r23030: finally fixed up our asn1 code to use better memory allocation. This

should allow us to fix some long standing memory leaks.
(This used to be commit 3db49c2ec9968221c1361785b94061046ecd159d)

3 files changed, 320 insertions, 332 deletions

diff --git a/source4/libcli/ldap/ldap.c b/source4/libcli/ldap/ldap.c
index 1e308d5847..70ba9335db 100644
--- a/source4/libcli/ldap/ldap.c
+++ b/source4/libcli/ldap/ldap.c
@@ -190,55 +190,54 @@ static void ldap_encode_response(struct asn1_data *data, struct ldap_Result *res
 
 BOOL ldap_encode(struct ldap_message *msg, DATA_BLOB *result, TALLOC_CTX *mem_ctx)
 {
-	struct asn1_data data;
+	struct asn1_data *data = asn1_init(mem_ctx);
 	int i, j;
 
-	ZERO_STRUCT(data);
-	asn1_push_tag(&data, ASN1_SEQUENCE(0));
-	asn1_write_Integer(&data, msg->messageid);
+	asn1_push_tag(data, ASN1_SEQUENCE(0));
+	asn1_write_Integer(data, msg->messageid);
 
 	switch (msg->type) {
 	case LDAP_TAG_BindRequest: {
 		struct ldap_BindRequest *r = &msg->r.BindRequest;
-		asn1_push_tag(&data, ASN1_APPLICATION(msg->type));
-		asn1_write_Integer(&data, r->version);
-		asn1_write_OctetString(&data, r->dn,
+		asn1_push_tag(data, ASN1_APPLICATION(msg->type));
+		asn1_write_Integer(data, r->version);
+		asn1_write_OctetString(data, r->dn,
 				       (r->dn != NULL) ? strlen(r->dn) : 0);
 
 		switch (r->mechanism) {
 		case LDAP_AUTH_MECH_SIMPLE:
 			/* context, primitive */
-			asn1_push_tag(&data, ASN1_CONTEXT_SIMPLE(0));
-			asn1_write(&data, r->creds.password,
+			asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(0));
+			asn1_write(data, r->creds.password,
 				   strlen(r->creds.password));
-			asn1_pop_tag(&data);
+			asn1_pop_tag(data);
 			break;
 		case LDAP_AUTH_MECH_SASL:
 			/* context, constructed */
-			asn1_push_tag(&data, ASN1_CONTEXT(3));
-			asn1_write_OctetString(&data, r->creds.SASL.mechanism,
+			asn1_push_tag(data, ASN1_CONTEXT(3));
+			asn1_write_OctetString(data, r->creds.SASL.mechanism,
 					       strlen(r->creds.SASL.mechanism));
 			if (r->creds.SASL.secblob) {
-				asn1_write_OctetString(&data, r->creds.SASL.secblob->data,
+				asn1_write_OctetString(data, r->creds.SASL.secblob->data,
 						       r->creds.SASL.secblob->length);
 			}
-			asn1_pop_tag(&data);
+			asn1_pop_tag(data);
 			break;
 		default:
 			return False;
 		}
 
-		asn1_pop_tag(&data);
+		asn1_pop_tag(data);
 		break;
 	}
 	case LDAP_TAG_BindResponse: {
 		struct ldap_BindResponse *r = &msg->r.BindResponse;
-		asn1_push_tag(&data, ASN1_APPLICATION(msg->type));
-		ldap_encode_response(&data, &r->response);
+		asn1_push_tag(data, ASN1_APPLICATION(msg->type));
+		ldap_encode_response(data, &r->response);
 		if (r->SASL.secblob) {
-			asn1_write_ContextSimple(&data, 7, r->SASL.secblob);
+			asn1_write_ContextSimple(data, 7, r->SASL.secblob);
 		}
-		asn1_pop_tag(&data);
+		asn1_pop_tag(data);
 		break;
 	}
 	case LDAP_TAG_UnbindRequest: {
@@ -247,223 +246,223 @@ BOOL ldap_encode(struct ldap_message *msg, DATA_BLOB *result, TALLOC_CTX *mem_ct
 	}
 	case LDAP_TAG_SearchRequest: {
 		struct ldap_SearchRequest *r = &msg->r.SearchRequest;
-		asn1_push_tag(&data, ASN1_APPLICATION(msg->type));
-		asn1_write_OctetString(&data, r->basedn, strlen(r->basedn));
-		asn1_write_enumerated(&data, r->scope);
-		asn1_write_enumerated(&data, r->deref);
-		asn1_write_Integer(&data, r->sizelimit);
-		asn1_write_Integer(&data, r->timelimit);
-		asn1_write_BOOLEAN(&data, r->attributesonly);
-
-		if (!ldap_push_filter(&data, r->tree)) {
+		asn1_push_tag(data, ASN1_APPLICATION(msg->type));
+		asn1_write_OctetString(data, r->basedn, strlen(r->basedn));
+		asn1_write_enumerated(data, r->scope);
+		asn1_write_enumerated(data, r->deref);
+		asn1_write_Integer(data, r->sizelimit);
+		asn1_write_Integer(data, r->timelimit);
+		asn1_write_BOOLEAN(data, r->attributesonly);
+
+		if (!ldap_push_filter(data, r->tree)) {
 			return False;
 		}
 
