENTRY_LEN], 0);
 						/* Followed by the md5 hash of salt + md4 hash */
-						pdb_sethexpwd(&temp[(i*64)+32],
+						pdb_sethexpwd(&pwstr[(i*64)+32],
 							&pwhist[(i*PW_HISTORY_ENTRY_LEN)+PW_HISTORY_SALT_LEN], 0);
-						DEBUG(100, ("temp=%s\n", temp));
+						DEBUG(100, ("pwstr=%s\n", pwstr));
 					}
-				} 
+				}
 			}
 			smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
 					 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_HISTORY), 
-					 temp);
+					 pwstr);
+			SAFE_FREE(pwstr);
 		}
 
 		if (need_update(sampass, PDB_PASSLASTSET)) {
-			slprintf (temp, sizeof (temp) - 1, "%li", pdb_get_pass_last_set_time(sampass));
+			if (asprintf(&temp, "%li",
+				pdb_get_pass_last_set_time(sampass)) < 0) {
+				return false;
+			}
 			smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
 				get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_LAST_SET), 
 				temp);
+			SAFE_FREE(temp);
 		}
 	}
 
 	if (need_update(sampass, PDB_HOURS)) {
 		const uint8 *hours = pdb_get_hours(sampass);
 		if (hours) {
-			pdb_sethexhours(temp, hours);
+			char hourstr[44];
+			pdb_sethexhours(hourstr, hours);
 			smbldap_make_mod(ldap_state->smbldap_state->ldap_struct,
 				existing,
 				mods,
 				get_userattr_key2string(ldap_state->schema_ver,
 						LDAP_ATTR_LOGON_HOURS),
-				temp);
+				hourstr);
 		}
 	}
 
@@ -1201,7 +1387,7 @@ static bool init_ldap_from_sam (struct ldapsam_privates *ldap_state,
 			get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_ACB_INFO), 
 			pdb_encode_acct_ctrl (pdb_get_acct_ctrl(sampass), NEW_PW_FORMAT_SPACE_PADDED_LEN));
 
-	/* password lockout cache: 
+	/* password lockout cache:
 	   - If we are now autolocking or clearing, we write to ldap
 	   - If we are clearing, we delete the cache entry
 	   - If the count is > 0, we update the cache
@@ -1222,23 +1408,29 @@ static bool init_ldap_from_sam (struct ldapsam_privates *ldap_state,
 		if ((badcount >= pol) || (badcount == 0)) {
 			DEBUG(7, ("making mods to update ldap, count=%u, time=%u\n",
 				(unsigned int)badcount, (unsigned int)badtime));
-			slprintf (temp, sizeof (temp) - 1, "%li", (long)badcount);
+			if (asprintf(&temp, "%li", (long)badcount) < 0) {
+				return false;
+			}
 			smbldap_make_mod(
 				ldap_state->smbldap_state->ldap_struct,
-				existing, mods, 
+				existing, mods,
 				get_userattr_key2string(
-					ldap_state->schema_ver, 
+					ldap_state->schema_ver,
 					LDAP_ATTR_BAD_PASSWORD_COUNT),
 				temp);
+			SAFE_FREE(temp);
 
-			slprintf (temp, sizeof (temp) - 1, "%li", badtime);
+			if (asprintf(&temp, "%li", badtime) < 0) {
+				return false;
+			}
 			smbldap_make_mod(
-				ldap_state->smbldap_state->ldap_struct, 
+				ldap_state->smbldap_state->ldap_struct,
 				existing, mods,
 				get_userattr_key2string(
-					ldap_state->schema_ver, 
-					LDAP_ATTR_BAD_PASSWORD_TIME), 
+					ldap_state->schema_ver,
+					LDAP_ATTR_BAD_PASSWORD_TIME),
 				temp);
+			SAFE_FREE(temp);
 		}
 		if (badcount == 0) {
 			DEBUG(7, ("bad password count is reset, deleting login cache entry for %s\n", pdb_get_nt_username(sampass)));
@@ -1267,23 +1459,38 @@ static NTSTATUS ldapsam_setsampwent(struct pdb_methods *my_methods, bool update,
 {
 	struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
 	int rc;
-	pstring filter, suffix;
+	char *filter = NULL;
+	const char *suffix;
 	const char **attr_list;
 	bool machine_mask = False, user_mask = False;
+	NTSTATUS status = NT_STATUS_OK;
+	TALLOC_CTX *ctx = talloc_init("ldapsam_setsampwent");
 
-	pstr_sprintf( filter, "(&%s%s)", "(uid=%u)", 
+	if (!ctx) {
+		return NT_STATUS_NO_MEMORY;
+	}
+	filter = talloc_asprintf(ctx, "(&%s%s)", "(uid=%u)",
 		get_objclass_filter(ldap_state->schema_ver));
-	all_string_sub(filter, "%u", "*", sizeof(pstring));
+	if (!filter) {
+		status = NT_STATUS_NO_MEMORY;
+		goto out;
+	}
+
+	filter = talloc_all_string_sub(ctx, filter, "%u", "*");
+	if (!filter) {
+		status = NT_STATUS_NO_MEMORY;
+		goto out;
+	}
 
 	machine_mask 	= ((acb_mask != 0) && (acb_mask & (ACB_WSTRUST|ACB_SVRTRUST|ACB_DOMTRUST)));
 	user_mask 	= ((acb_mask != 0) && (acb_mask & ACB_NORMAL));
 
 	if (machine_mask) {
-		pstrcpy(suffix, lp_ldap_machine_suffix());
+		suffix = lp_ldap_machine_suffix();
 	} else if (user_mask) {
-		pstrcpy(suffix, lp_ldap_user_suffix());
+		suffix = lp_ldap_user_suffix();
 	} else {
-		pstrcpy(suffix, lp_ldap_suffix());
+		suffix = lp_ldap_suffix();
 	}
 
 	DEBUG(10,("ldapsam_setsampwent: LDAP Query for acb_mask 0x%x will use suffix %s\n", 
@@ -1299,18 +1506,22 @@ static NTSTATUS ldapsam_setsampwent(struct pdb_methods *my_methods, bool update,
 		DEBUG(3, ("ldapsam_setsampwent: Query was: %s, %s\n", suffix, filter));
 		ldap_msgfree(ldap_state->result);
 		ldap_state->result = NULL;
-		return NT_STATUS_UNSUCCESSFUL;
+		status = NT_STATUS_UNSUCCESSFUL;
+		goto out;
 	}
 
 	DEBUG(2, ("ldapsam_setsampwent: %d entries in the base %s\n",
-		ldap_count_entries(ldap_state->smbldap_state->ldap_struct, 
+		ldap_count_entries(ldap_state->smbldap_state->ldap_struct,
 		ldap_state->result), suffix));
 
 	ldap_state->entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct,
 				 ldap_state->result);
 	ldap_state->index = 0;
 
-	return NT_STATUS_OK;
+  out:
+
+	TALLOC_FREE(ctx);
+	return status;
 }
 
 /**********************************************************************
@@ -1834,12 +2045,12 @@ static NTSTATUS ldapsam_update_sam_account(struct pdb_methods *my_methods, struc
 ***************************************************************************/
 
 static NTSTATUS ldapsam_rename_sam_account(struct pdb_methods *my_methods,
-					   struct samu *old_acct, 
+					   struct samu *old_acct,
 					   const char *newname)
 {
 	const char *oldname;
 	int rc;
-	pstring rename_script;
+	char *rename_script = NULL;
 	fstring oldname_lower, newname_lower;
 
 	if (!old_acct) {
@@ -1850,16 +2061,21 @@ static NTSTATUS ldapsam_rename_sam_account(struct pdb_methods *my_methods,
 		DEBUG(0, ("ldapsam_rename_sam_account: newname was NULL!\n"));
 		return NT_STATUS_INVALID_PARAMETER;
 	}
-		
+
 	oldname = pdb_get_username(old_acct);
 
-        /* rename the posix user */
-        pstrcpy(rename_script, lp_renameuser_script());
+	/* rename the posix user */
+	rename_script = SMB_STRDUP(lp_renameuser_script());
+	if (rename_script) {
+		return NT_STATUS_NO_MEMORY;
+	}
 
-	if (!(*rename_script))
+	if (!(*rename_script)) {
+		SAFE_FREE(rename_script);
 		return NT_STATUS_ACCESS_DENIED;
+	}
 
-	DEBUG (3, ("ldapsam_rename_sam_account: Renaming user %s to %s.\n", 
+	DEBUG (3, ("ldapsam_rename_sam_account: Renaming user %s to %s.\n",
 		   oldname, newname));
 
 	/* We have to allow the account name to end with a '$'.
@@ -1870,15 +2086,26 @@ static NTSTATUS ldapsam_rename_sam_account(struct pdb_methods *my_methods,
 	strlower_m( oldname_lower );
 	fstrcpy( newname_lower, newname );
 	strlower_m( newname_lower );
-	string_sub2(rename_script, "%unew", newname_lower, sizeof(pstring), 
-		    True, False, True);
-	string_sub2(rename_script, "%uold", oldname_lower, sizeof(pstring), 
-		    True, False, True);
+	rename_script = realloc_string_sub2(rename_script,
+					"%unew",
+					newname_lower,
+					true,
+					true);
+	if (rename_script) {
+		return NT_STATUS_NO_MEMORY;
+	}
+	rename_script = realloc_string_sub2(rename_script,
+					"%uold",
+					oldname_lower,
+					true,
+					true);
 	rc = smbrun(rename_script, NULL);
 
-	DEBUG(rc ? 0 : 3,("Running the command `%s' gave %d\n", 
+	DEBUG(rc ? 0 : 3,("Running the command `%s' gave %d\n",
 			  rename_script, rc));
 
+	SAFE_FREE(rename_script);
+
 	if (rc == 0) {
 		smb_nscd_flush_user_cache();
 	}
@@ -1912,148 +2139,161 @@ static NTSTATUS ldapsam_add_sam_account(struct pdb_methods *my_methods, struct s
 	int rc;
 	LDAPMessage 	*result = NULL;
 	LDAPMessage 	*entry  = NULL;
-	pstring 	dn;
 	LDAPMod 	**mods = NULL;
 	int		ldap_op = LDAP_MOD_REPLACE;
 	uint32		num_result;
 	const char	**attr_list;
-	char 		*escape_user;
+	char *escape_user = NULL;
 	const char 	*username = pdb_get_username(newpwd);
 	const DOM_SID 	*sid = pdb_get_user_sid(newpwd);
-	pstring		filter;
+	char *filter = NULL;
+	char *dn = NULL;
 	fstring         sid_string;
+	NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
+	TALLOC_CTX *ctx = talloc_init("ldapsam_add_sam_account");
+
+	if (!ctx) {
+		return NT_STATUS_NO_MEMORY;
+	}
 
 	if (!username || !*username) {
 		DEBUG(0, ("ldapsam_add_sam_account: Cannot add user without a username!\n"));
-		return NT_STATUS_INVALID_PARAMETER;
+		status = NT_STATUS_INVALID_PARAMETER;
+		goto fn_exit;
 	}
 