-		asn1_push_tag(&data, ASN1_SEQUENCE(0));
+		asn1_push_tag(data, ASN1_SEQUENCE(0));
 		for (i=0; i<r->num_attributes; i++) {
-			asn1_write_OctetString(&data, r->attributes[i],
+			asn1_write_OctetString(data, r->attributes[i],
 					       strlen(r->attributes[i]));
 		}
-		asn1_pop_tag(&data);
-		asn1_pop_tag(&data);
+		asn1_pop_tag(data);
+		asn1_pop_tag(data);
 		break;
 	}
 	case LDAP_TAG_SearchResultEntry: {
 		struct ldap_SearchResEntry *r = &msg->r.SearchResultEntry;
-		asn1_push_tag(&data, ASN1_APPLICATION(msg->type));
-		asn1_write_OctetString(&data, r->dn, strlen(r->dn));
-		asn1_push_tag(&data, ASN1_SEQUENCE(0));
+		asn1_push_tag(data, ASN1_APPLICATION(msg->type));
+		asn1_write_OctetString(data, r->dn, strlen(r->dn));
+		asn1_push_tag(data, ASN1_SEQUENCE(0));
 		for (i=0; i<r->num_attributes; i++) {
 			struct ldb_message_element *attr = &r->attributes[i];
-			asn1_push_tag(&data, ASN1_SEQUENCE(0));
-			asn1_write_OctetString(&data, attr->name,
+			asn1_push_tag(data, ASN1_SEQUENCE(0));
+			asn1_write_OctetString(data, attr->name,
 					       strlen(attr->name));
-			asn1_push_tag(&data, ASN1_SEQUENCE(1));
+			asn1_push_tag(data, ASN1_SEQUENCE(1));
 			for (j=0; j<attr->num_values; j++) {
-				asn1_write_OctetString(&data,
+				asn1_write_OctetString(data,
 						       attr->values[j].data,
 						       attr->values[j].length);
 			}
-			asn1_pop_tag(&data);
-			asn1_pop_tag(&data);
+			asn1_pop_tag(data);
+			asn1_pop_tag(data);
 		}
-		asn1_pop_tag(&data);
-		asn1_pop_tag(&data);
+		asn1_pop_tag(data);
+		asn1_pop_tag(data);
 		break;
 	}
 	case LDAP_TAG_SearchResultDone: {
 		struct ldap_Result *r = &msg->r.SearchResultDone;
-		asn1_push_tag(&data, ASN1_APPLICATION(msg->type));
-		ldap_encode_response(&data, r);
-		asn1_pop_tag(&data);
+		asn1_push_tag(data, ASN1_APPLICATION(msg->type));
+		ldap_encode_response(data, r);
+		asn1_pop_tag(data);
 		break;
 	}
 	case LDAP_TAG_ModifyRequest: {
 		struct ldap_ModifyRequest *r = &msg->r.ModifyRequest;
-		asn1_push_tag(&data, ASN1_APPLICATION(msg->type));
-		asn1_write_OctetString(&data, r->dn, strlen(r->dn));
-		asn1_push_tag(&data, ASN1_SEQUENCE(0));
+		asn1_push_tag(data, ASN1_APPLICATION(msg->type));
+		asn1_write_OctetString(data, r->dn, strlen(r->dn));
+		asn1_push_tag(data, ASN1_SEQUENCE(0));
 
 		for (i=0; i<r->num_mods; i++) {
 			struct ldb_message_element *attrib = &r->mods[i].attrib;
-			asn1_push_tag(&data, ASN1_SEQUENCE(0));
-			asn1_write_enumerated(&data, r->mods[i].type);
-			asn1_push_tag(&data, ASN1_SEQUENCE(0));
-			asn1_write_OctetString(&data, attrib->name,
+			asn1_push_tag(data, ASN1_SEQUENCE(0));
+			asn1_write_enumerated(data, r->mods[i].type);
+			asn1_push_tag(data, ASN1_SEQUENCE(0));
+			asn1_write_OctetString(data, attrib->name,
 					       strlen(attrib->name));
-			asn1_push_tag(&data, ASN1_SET);
+			asn1_push_tag(data, ASN1_SET);
 			for (j=0; j<attrib->num_values; j++) {
-				asn1_write_OctetString(&data,
+				asn1_write_OctetString(data,
 						       attrib->values[j].data,
 						       attrib->values[j].length);
 	
 			}
-			asn1_pop_tag(&data);
-			asn1_pop_tag(&data);
-			asn1_pop_tag(&data);
+			asn1_pop_tag(data);
+			asn1_pop_tag(data);
+			asn1_pop_tag(data);
 		}
 		
-		asn1_pop_tag(&data);
-		asn1_pop_tag(&data);
+		asn1_pop_tag(data);
+		asn1_pop_tag(data);
 		break;
 	}
 	case LDAP_TAG_ModifyResponse: {
 		struct ldap_Result *r = &msg->r.ModifyResponse;
-		asn1_push_tag(&data, ASN1_APPLICATION(msg->type));
-		ldap_encode_response(&data, r);
-		asn1_pop_tag(&data);
+		asn1_push_tag(data, ASN1_APPLICATION(msg->type));
+		ldap_encode_response(data, r);
+		asn1_pop_tag(data);
 		break;
 	}
 	case LDAP_TAG_AddRequest: {
 		struct ldap_AddRequest *r = &msg->r.AddRequest;
-		asn1_push_tag(&data, ASN1_APPLICATION(msg->type));
-		asn1_write_OctetString(&data, r->dn, strlen(r->dn));
-		asn1_push_tag(&data, ASN1_SEQUENCE(0));
+		asn1_push_tag(data, ASN1_APPLICATION(msg->type));
+		asn1_write_OctetString(data, r->dn, strlen(r->dn));
+		asn1_push_tag(data, ASN1_SEQUENCE(0));
 