 	/* free this list after the second search or in case we exit on failure */
-	attr_list = get_userattr_list(NULL, ldap_state->schema_ver);
+	attr_list = get_userattr_list(ctx, ldap_state->schema_ver);
 
 	rc = ldapsam_search_suffix_by_name (ldap_state, username, &result, attr_list);
 
 	if (rc != LDAP_SUCCESS) {
-		TALLOC_FREE( attr_list );
-		return NT_STATUS_UNSUCCESSFUL;
+		goto fn_exit;
 	}
 
 	if (ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result) != 0) {
 		DEBUG(0,("ldapsam_add_sam_account: User '%s' already in the base, with samba attributes\n", 
 			 username));
-		ldap_msgfree(result);
-		TALLOC_FREE( attr_list );
-		return NT_STATUS_UNSUCCESSFUL;
+		goto fn_exit;
 	}
 	ldap_msgfree(result);
 	result = NULL;
 
 	if (element_is_set_or_changed(newpwd, PDB_USERSID)) {
-		rc = ldapsam_get_ldap_user_by_sid(ldap_state, 
-						  sid, &result); 
+		rc = ldapsam_get_ldap_user_by_sid(ldap_state,
+						  sid, &result);
 		if (rc == LDAP_SUCCESS) {
 			if (ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result) != 0) {
 				DEBUG(0,("ldapsam_add_sam_account: SID '%s' already in the base, with samba attributes\n", 
 					 sid_to_string(sid_string, sid)));
-				TALLOC_FREE( attr_list );
-				ldap_msgfree(result);
-				return NT_STATUS_UNSUCCESSFUL;
+				goto fn_exit;
 			}
 			ldap_msgfree(result);
+			result = NULL;
 		}
 	}
 
 	/* does the entry already exist but without a samba attributes?
 	   we need to return the samba attributes here */
-	   
+
 	escape_user = escape_ldap_string_alloc( username );
-	pstrcpy( filter, "(uid=%u)" );
-	all_string_sub( filter, "%u", escape_user, sizeof(filter) );
-	SAFE_FREE( escape_user );
+	filter = talloc_strdup(attr_list, "(uid=%u)");
+	if (!filter) {
+		status = NT_STATUS_NO_MEMORY;
+		goto fn_exit;
+	}
+	filter = talloc_all_string_sub(attr_list, filter, "%u", escape_user);
+	if (!filter) {
+		status = NT_STATUS_NO_MEMORY;
+		goto fn_exit;
+	}
+	SAFE_FREE(escape_user);
 
-	rc = smbldap_search_suffix(ldap_state->smbldap_state, 
+	rc = smbldap_search_suffix(ldap_state->smbldap_state,
 				   filter, attr_list, &result);
 	if ( rc != LDAP_SUCCESS ) {
-		TALLOC_FREE( attr_list );
-		return NT_STATUS_UNSUCCESSFUL;
+		goto fn_exit;
 	}
 
 	num_result = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result);
-	
+
 	if (num_result > 1) {
 		DEBUG (0, ("ldapsam_add_sam_account: More than one user with that uid exists: bailing out!\n"));
-		TALLOC_FREE( attr_list );
-		ldap_msgfree(result);
-		return NT_STATUS_UNSUCCESSFUL;
+		goto fn_exit;
 	}
-	
+
 	/* Check if we need to update an existing entry */
 	if (num_result == 1) {
 		char *tmp;
-		
+
 		DEBUG(3,("ldapsam_add_sam_account: User exists without samba attributes: adding them\n"));
 		ldap_op = LDAP_MOD_REPLACE;
 		entry = ldap_first_entry (ldap_state->smbldap_state->ldap_struct, result);
-		tmp = smbldap_get_dn (ldap_state->smbldap_state->ldap_struct, entry);
+		tmp = smbldap_get_dn(ldap_state->smbldap_state->ldap_struct, entry);
 		if (!tmp) {
-			TALLOC_FREE( attr_list );
-			ldap_msgfree(result);
-			return NT_STATUS_UNSUCCESSFUL;
+			goto fn_exit;
 		}
-		slprintf (dn, sizeof (dn) - 1, "%s", tmp);
+		dn = talloc_asprintf(ctx, "%s", tmp);
 		SAFE_FREE(tmp);
+		if (!dn) {
+			status = NT_STATUS_NO_MEMORY;
+			goto fn_exit;
+		}
 
 	} else if (ldap_state->schema_ver == SCHEMAVER_SAMBASAMACCOUNT) {
 
 		/* There might be a SID for this account already - say an idmap entry */
 
-		pstr_sprintf(filter, "(&(%s=%s)(|(objectClass=%s)(objectClass=%s)))", 
-			 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID),
-			 sid_to_string(sid_string, sid),
-			 LDAP_OBJ_IDMAP_ENTRY,
-			 LDAP_OBJ_SID_ENTRY);
-		
+		filter = talloc_asprintf(ctx,
+				"(&(%s=%s)(|(objectClass=%s)(objectClass=%s)))",
+				 get_userattr_key2string(ldap_state->schema_ver,
+					 LDAP_ATTR_USER_SID),
+				 sid_to_string(sid_string, sid),
+				 LDAP_OBJ_IDMAP_ENTRY,
+				 LDAP_OBJ_SID_ENTRY);
+		if (!filter) {
+			status = NT_STATUS_NO_MEMORY;
+			goto fn_exit;
+		}
+
 		/* free old result before doing a new search */
 		if (result != NULL) {
 			ldap_msgfree(result);
 			result = NULL;
 		}
-		rc = smbldap_search_suffix(ldap_state->smbldap_state, 
+		rc = smbldap_search_suffix(ldap_state->smbldap_state,
 					   filter, attr_list, &result);
-			
+
 		if ( rc != LDAP_SUCCESS ) {
-			TALLOC_FREE( attr_list );
-			return NT_STATUS_UNSUCCESSFUL;
+			goto fn_exit;
 		}
-		
+
 		num_result = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result);
-		
+
 		if (num_result > 1) {
 			DEBUG (0, ("ldapsam_add_sam_account: More than one user with specified Sid exists: bailing out!\n"));
-			TALLOC_FREE( attr_list );
-			ldap_msgfree(result);
-			return NT_STATUS_UNSUCCESSFUL;
+			goto fn_exit;
 		}
-		
+
 		/* Check if we need to update an existing entry */
 		if (num_result == 1) {
 			char *tmp;
-			
+
 			DEBUG(3,("ldapsam_add_sam_account: User exists without samba attributes: adding them\n"));
 			ldap_op = LDAP_MOD_REPLACE;
 			entry = ldap_first_entry (ldap_state->smbldap_state->ldap_struct, result);
 			tmp = smbldap_get_dn (ldap_state->smbldap_state->ldap_struct, entry);
 			if (!tmp) {
-				TALLOC_FREE( attr_list );
-				ldap_msgfree(result);
-				return NT_STATUS_UNSUCCESSFUL;
+				goto fn_exit;
 			}
-			slprintf (dn, sizeof (dn) - 1, "%s", tmp);
+			dn = talloc_asprintf(ctx, "%s", tmp);
 			SAFE_FREE(tmp);
+			if (!dn) {
+				status = NT_STATUS_NO_MEMORY;
+				goto fn_exit;
+			}
 		}
 	}
-	
-	TALLOC_FREE( attr_list );
 
 	if (num_result == 0) {
 		char *escape_username;
@@ -2063,34 +2303,41 @@ static NTSTATUS ldapsam_add_sam_account(struct pdb_methods *my_methods, struct s
 
 		escape_username = escape_rdn_val_string_alloc(username);
 		if (!escape_username) {
-			DEBUG(0, ("Out of memory!\n"));
-			ldap_msgfree(result);
-			return NT_STATUS_NO_MEMORY;
+			status = NT_STATUS_NO_MEMORY;
+			goto fn_exit;
 		}
 
 		if (username[strlen(username)-1] == '$') {
-			slprintf (dn, sizeof (dn) - 1, "uid=%s,%s", escape_username, lp_ldap_machine_suffix ());
+			dn = talloc_asprintf(ctx,
+					"uid=%s,%s",
+					escape_username,
+					lp_ldap_machine_suffix());
 		} else {
-			slprintf (dn, sizeof (dn) - 1, "uid=%s,%s", escape_username, lp_ldap_user_suffix ());
+			dn = talloc_asprintf(ctx,
+					"uid=%s,%s",
+					escape_username,
+					lp_ldap_user_suffix());
 		}
 
 		SAFE_FREE(escape_username);
+		if (!dn) {
+			status = NT_STATUS_NO_MEMORY;
+			goto fn_exit;
+		}
 	}
 
 	if (!init_ldap_from_sam(ldap_state, entry, &mods, newpwd,
 				element_is_set_or_changed)) {
 		DEBUG(0, ("ldapsam_add_sam_account: init_ldap_from_sam failed!\n"));
-		ldap_msgfree(result);
-		if (mods != NULL)
-			ldap_mods_free(mods,True);
-		return NT_STATUS_UNSUCCESSFUL;		
+		if (mods != NULL) {
+			ldap_mods_free(mods, true);
+		}
+		goto fn_exit;
 	}
-	
-	ldap_msgfree(result);
 
 	if (mods == NULL) {
 		DEBUG(0,("ldapsam_add_sam_account: mods is empty: nothing to add for user: %s\n",pdb_get_username(newpwd)));
-		return NT_STATUS_UNSUCCESSFUL;
+		goto fn_exit;
 	}
 	switch ( ldap_state->schema_ver ) {
 		case SCHEMAVER_SAMBAACCOUNT:
@@ -2108,14 +2355,23 @@ static NTSTATUS ldapsam_add_sam_account(struct pdb_methods *my_methods, struct s
 	if (!NT_STATUS_IS_OK(ret)) {
 		DEBUG(0,("ldapsam_add_sam_account: failed to modify/add user with uid = %s (dn = %s)\n",
 			 pdb_get_username(newpwd),dn));
-		ldap_mods_free(mods, True);
-		return ret;
+		ldap_mods_free(mods, true);
+		goto fn_exit;
 	}
 