 		for (i=0; i<r->num_attributes; i++) {
 			struct ldb_message_element *attrib = &r->attributes[i];
-			asn1_push_tag(&data, ASN1_SEQUENCE(0));
-			asn1_write_OctetString(&data, attrib->name,
+			asn1_push_tag(data, ASN1_SEQUENCE(0));
+			asn1_write_OctetString(data, attrib->name,
 					       strlen(attrib->name));
-			asn1_push_tag(&data, ASN1_SET);
+			asn1_push_tag(data, ASN1_SET);
 			for (j=0; j<r->attributes[i].num_values; j++) {
-				asn1_write_OctetString(&data,
+				asn1_write_OctetString(data,
 						       attrib->values[j].data,
 						       attrib->values[j].length);
 			}
-			asn1_pop_tag(&data);
-			asn1_pop_tag(&data);
+			asn1_pop_tag(data);
+			asn1_pop_tag(data);
 		}
-		asn1_pop_tag(&data);
-		asn1_pop_tag(&data);
+		asn1_pop_tag(data);
+		asn1_pop_tag(data);
 		break;
 	}
 	case LDAP_TAG_AddResponse: {
 		struct ldap_Result *r = &msg->r.AddResponse;
-		asn1_push_tag(&data, ASN1_APPLICATION(msg->type));
-		ldap_encode_response(&data, r);
-		asn1_pop_tag(&data);
+		asn1_push_tag(data, ASN1_APPLICATION(msg->type));
+		ldap_encode_response(data, r);
+		asn1_pop_tag(data);
 		break;
 	}
 	case LDAP_TAG_DelRequest: {
 		struct ldap_DelRequest *r = &msg->r.DelRequest;
-		asn1_push_tag(&data, ASN1_APPLICATION_SIMPLE(msg->type));
-		asn1_write(&data, r->dn, strlen(r->dn));
-		asn1_pop_tag(&data);
+		asn1_push_tag(data, ASN1_APPLICATION_SIMPLE(msg->type));
+		asn1_write(data, r->dn, strlen(r->dn));
+		asn1_pop_tag(data);
 		break;
 	}
 	case LDAP_TAG_DelResponse: {
 		struct ldap_Result *r = &msg->r.DelResponse;
-		asn1_push_tag(&data, ASN1_APPLICATION(msg->type));
-		ldap_encode_response(&data, r);
-		asn1_pop_tag(&data);
+		asn1_push_tag(data, ASN1_APPLICATION(msg->type));
+		ldap_encode_response(data, r);
+		asn1_pop_tag(data);
 		break;
 	}
 	case LDAP_TAG_ModifyDNRequest: {
 		struct ldap_ModifyDNRequest *r = &msg->r.ModifyDNRequest;
-		asn1_push_tag(&data, ASN1_APPLICATION(msg->type));
-		asn1_write_OctetString(&data, r->dn, strlen(r->dn));
-		asn1_write_OctetString(&data, r->newrdn, strlen(r->newrdn));
-		asn1_write_BOOLEAN(&data, r->deleteolddn);
+		asn1_push_tag(data, ASN1_APPLICATION(msg->type));
+		asn1_write_OctetString(data, r->dn, strlen(r->dn));
+		asn1_write_OctetString(data, r->newrdn, strlen(r->newrdn));
+		asn1_write_BOOLEAN(data, r->deleteolddn);
 		if (r->newsuperior) {
-			asn1_push_tag(&data, ASN1_CONTEXT_SIMPLE(0));
-			asn1_write(&data, r->newsuperior,
+			asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(0));
+			asn1_write(data, r->newsuperior,
 				   strlen(r->newsuperior));
-			asn1_pop_tag(&data);
+			asn1_pop_tag(data);
 		}
-		asn1_pop_tag(&data);
+		asn1_pop_tag(data);
 		break;
 	}
 	case LDAP_TAG_ModifyDNResponse: {
 		struct ldap_Result *r = &msg->r.ModifyDNResponse;
-		asn1_push_tag(&data, ASN1_APPLICATION(msg->type));
-		ldap_encode_response(&data, r);
-		asn1_pop_tag(&data);
+		asn1_push_tag(data, ASN1_APPLICATION(msg->type));
+		ldap_encode_response(data, r);
+		asn1_pop_tag(data);
 		break;
 	}
 	case LDAP_TAG_CompareRequest: {
 		struct ldap_CompareRequest *r = &msg->r.CompareRequest;
-		asn1_push_tag(&data, ASN1_APPLICATION(msg->type));
-		asn1_write_OctetString(&data, r->dn, strlen(r->dn));
-		asn1_push_tag(&data, ASN1_SEQUENCE(0));
-		asn1_write_OctetString(&data, r->attribute,
+		asn1_push_tag(data, ASN1_APPLICATION(msg->type));
+		asn1_write_OctetString(data, r->dn, strlen(r->dn));
+		asn1_push_tag(data, ASN1_SEQUENCE(0));
+		asn1_write_OctetString(data, r->attribute,
 				       strlen(r->attribute));
-		asn1_write_OctetString(&data, r->value.data,
+		asn1_write_OctetString(data, r->value.data,
 				       r->value.length);
-		asn1_pop_tag(&data);
-		asn1_pop_tag(&data);
+		asn1_pop_tag(data);
+		asn1_pop_tag(data);
 		break;
 	}
 	case LDAP_TAG_CompareResponse: {
 		struct ldap_Result *r = &msg->r.ModifyDNResponse;
-		asn1_push_tag(&data, ASN1_APPLICATION(msg->type));
-		ldap_encode_response(&data, r);
-		asn1_pop_tag(&data);
+		asn1_push_tag(data, ASN1_APPLICATION(msg->type));
+		ldap_encode_response(data, r);
+		asn1_pop_tag(data);
 		break;
 	}
 	case LDAP_TAG_AbandonRequest: {
 		struct ldap_AbandonRequest *r = &msg->r.AbandonRequest;
-		asn1_push_tag(&data, ASN1_APPLICATION_SIMPLE(msg->type));
-		asn1_write_implicit_Integer(&data, r->messageid);
-		asn1_pop_tag(&data);
+		asn1_push_tag(data, ASN1_APPLICATION_SIMPLE(msg->type));
+		asn1_write_implicit_Integer(data, r->messageid);
+		asn1_pop_tag(data);
 		break;
 	}
 	case LDAP_TAG_SearchResultReference: {
 		struct ldap_SearchResRef *r = &msg->r.SearchResultReference;
-		asn1_push_tag(&data, ASN1_APPLICATION(msg->type));
-		asn1_write_OctetString(&data, r->referral, strlen(r->referral));
-		asn1_pop_tag(&data);
+		asn1_push_tag(data, ASN1_APPLICATION(msg->type));
+		asn1_write_OctetString(data, r->referral, strlen(r->referral));
+		asn1_pop_tag(data);
 		break;
 	}
 	case LDAP_TAG_ExtendedRequest: {
 		struct ldap_ExtendedRequest *r = &msg->r.ExtendedRequest;
-		asn1_push_tag(&data, ASN1_APPLICATION(msg->type));
-		asn1_push_tag(&data, ASN1_CONTEXT_SIMPLE(0));
-		asn1_write(&data, r->oid, strlen(r->oid));
-		asn1_pop_tag(&data);
+		asn1_push_tag(data, ASN1_APPLICATION(msg->type));
+		asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(0));
+		asn1_write(data, r->oid, strlen(r->oid));
+		asn1_pop_tag(data);
 		if (r->value) {
-			asn1_push_tag(&data, ASN1_CONTEXT_SIMPLE(1));
-			asn1_write(&data, r->value->data, r->value->length);
-			asn1_pop_tag(&data);
+			asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(1));
+			asn1_write(data, r->value->data, r->value->length);
+			asn1_pop_tag(data);
 		}
-		asn1_pop_tag(&data);
+		asn1_pop_tag(data);
 		break;
 	}
 	case LDAP_TAG_ExtendedResponse: {
 		struct ldap_ExtendedResponse *r = &msg->r.ExtendedResponse;
-		asn1_push_tag(&data, ASN1_APPLICATION(msg->type));
-		ldap_encode_response(&data, &r->response);
+		asn1_push_tag(data, ASN1_APPLICATION(msg->type));
+		ldap_encode_response(data, &r->response);
 		if (r->oid) {
-			asn1_push_tag(&data, ASN1_CONTEXT_SIMPLE(10));
-			asn1_write(&data, r->oid, strlen(r->oid));
-			asn1_pop_tag(&data);
+			asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(10));
+			asn1_write(data, r->oid, strlen(r->oid));
+			asn1_pop_tag(data);
 		}
 		if (r->value) {
-			asn1_push_tag(&data, ASN1_CONTEXT_SIMPLE(11));
-			asn1_write(&data, r->value->data, r->value->length);
-			asn1_pop_tag(&data);
+			asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(11));
+			asn1_write(data, r->value->data, r->value->length);
+			asn1_pop_tag(data);
 		}
-		asn1_pop_tag(&data);
+		asn1_pop_tag(data);
 		break;
 	}
 	default:
@@ -471,26 +470,26 @@ BOOL ldap_encode(struct ldap_message *msg, DATA_BLOB *result, TALLOC_CTX *mem_ct
 	}
 