 	DEBUG(2,("ldapsam_add_sam_account: added: uid == %s in the LDAP database\n", pdb_get_username(newpwd)));
-	ldap_mods_free(mods, True);
-	
-	return NT_STATUS_OK;
+	ldap_mods_free(mods, true);
+
+	status = NT_STATUS_OK;
+
+  fn_exit:
+
+	TALLOC_FREE(ctx);
+	SAFE_FREE(escape_user);
+	if (result) {
+		ldap_msgfree(result);
+	}
+	return status;
 }
 
 /**********************************************************************
@@ -2130,7 +2386,7 @@ static int ldapsam_search_one_group (struct ldapsam_privates *ldap_state,
 	const char **attr_list;
 
 	attr_list = get_attr_list(NULL, groupmap_attr_list);
-	rc = smbldap_search(ldap_state->smbldap_state, 
+	rc = smbldap_search(ldap_state->smbldap_state,
 			    lp_ldap_group_suffix (), scope,
 			    filter, attr_list, 0, result);
 	TALLOC_FREE(attr_list);
@@ -2144,74 +2400,119 @@ static int ldapsam_search_one_group (struct ldapsam_privates *ldap_state,
 static bool init_group_from_ldap(struct ldapsam_privates *ldap_state,
 				 GROUP_MAP *map, LDAPMessage *entry)
 {
-	pstring temp;
+	char *temp = NULL;
+	TALLOC_CTX *ctx = talloc_init("init_group_from_ldap");
 
 	if (ldap_state == NULL || map == NULL || entry == NULL ||
 			ldap_state->smbldap_state->ldap_struct == NULL) {
 		DEBUG(0, ("init_group_from_ldap: NULL parameters found!\n"));
-		return False;
+		TALLOC_FREE(ctx);
+		return false;
 	}
 
-	if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry, 
-			get_attr_key2string(groupmap_attr_list, LDAP_ATTR_GIDNUMBER), temp)) {
+	temp = smbldap_talloc_single_attribute(
+			ldap_state->smbldap_state->ldap_struct,
+			entry,
+			get_attr_key2string(groupmap_attr_list,
+				LDAP_ATTR_GIDNUMBER),
+			ctx);
+	if (!temp) {
 		DEBUG(0, ("init_group_from_ldap: Mandatory attribute %s not found\n", 
 			get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GIDNUMBER)));
-		return False;
+		TALLOC_FREE(ctx);
+		return false;
 	}
 	DEBUG(2, ("init_group_from_ldap: Entry found for group: %s\n", temp));
 
 	map->gid = (gid_t)atol(temp);
 
-	if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry, 
-			get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GROUP_SID), temp)) {
+	TALLOC_FREE(temp);
+	temp = smbldap_talloc_single_attribute(
+			ldap_state->smbldap_state->ldap_struct,
+			entry,
+			get_attr_key2string(groupmap_attr_list,
+				LDAP_ATTR_GROUP_SID),
+			ctx);
+	if (!temp) {
 		DEBUG(0, ("init_group_from_ldap: Mandatory attribute %s not found\n",
 			get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GROUP_SID)));
-		return False;
+		TALLOC_FREE(ctx);
+		return false;
 	}
-	
+
 	if (!string_to_sid(&map->sid, temp)) {
 		DEBUG(1, ("SID string [%s] could not be read as a valid SID\n", temp));
-		return False;
+		TALLOC_FREE(ctx);
+		return false;
 	}
 
-	if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry, 
-			get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GROUP_TYPE), temp)) {
+	TALLOC_FREE(temp);
+	temp = smbldap_talloc_single_attribute(
+			ldap_state->smbldap_state->ldap_struct,
+			entry,
+			get_attr_key2string(groupmap_attr_list,
+				LDAP_ATTR_GROUP_TYPE),
+			ctx);
+	if (!temp) {
 		DEBUG(0, ("init_group_from_ldap: Mandatory attribute %s not found\n",
 			get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GROUP_TYPE)));
-		return False;
+		TALLOC_FREE(ctx);
+		return false;
 	}
 	map->sid_name_use = (enum lsa_SidType)atol(temp);
 
 	if ((map->sid_name_use < SID_NAME_USER) ||
 			(map->sid_name_use > SID_NAME_UNKNOWN)) {
 		DEBUG(0, ("init_group_from_ldap: Unknown Group type: %d\n", map->sid_name_use));
-		return False;
+		TALLOC_FREE(ctx);
+		return false;
 	}
 
-	if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry, 
-			get_attr_key2string( groupmap_attr_list, LDAP_ATTR_DISPLAY_NAME), temp)) {
-		temp[0] = '\0';
-		if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry, 
-			get_attr_key2string( groupmap_attr_list, LDAP_ATTR_CN), temp)) 
-		{
+	TALLOC_FREE(temp);
+	temp = smbldap_talloc_single_attribute(
+			ldap_state->smbldap_state->ldap_struct,
+			entry,
+			get_attr_key2string(groupmap_attr_list,
+				LDAP_ATTR_DISPLAY_NAME),
+			ctx);
+	if (!temp) {
+		temp = smbldap_talloc_single_attribute(
+				ldap_state->smbldap_state->ldap_struct,
+				entry,
+				get_attr_key2string(groupmap_attr_list,
+					LDAP_ATTR_CN),
+				ctx);
+		if (!temp) {
 			DEBUG(0, ("init_group_from_ldap: Attributes cn not found either \
 for gidNumber(%lu)\n",(unsigned long)map->gid));
-			return False;
+			TALLOC_FREE(ctx);
+			return false;
 		}
 	}
 	fstrcpy(map->nt_name, temp);
 