 	if (msg->controls != NULL) {
-		asn1_push_tag(&data, ASN1_CONTEXT(0));
+		asn1_push_tag(data, ASN1_CONTEXT(0));
 		
 		for (i = 0; msg->controls[i] != NULL; i++) {
-			if (!ldap_encode_control(mem_ctx, &data, msg->controls[i])) {
+			if (!ldap_encode_control(mem_ctx, data, msg->controls[i])) {
 				return False;
 			}
 		}
 
-		asn1_pop_tag(&data);
+		asn1_pop_tag(data);
 	}
 
-	asn1_pop_tag(&data);
+	asn1_pop_tag(data);
 
-	if (data.has_error) {
-		asn1_free(&data);
+	if (data->has_error) {
+		asn1_free(data);
 		return False;
 	}
 
-	*result = data_blob_talloc(mem_ctx, data.data, data.length);
-	asn1_free(&data);
+	*result = data_blob_talloc(mem_ctx, data->data, data->length);
+	asn1_free(data);
 	return True;
 }
 
@@ -508,7 +507,7 @@ static BOOL asn1_read_OctetString_talloc(TALLOC_CTX *mem_ctx,
 					 const char **result)
 {
 	DATA_BLOB string;
-	if (!asn1_read_OctetString(data, &string))
+	if (!asn1_read_OctetString(data, mem_ctx, &string))
 		return False;
 	*result = blob2string_talloc(mem_ctx, string);
 	data_blob_free(&string);
@@ -631,7 +630,7 @@ static struct ldb_parse_tree *ldap_decode_filter_tree(TALLOC_CTX *mem_ctx,
 
 		asn1_start_tag(data, ASN1_CONTEXT(filter_tag));
 		asn1_read_OctetString_talloc(mem_ctx, data, &attrib);
-		asn1_read_OctetString(data, &value);
+		asn1_read_OctetString(data, mem_ctx, &value);
 		asn1_end_tag(data);
 		if ((data->has_error) || (attrib == NULL) || (value.data == NULL)) {
 			goto failed;
@@ -653,7 +652,7 @@ static struct ldb_parse_tree *ldap_decode_filter_tree(TALLOC_CTX *mem_ctx,
 		if (!asn1_start_tag(data, ASN1_CONTEXT(filter_tag))) {
 			goto failed;
 		}
-		if (!asn1_read_OctetString(data, &attr)) {
+		if (!asn1_read_OctetString(data, mem_ctx, &attr)) {
 			goto failed;
 		}
 
@@ -673,7 +672,7 @@ static struct ldb_parse_tree *ldap_decode_filter_tree(TALLOC_CTX *mem_ctx,
 			if (subs_tag > 2) goto failed;
 
 			asn1_start_tag(data, ASN1_CONTEXT_SIMPLE(subs_tag));
-			asn1_read_LDAPString(data, &value);
+			asn1_read_LDAPString(data, mem_ctx, &value);
 			asn1_end_tag(data);
 
 			switch (subs_tag) {
@@ -743,7 +742,7 @@ static struct ldb_parse_tree *ldap_decode_filter_tree(TALLOC_CTX *mem_ctx,
 
 		asn1_start_tag(data, ASN1_CONTEXT(filter_tag));
 		asn1_read_OctetString_talloc(mem_ctx, data, &attrib);
-		asn1_read_OctetString(data, &value);
+		asn1_read_OctetString(data, mem_ctx, &value);
 		asn1_end_tag(data);
 		if ((data->has_error) || (attrib == NULL) || (value.data == NULL)) {
 			goto failed;
@@ -762,7 +761,7 @@ static struct ldb_parse_tree *ldap_decode_filter_tree(TALLOC_CTX *mem_ctx,
 
 		asn1_start_tag(data, ASN1_CONTEXT(filter_tag));
 		asn1_read_OctetString_talloc(mem_ctx, data, &attrib);
-		asn1_read_OctetString(data, &value);
+		asn1_read_OctetString(data, mem_ctx, &value);
 		asn1_end_tag(data);
 		if ((data->has_error) || (attrib == NULL) || (value.data == NULL)) {
 			goto failed;
@@ -781,7 +780,7 @@ static struct ldb_parse_tree *ldap_decode_filter_tree(TALLOC_CTX *mem_ctx,
 		if (!asn1_start_tag(data, ASN1_CONTEXT_SIMPLE(filter_tag))) {
 			goto failed;
 		}
-		if (!asn1_read_LDAPString(data, &attr)) {
+		if (!asn1_read_LDAPString(data, ret, &attr)) {
 			goto failed;
 		}
 
@@ -800,7 +799,7 @@ static struct ldb_parse_tree *ldap_decode_filter_tree(TALLOC_CTX *mem_ctx,
 
 		asn1_start_tag(data, ASN1_CONTEXT(filter_tag));
 		asn1_read_OctetString_talloc(mem_ctx, data, &attrib);
-		asn1_read_OctetString(data, &value);
+		asn1_read_OctetString(data, mem_ctx, &value);
 		asn1_end_tag(data);
 		if ((data->has_error) || (attrib == NULL) || (value.data == NULL)) {
 			goto failed;
@@ -825,16 +824,16 @@ static struct ldb_parse_tree *ldap_decode_filter_tree(TALLOC_CTX *mem_ctx,
 		/* either oid or type must be defined */
 		if (asn1_peek_tag(data, ASN1_CONTEXT_SIMPLE(1))) { /* optional */
 			asn1_start_tag(data, ASN1_CONTEXT_SIMPLE(1));
-			asn1_read_LDAPString(data, &oid);
+			asn1_read_LDAPString(data, ret, &oid);
 			asn1_end_tag(data);
 		}
 		if (asn1_peek_tag(data, ASN1_CONTEXT_SIMPLE(2))) {	/* optional  */
 			asn1_start_tag(data, ASN1_CONTEXT_SIMPLE(2));
-			asn1_read_LDAPString(data, &attr);
+			asn1_read_LDAPString(data, ret, &attr);
 			asn1_end_tag(data);
 		}
 		asn1_start_tag(data, ASN1_CONTEXT_SIMPLE(3));
-		asn1_read_LDAPString(data, &value);
+		asn1_read_LDAPString(data, ret, &value);
 		asn1_end_tag(data);
 		/* dnAttributes is marked as BOOLEAN DEFAULT FALSE
 		   it is not marked as OPTIONAL but openldap tools
@@ -902,7 +901,7 @@ static void ldap_decode_attrib(TALLOC_CTX *mem_ctx, struct asn1_data *data,
 	asn1_start_tag(data, ASN1_SET);
 	while (asn1_peek_tag(data, ASN1_OCTET_STRING)) {
 		DATA_BLOB blob;
-		asn1_read_OctetString(data, &blob);
+		asn1_read_OctetString(data, mem_ctx, &blob);
 		add_value_to_attrib(mem_ctx, &blob, attrib);
 	}
 	asn1_end_tag(data);
@@ -970,7 +969,7 @@ NTSTATUS ldap_decode(struct asn1_data *data, struct ldap_message *msg)
 			asn1_read_OctetString_talloc(msg, data, &r->creds.SASL.mechanism);
 			if (asn1_peek_tag(data, ASN1_OCTET_STRING)) { /* optional */
 				DATA_BLOB tmp_blob = data_blob(NULL, 0);
-				asn1_read_OctetString(data, &tmp_blob);
+				asn1_read_OctetString(data, msg, &tmp_blob);
 				r->creds.SASL.secblob = talloc(msg, DATA_BLOB);
 				if (!r->creds.SASL.secblob) {
 					return NT_STATUS_LDAP(LDAP_OPERATIONS_ERROR);
@@ -1228,7 +1227,7 @@ NTSTATUS ldap_decode(struct asn1_data *data, struct ldap_message *msg)
 		asn1_read_OctetString_talloc(msg, data, &r->dn);
 		asn1_start_tag(data, ASN1_SEQUENCE(0));
 		asn1_read_OctetString_talloc(msg, data, &r->attribute);
-		asn1_read_OctetString(data, &r->value);
+		asn1_read_OctetString(data, msg, &r->value);
 		if (r->value.data) {
 			talloc_steal(msg, r->value.data);
 		}
diff --git a/source4/libcli/ldap/ldap_client.c b/source4/libcli/ldap/ldap_client.c
index c819122dd2..5e4eddee92 100644
--- a/source4/libcli/ldap/ldap_client.c
+++ b/source4/libcli/ldap/ldap_client.c
@@ -169,31 +169,30 @@ static void ldap_match_message(struct ldap_connection *conn, struct ldap_message
 */
 static NTSTATUS ldap_recv_handler(void *private_data, DATA_BLOB blob)
 {
-	int ret;
 	NTSTATUS status;
-	struct asn1_data asn1;
 	struct ldap_connection *conn = talloc_get_type(private_data, 
 						       struct ldap_connection);
 	struct ldap_message *msg = talloc(conn, struct ldap_message);
+	struct asn1_data *asn1 = asn1_init(conn);
 
 	if (msg == NULL) {
 		return NT_STATUS_LDAP(LDAP_PROTOCOL_ERROR);
 	}
 
-	if (!asn1_load(&asn1, blob)) {
+	if (!asn1_load(asn1, blob)) {
 		return NT_STATUS_LDAP(LDAP_PROTOCOL_ERROR);
 	}
 	