-	if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry, 
-			get_attr_key2string( groupmap_attr_list, LDAP_ATTR_DESC), temp)) {
-		temp[0] = '\0';
+	TALLOC_FREE(temp);
+	temp = smbldap_talloc_single_attribute(
+			ldap_state->smbldap_state->ldap_struct,
+			entry,
+			get_attr_key2string(groupmap_attr_list,
+				LDAP_ATTR_DESC),
+			ctx);
+	if (!temp) {
+		temp = talloc_strdup(ctx, "");
+		if (!temp) {
+			TALLOC_FREE(ctx);
+			return false;
+		}
 	}
 	fstrcpy(map->comment, temp);
 
-	if (lp_parm_bool(-1, "ldapsam", "trusted", False)) {
+	if (lp_parm_bool(-1, "ldapsam", "trusted", false)) {
 		store_gid_sid_cache(&map->sid, map->gid);
 	}
 
-	return True;
+	TALLOC_FREE(ctx);
+	return true;
 }
 
 /**********************************************************************
@@ -2271,14 +2572,19 @@ static NTSTATUS ldapsam_getgroup(struct pdb_methods *methods,
 static NTSTATUS ldapsam_getgrsid(struct pdb_methods *methods, GROUP_MAP *map,
 				 DOM_SID sid)
 {
-	pstring filter;
+	char *filter = NULL;
+	NTSTATUS status;
 
-	pstr_sprintf(filter, "(&(objectClass=%s)(%s=%s))",
-		LDAP_OBJ_GROUPMAP, 
+	if (asprintf(&filter, "(&(objectClass=%s)(%s=%s))",
+		LDAP_OBJ_GROUPMAP,
 		get_attr_key2string(groupmap_attr_list, LDAP_ATTR_GROUP_SID),
-		sid_string_static(&sid));
+		sid_string_static(&sid)) < 0) {
+		return NT_STATUS_NO_MEMORY;
+	}
 
-	return ldapsam_getgroup(methods, filter, map);
+	status = ldapsam_getgroup(methods, filter, map);
+	SAFE_FREE(filter);
+	return status;
 }
 
 /**********************************************************************
@@ -2287,14 +2593,19 @@ static NTSTATUS ldapsam_getgrsid(struct pdb_methods *methods, GROUP_MAP *map,
 static NTSTATUS ldapsam_getgrgid(struct pdb_methods *methods, GROUP_MAP *map,
 				 gid_t gid)
 {
-	pstring filter;
+	char *filter = NULL;
+	NTSTATUS status;
 
-	pstr_sprintf(filter, "(&(objectClass=%s)(%s=%lu))",
+	if (asprintf(&filter, "(&(objectClass=%s)(%s=%lu))",
 		LDAP_OBJ_GROUPMAP,
 		get_attr_key2string(groupmap_attr_list, LDAP_ATTR_GIDNUMBER),
-		(unsigned long)gid);
+		(unsigned long)gid) < 0) {
+		return NT_STATUS_NO_MEMORY;
+	}
 
-	return ldapsam_getgroup(methods, filter, map);
+	status = ldapsam_getgroup(methods, filter, map);
+	SAFE_FREE(filter);
+	return status;
 }
 
 /**********************************************************************
@@ -2303,21 +2614,27 @@ static NTSTATUS ldapsam_getgrgid(struct pdb_methods *methods, GROUP_MAP *map,
 static NTSTATUS ldapsam_getgrnam(struct pdb_methods *methods, GROUP_MAP *map,
 				 const char *name)
 {
-	pstring filter;
+	char *filter = NULL;
 	char *escape_name = escape_ldap_string_alloc(name);
+	NTSTATUS status;
 
 	if (!escape_name) {
 		return NT_STATUS_NO_MEMORY;
 	}
 
-	pstr_sprintf(filter, "(&(objectClass=%s)(|(%s=%s)(%s=%s)))",
+	if (asprintf(&filter, "(&(objectClass=%s)(|(%s=%s)(%s=%s)))",
 		LDAP_OBJ_GROUPMAP,
 		get_attr_key2string(groupmap_attr_list, LDAP_ATTR_DISPLAY_NAME), escape_name,
-		get_attr_key2string(groupmap_attr_list, LDAP_ATTR_CN), escape_name);
+		get_attr_key2string(groupmap_attr_list, LDAP_ATTR_CN),
+		escape_name) < 0) {
+		SAFE_FREE(escape_name);
+		return NT_STATUS_NO_MEMORY;
+	}
 
 	SAFE_FREE(escape_name);
-
-	return ldapsam_getgroup(methods, filter, map);
+	status = ldapsam_getgroup(methods, filter, map);
+	SAFE_FREE(filter);
+	return status;
 }
 
 static bool ldapsam_extract_rid_from_entry(LDAP *ldap_struct,
@@ -3213,7 +3530,7 @@ static NTSTATUS ldapsam_modify_aliasmem(struct pdb_methods *methods,
 {
 	struct ldapsam_privates *ldap_state =
 		(struct ldapsam_privates *)methods->private_data;
-	char *dn;
+	char *dn = NULL;
 	LDAPMessage *result = NULL;
 	LDAPMessage *entry = NULL;
 	int count;
@@ -3221,7 +3538,7 @@ static NTSTATUS ldapsam_modify_aliasmem(struct pdb_methods *methods,
 	int rc;
 	enum lsa_SidType type = SID_NAME_USE_NONE;
 
-	pstring filter;
+	char *filter = NULL;
 
 	if (sid_check_is_in_builtin(alias)) {
 		type = SID_NAME_ALIAS;
@@ -3237,14 +3554,18 @@ static NTSTATUS ldapsam_modify_aliasmem(struct pdb_methods *methods,
 		return NT_STATUS_NO_SUCH_ALIAS;
 	}
 
-	pstr_sprintf(filter,
+	if (asprintf(&filter,
 		     "(&(objectClass=%s)(sambaSid=%s)(sambaGroupType=%d))",
 		     LDAP_OBJ_GROUPMAP, sid_string_static(alias),
-		     type);
+		     type) < 0) {
+		return NT_STATUS_NO_MEMORY;
+	}
 
 	if (ldapsam_search_one_group(ldap_state, filter,
-				     &result) != LDAP_SUCCESS)
+				     &result) != LDAP_SUCCESS) {
+		SAFE_FREE(filter);
 		return NT_STATUS_NO_SUCH_ALIAS;
+	}
 
 	count = ldap_count_entries(ldap_state->smbldap_state->ldap_struct,
 				   result);
@@ -3252,6 +3573,7 @@ static NTSTATUS ldapsam_modify_aliasmem(struct pdb_methods *methods,
 	if (count < 1) {
 		DEBUG(4, ("ldapsam_modify_aliasmem: Did not find alias\n"));
 		ldap_msgfree(result);
+		SAFE_FREE(filter);
 		return NT_STATUS_NO_SUCH_ALIAS;
 	}
 
@@ -3259,9 +3581,12 @@ static NTSTATUS ldapsam_modify_aliasmem(struct pdb_methods *methods,
 		DEBUG(1, ("ldapsam_modify_aliasmem: Duplicate entries for "
 			  "filter %s: count=%d\n", filter, count));
 		ldap_msgfree(result);
+		SAFE_FREE(filter);
 		return NT_STATUS_NO_SUCH_ALIAS;
 	}
 
+	SAFE_FREE(filter);
+
 	entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct,
 				 result);
 
@@ -3327,9 +3652,9 @@ static NTSTATUS ldapsam_enum_aliasmem(struct pdb_methods *methods,
 	LDAPMessage *result = NULL;
 	LDAPMessage *entry = NULL;
 	int count;
-	char **values;
+	char **values = NULL;
 	int i;
-	pstring filter;
+	char *filter = NULL;
 	size_t num_members = 0;
 	enum lsa_SidType type = SID_NAME_USE_NONE;
 
@@ -3350,14 +3675,18 @@ static NTSTATUS ldapsam_enum_aliasmem(struct pdb_methods *methods,
 		return NT_STATUS_NO_SUCH_ALIAS;
 	}
 
-	pstr_sprintf(filter,
+	if (asprintf(&filter,
 		     "(&(objectClass=%s)(sambaSid=%s)(sambaGroupType=%d))",
 		     LDAP_OBJ_GROUPMAP, sid_string_static(alias),
-		     type);
+		     type) < 0) {
+		return NT_STATUS_NO_MEMORY;
+	}
 
 	if (ldapsam_search_one_group(ldap_state, filter,
-				     &result) != LDAP_SUCCESS)
+				     &result) != LDAP_SUCCESS) {
+		SAFE_FREE(filter);
 		return NT_STATUS_NO_SUCH_ALIAS;
+	}
 
 	count = ldap_count_entries(ldap_state->smbldap_state->ldap_struct,
 				   result);
@@ -3365,6 +3694,7 @@ static NTSTATUS ldapsam_enum_aliasmem(struct pdb_methods *methods,
 	if (count < 1) {
 		DEBUG(4, ("ldapsam_enum_aliasmem: Did not find alias\n"));
 		ldap_msgfree(result);
+		SAFE_FREE(filter);
 		return NT_STATUS_NO_SUCH_ALIAS;
 	}
 
@@ -3372,9 +3702,12 @@ static NTSTATUS ldapsam_enum_aliasmem(struct pdb_methods *methods,
 		DEBUG(1, ("ldapsam_enum_aliasmem: Duplicate entries for "
 			  "filter %s: count=%d\n", filter, count));
 		ldap_msgfree(result);
+		SAFE_FREE(filter);
 		return NT_STATUS_NO_SUCH_ALIAS;
 	}
 
+	SAFE_FREE(filter);
+
 	entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct,
 				 result);
 