-	status = ldap_decode(&asn1, msg);
+	status = ldap_decode(asn1, msg);
 	if (!NT_STATUS_IS_OK(status)) {
-		asn1_free(&asn1);
+		asn1_free(asn1);
 		return status;
 	}
 
 	ldap_match_message(conn, msg);
 
 	data_blob_free(&blob);
-	asn1_free(&asn1);
+	asn1_free(asn1);
 	return NT_STATUS_OK;
 }
 
diff --git a/source4/libcli/ldap/ldap_controls.c b/source4/libcli/ldap/ldap_controls.c
index bbb0cb1aa5..180e6eeb62 100644
--- a/source4/libcli/ldap/ldap_controls.c
+++ b/source4/libcli/ldap/ldap_controls.c
@@ -34,10 +34,10 @@ struct control_handler {
 static BOOL decode_server_sort_response(void *mem_ctx, DATA_BLOB in, void **out)
 {
 	DATA_BLOB attr;
-	struct asn1_data data;
+	struct asn1_data *data = asn1_init(mem_ctx);
 	struct ldb_sort_resp_control *lsrc;
 
-	if (!asn1_load(&data, in)) {
+	if (!asn1_load(data, in)) {
 		return False;
 	}
 
@@ -46,17 +46,17 @@ static BOOL decode_server_sort_response(void *mem_ctx, DATA_BLOB in, void **out)
 		return False;
 	}
 
-	if (!asn1_start_tag(&data, ASN1_SEQUENCE(0))) {
+	if (!asn1_start_tag(data, ASN1_SEQUENCE(0))) {
 		return False;
 	}
 
-	if (!asn1_read_enumerated(&data, &(lsrc->result))) {
+	if (!asn1_read_enumerated(data, &(lsrc->result))) {
 		return False;
 	}
 
 	lsrc->attr_desc = NULL;
-	if (asn1_peek_tag(&data, ASN1_OCTET_STRING)) {
-		if (!asn1_read_OctetString(&data, &attr)) {
+	if (asn1_peek_tag(data, ASN1_OCTET_STRING)) {
+		if (!asn1_read_OctetString(data, mem_ctx, &attr)) {
 			return False;
 		}
 		lsrc->attr_desc = talloc_strndup(lsrc, (const char *)attr.data, attr.length);
@@ -65,7 +65,7 @@ static BOOL decode_server_sort_response(void *mem_ctx, DATA_BLOB in, void **out)
 		}
 	}
 
-	if (!asn1_end_tag(&data)) {
+	if (!asn1_end_tag(data)) {
 		return False;
 	}
 
@@ -78,21 +78,21 @@ static BOOL decode_server_sort_request(void *mem_ctx, DATA_BLOB in, void **out)
 {
 	DATA_BLOB attr;
 	DATA_BLOB rule;
-	struct asn1_data data;
+	struct asn1_data *data = asn1_init(mem_ctx);
 	struct ldb_server_sort_control **lssc;
 	int num;
 
-	if (!asn1_load(&data, in)) {
+	if (!asn1_load(data, in)) {
 		return False;
 	}
 
-	if (!asn1_start_tag(&data, ASN1_SEQUENCE(0))) {
+	if (!asn1_start_tag(data, ASN1_SEQUENCE(0))) {
 		return False;
 	}
 
 	lssc = NULL;
 
-	for (num = 0; asn1_peek_tag(&data, ASN1_SEQUENCE(0)); num++) {
+	for (num = 0; asn1_peek_tag(data, ASN1_SEQUENCE(0)); num++) {
 		lssc = talloc_realloc(mem_ctx, lssc, struct ldb_server_sort_control *, num + 2);
 		if (!lssc) {
 			return False;
@@ -102,11 +102,11 @@ static BOOL decode_server_sort_request(void *mem_ctx, DATA_BLOB in, void **out)
 			return False;
 		}
 
-		if (!asn1_start_tag(&data, ASN1_SEQUENCE(0))) {
+		if (!asn1_start_tag(data, ASN1_SEQUENCE(0))) {
 			return False;
 		}
 
-		if (!asn1_read_OctetString(&data, &attr)) {
+		if (!asn1_read_OctetString(data, mem_ctx, &attr)) {
 			return False;
 		}
 
@@ -115,8 +115,8 @@ static BOOL decode_server_sort_request(void *mem_ctx, DATA_BLOB in, void **out)
 			return False;
 		}
 	
-		if (asn1_peek_tag(&data, ASN1_OCTET_STRING)) {
-			if (!asn1_read_OctetString(&data, &rule)) {
+		if (asn1_peek_tag(data, ASN1_OCTET_STRING)) {
+			if (!asn1_read_OctetString(data, mem_ctx, &rule)) {
 				return False;
 			}
 			lssc[num]->orderingRule = talloc_strndup(lssc[num], (const char *)rule.data, rule.length);
@@ -125,15 +125,15 @@ static BOOL decode_server_sort_request(void *mem_ctx, DATA_BLOB in, void **out)
 			}
 		}
 
-		if (asn1_peek_tag(&data, ASN1_BOOLEAN)) {
+		if (asn1_peek_tag(data, ASN1_BOOLEAN)) {
 			BOOL reverse;
-			if (!asn1_read_BOOLEAN(&data, &reverse)) {
+			if (!asn1_read_BOOLEAN(data, &reverse)) {
 			return False;
 			}
 			lssc[num]->reverse = reverse;
 		}
 	
-		if (!asn1_end_tag(&data)) {
+		if (!asn1_end_tag(data)) {
 			return False;
 		}
 	}
@@ -142,7 +142,7 @@ static BOOL decode_server_sort_request(void *mem_ctx, DATA_BLOB in, void **out)
 		lssc[num] = NULL;
 	}
 
-	if (!asn1_end_tag(&data)) {
+	if (!asn1_end_tag(data)) {
 		return False;
 	}
 
@@ -153,10 +153,10 @@ static BOOL decode_server_sort_request(void *mem_ctx, DATA_BLOB in, void **out)
 
 static BOOL decode_extended_dn_request(void *mem_ctx, DATA_BLOB in, void **out)
 {
-	struct asn1_data data;
+	struct asn1_data *data = asn1_init(mem_ctx);
 	struct ldb_extended_dn_control *ledc;
 
-	if (!asn1_load(&data, in)) {
+	if (!asn1_load(data, in)) {
 		return False;
 	}
 
@@ -165,15 +165,15 @@ static BOOL decode_extended_dn_request(void *mem_ctx, DATA_BLOB in, void **out)
 		return False;
 	}
 
-	if (!asn1_start_tag(&data, ASN1_SEQUENCE(0))) {
+	if (!asn1_start_tag(data, ASN1_SEQUENCE(0))) {
 		return False;
 	}
 
-	if (!asn1_read_Integer(&data, &(ledc->type))) {
+	if (!asn1_read_Integer(data, &(ledc->type))) {
 		return False;
 	}
 	
-	if (!asn1_end_tag(&data)) {
+	if (!asn1_end_tag(data)) {
 		return False;
 	}
 
@@ -184,10 +184,10 @@ static BOOL decode_extended_dn_request(void *mem_ctx, DATA_BLOB in, void **out)
 
 static BOOL decode_sd_flags_request(void *mem_ctx, DATA_BLOB in, void **out)
 {
-	struct asn1_data data;
+	struct asn1_data *data = asn1_init(mem_ctx);
 	struct ldb_sd_flags_control *lsdfc;
 
-	if (!asn1_load(&data, in)) {
+	if (!asn1_load(data, in)) {
 		return False;
 	}
 
@@ -196,15 +196,15 @@ static BOOL decode_sd_flags_request(void *mem_ctx, DATA_BLOB in, void **out)
 		return False;
 	}
 
-	if (!asn1_start_tag(&data, ASN1_SEQUENCE(0))) {
+	if (!asn1_start_tag(data, ASN1_SEQUENCE(0))) {
 		return False;
 	}
 
-	if (!asn1_read_Integer(&data, &(lsdfc->secinfo_flags))) {
+	if (!asn1_read_Integer(data, &(lsdfc->secinfo_flags))) {
 		return False;
 	}
 
-	if (!asn1_end_tag(&data)) {
+	if (!asn1_end_tag(data)) {
 		return False;
 	}
 
@@ -215,10 +215,10 @@ static BOOL decode_sd_flags_request(void *mem_ctx, DATA_BLOB in, void **out)
 
 static BOOL decode_search_options_request(void *mem_ctx, DATA_BLOB in, void **out)
 {
-	struct asn1_data data;
+	struct asn1_data *data = asn1_init(mem_ctx);
 	struct ldb_search_options_control *lsoc;
 
-	if (!asn1_load(&data, in)) {
+	if (!asn1_load(data, in)) {
 		return False;
 	}
 
@@ -227,15 +227,15 @@ static BOOL decode_search_options_request(void *mem_ctx, DATA_BLOB in, void **ou
 		return False;
 	}
 
-	if (!asn1_start_tag(&data, ASN1_SEQUENCE(0))) {
+	if (!asn1_start_tag(data, ASN1_SEQUENCE(0))) {
 		return False;
 	}
 
-	if (!asn1_read_Integer(&data, &(lsoc->search_options))) {
+	if (!asn1_read_Integer(data, &(lsoc->search_options))) {
 		return False;
 	}
 
-	if (!asn1_end_tag(&data)) {
+	if (!asn1_end_tag(data)) {
 		return False;
 	}
 
@@ -247,10 +247,10 @@ static BOOL decode_search_options_request(void *mem_ctx, DATA_BLOB in, void **ou
 static BOOL decode_paged_results_request(void *mem_ctx, DATA_BLOB in, void **out)
 {
 	DATA_BLOB cookie;
-	struct asn1_data data;
+	struct asn1_data *data = asn1_init(mem_ctx);
 	struct ldb_paged_control *lprc;
 
-	if (!asn1_load(&data, in)) {
+	if (!asn1_load(data, in)) {
 		return False;
 	}
 
@@ -259,15 +259,15 @@ static BOOL decode_paged_results_request(void *mem_ctx, DATA_BLOB in, void **out
 		return False;
 	}
 
-	if (!asn1_start_tag(&data, ASN1_SEQUENCE(0))) {
+	if (!asn1_start_tag(data, ASN1_SEQUENCE(0))) {
 		return False;
 	}
 
-	if (!asn1_read_Integer(&data, &(lprc->size))) {
+	if (!asn1_read_Integer(data, &(lprc->size))) {
 		return False;
 	}
 	
-	if (!asn1_read_OctetString(&data, &cookie)) {
+	if (!asn1_read_OctetString(data, mem_ctx, &cookie)) {
 		return False;
 	}
 	lprc->cookie_len = cookie.length;
@@ -281,7 +281,7 @@ static BOOL decode_paged_results_request(void *mem_ctx, DATA_BLOB in, void **out
 		lprc->cookie = NULL;
 	}
 
-	if (!asn1_end_tag(&data)) {
+	if (!asn1_end_tag(data)) {
 		return False;
 	}
 
@@ -293,10 +293,10 @@ static BOOL decode_paged_results_request(void *mem_ctx, DATA_BLOB in, void **out
 static BOOL decode_dirsync_request(void *mem_ctx, DATA_BLOB in, void **out)
 {
 	DATA_BLOB cookie;
-	struct asn1_data data;
+	struct asn1_data *data = asn1_init(mem_ctx);
 	struct ldb_dirsync_control *ldc;
 