@@ -5916,21 +6249,22 @@ NTSTATUS pdb_init_ldapsam_compat(struct pdb_methods **pdb_method, const char *lo
 NTSTATUS pdb_init_ldapsam(struct pdb_methods **pdb_method, const char *location)
 {
 	NTSTATUS nt_status;
-	struct ldapsam_privates *ldap_state;
+	struct ldapsam_privates *ldap_state = NULL;
 	uint32 alg_rid_base;
-	pstring alg_rid_base_string;
+	char *alg_rid_base_string = NULL;
 	LDAPMessage *result = NULL;
 	LDAPMessage *entry = NULL;
 	DOM_SID ldap_domain_sid;
 	DOM_SID secrets_domain_sid;
-	pstring domain_sid_string;
-	char *dn;
+	char *domain_sid_string = NULL;
+	char *dn = NULL;
 	char *uri = talloc_strdup( NULL, location );
 
 	trim_char( uri, '\"', '\"' );
 	nt_status = pdb_init_ldapsam_common(pdb_method, uri);
-	if ( uri )
-		TALLOC_FREE( uri );
+	if (uri) {
+		TALLOC_FREE(uri);
+	}
 
 	if (!NT_STATUS_IS_OK(nt_status)) {
 		return nt_status;
@@ -5952,7 +6286,7 @@ NTSTATUS pdb_init_ldapsam(struct pdb_methods **pdb_method, const char *location)
 			ldapsam_enum_group_memberships;
 		(*pdb_method)->lookup_rids = ldapsam_lookup_rids;
 		(*pdb_method)->sid_to_id = ldapsam_sid_to_id;
-		
+
 		if (lp_parm_bool(-1, "ldapsam", "editposix", False)) {
 			(*pdb_method)->create_user = ldapsam_create_user;
 			(*pdb_method)->delete_user = ldapsam_delete_user;
@@ -5968,11 +6302,11 @@ NTSTATUS pdb_init_ldapsam(struct pdb_methods **pdb_method, const char *location)
 	ldap_state->schema_ver = SCHEMAVER_SAMBASAMACCOUNT;
 
 	/* Try to setup the Domain Name, Domain SID, algorithmic rid base */
-	
+
 	nt_status = smbldap_search_domain_info(ldap_state->smbldap_state,
-					       &result, 
+					       &result,
 					       ldap_state->domain_name, True);
-	
+
 	if ( !NT_STATUS_IS_OK(nt_status) ) {
 		DEBUG(2, ("pdb_init_ldapsam: WARNING: Could not get domain "
 			  "info, nor add one to the domain\n"));
@@ -5985,7 +6319,7 @@ NTSTATUS pdb_init_ldapsam(struct pdb_methods **pdb_method, const char *location)
 
 	/* Given that the above might fail, everything below this must be
 	 * optional */
-	
+
 	entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct,
 				 result);
 	if (!entry) {
@@ -6004,17 +6338,20 @@ NTSTATUS pdb_init_ldapsam(struct pdb_methods **pdb_method, const char *location)
 	ldap_state->domain_dn = smb_xstrdup(dn);
 	ldap_memfree(dn);
 
-	if (smbldap_get_single_pstring(
+	domain_sid_string = smbldap_talloc_single_attribute(
 		    ldap_state->smbldap_state->ldap_struct,
-		    entry, 
+		    entry,
 		    get_userattr_key2string(ldap_state->schema_ver,
-					    LDAP_ATTR_USER_SID), 
-		    domain_sid_string)) {
+					    LDAP_ATTR_USER_SID),
+		    NULL);
+
+	if (domain_sid_string) {
 		bool found_sid;
 		if (!string_to_sid(&ldap_domain_sid, domain_sid_string)) {
 			DEBUG(1, ("pdb_init_ldapsam: SID [%s] could not be "
 				  "read as a valid SID\n", domain_sid_string));
 			ldap_msgfree(result);
+			TALLOC_FREE(domain_sid_string);
 			return NT_STATUS_INVALID_PARAMETER;
 		}
 		found_sid = secrets_fetch_domain_sid(ldap_state->domain_name,
@@ -6029,7 +6366,7 @@ NTSTATUS pdb_init_ldapsam(struct pdb_methods **pdb_method, const char *location)
 						&secrets_domain_sid),
 				  sid_to_string(new_sid_str,
 						&ldap_domain_sid)));
-			
+
 			/* reset secrets.tdb sid */
 			secrets_store_domain_sid(ldap_state->domain_name,
 						 &ldap_domain_sid);
@@ -6038,22 +6375,26 @@ NTSTATUS pdb_init_ldapsam(struct pdb_methods **pdb_method, const char *location)
 						get_global_sam_sid())));
 		}
 		sid_copy(&ldap_state->domain_sid, &ldap_domain_sid);
+		TALLOC_FREE(domain_sid_string);
 	}
 
-	if (smbldap_get_single_pstring(
+	alg_rid_base_string = smbldap_talloc_single_attribute(
 		    ldap_state->smbldap_state->ldap_struct,
-		    entry, 
+		    entry,
 		    get_attr_key2string( dominfo_attr_list,
 					 LDAP_ATTR_ALGORITHMIC_RID_BASE ),
-		    alg_rid_base_string)) {
+		    NULL);
+	if (alg_rid_base_string) {
 		alg_rid_base = (uint32)atol(alg_rid_base_string);
 		if (alg_rid_base != algorithmic_rid_base()) {
 			DEBUG(0, ("The value of 'algorithmic RID base' has "
 				  "changed since the LDAP\n"
 				  "database was initialised.  Aborting. \n"));
 			ldap_msgfree(result);
+			TALLOC_FREE(alg_rid_base_string);
 			return NT_STATUS_UNSUCCESSFUL;
 		}
+		TALLOC_FREE(alg_rid_base_string);
 	}
 	ldap_msgfree(result);