-	if (!asn1_load(&data, in)) {
+	if (!asn1_load(data, in)) {
 		return False;
 	}
 
@@ -305,19 +305,19 @@ static BOOL decode_dirsync_request(void *mem_ctx, DATA_BLOB in, void **out)
 		return False;
 	}
 
-	if (!asn1_start_tag(&data, ASN1_SEQUENCE(0))) {
+	if (!asn1_start_tag(data, ASN1_SEQUENCE(0))) {
 		return False;
 	}
 
-	if (!asn1_read_Integer(&data, &(ldc->flags))) {
+	if (!asn1_read_Integer(data, &(ldc->flags))) {
 		return False;
 	}
 	
-	if (!asn1_read_Integer(&data, &(ldc->max_attributes))) {
+	if (!asn1_read_Integer(data, &(ldc->max_attributes))) {
 		return False;
 	}
 	
-	if (!asn1_read_OctetString(&data, &cookie)) {
+	if (!asn1_read_OctetString(data, mem_ctx, &cookie)) {
 		return False;
 	}
 	ldc->cookie_len = cookie.length;
@@ -331,7 +331,7 @@ static BOOL decode_dirsync_request(void *mem_ctx, DATA_BLOB in, void **out)
 		ldc->cookie = NULL;
 	}
 
-	if (!asn1_end_tag(&data)) {
+	if (!asn1_end_tag(data)) {
 		return False;
 	}
 
@@ -346,10 +346,10 @@ static BOOL decode_dirsync_request(void *mem_ctx, DATA_BLOB in, void **out)
 static BOOL decode_asq_control(void *mem_ctx, DATA_BLOB in, void **out)
 {
 	DATA_BLOB source_attribute;
-	struct asn1_data data;
+	struct asn1_data *data = asn1_init(mem_ctx);
 	struct ldb_asq_control *lac;
 
-	if (!asn1_load(&data, in)) {
+	if (!asn1_load(data, in)) {
 		return False;
 	}
 
@@ -358,13 +358,13 @@ static BOOL decode_asq_control(void *mem_ctx, DATA_BLOB in, void **out)
 		return False;
 	}
 
-	if (!asn1_start_tag(&data, ASN1_SEQUENCE(0))) {
+	if (!asn1_start_tag(data, ASN1_SEQUENCE(0))) {
 		return False;
 	}
 
-	if (asn1_peek_tag(&data, ASN1_OCTET_STRING)) {
+	if (asn1_peek_tag(data, ASN1_OCTET_STRING)) {
 
-		if (!asn1_read_OctetString(&data, &source_attribute)) {
+		if (!asn1_read_OctetString(data, mem_ctx, &source_attribute)) {
 			return False;
 		}
 		lac->src_attr_len = source_attribute.length;
@@ -380,9 +380,9 @@ static BOOL decode_asq_control(void *mem_ctx, DATA_BLOB in, void **out)
 
 		lac->request = 1;
 
-	} else if (asn1_peek_tag(&data, ASN1_ENUMERATED)) {
+	} else if (asn1_peek_tag(data, ASN1_ENUMERATED)) {
 
-		if (!asn1_read_enumerated(&data, &(lac->result))) {
+		if (!asn1_read_enumerated(data, &(lac->result))) {
 			return False;
 		}
 
@@ -392,7 +392,7 @@ static BOOL decode_asq_control(void *mem_ctx, DATA_BLOB in, void **out)
 		return False;
 	}
 
-	if (!asn1_end_tag(&data)) {
+	if (!asn1_end_tag(data)) {
 		return False;
 	}
 
@@ -449,10 +449,10 @@ static BOOL decode_manageDSAIT_request(void *mem_ctx, DATA_BLOB in, void **out)
 static BOOL decode_vlv_request(void *mem_ctx, DATA_BLOB in, void **out)
 {
 	DATA_BLOB assertion_value, context_id;
-	struct asn1_data data;
+	struct asn1_data *data = asn1_init(mem_ctx);
 	struct ldb_vlv_req_control *lvrc;
 
-	if (!asn1_load(&data, in)) {
+	if (!asn1_load(data, in)) {
 		return False;
 	}
 
@@ -461,43 +461,43 @@ static BOOL decode_vlv_request(void *mem_ctx, DATA_BLOB in, void **out)
 		return False;
 	}
 
-	if (!asn1_start_tag(&data, ASN1_SEQUENCE(0))) {
+	if (!asn1_start_tag(data, ASN1_SEQUENCE(0))) {
 		return False;
 	}
 
-	if (!asn1_read_Integer(&data, &(lvrc->beforeCount))) {
+	if (!asn1_read_Integer(data, &(lvrc->beforeCount))) {
 		return False;
 	}
 	
-	if (!asn1_read_Integer(&data, &(lvrc->afterCount))) {
+	if (!asn1_read_Integer(data, &(lvrc->afterCount))) {
 		return False;
 	}
 
-	if (asn1_peek_tag(&data, ASN1_CONTEXT(0))) {
+	if (asn1_peek_tag(data, ASN1_CONTEXT(0))) {
 
 		lvrc->type = 0;
 		
-		if (!asn1_start_tag(&data, ASN1_CONTEXT(0))) {
+		if (!asn1_start_tag(data, ASN1_CONTEXT(0))) {
 			return False;
 		}
 
-		if (!asn1_start_tag(&data, ASN1_SEQUENCE(0))) {
+		if (!asn1_start_tag(data, ASN1_SEQUENCE(0))) {
 			return False;
 		}
 
-		if (!asn1_read_Integer(&data, &(lvrc->match.byOffset.offset))) {
+		if (!asn1_read_Integer(data, &(lvrc->match.byOffset.offset))) {
 			return False;
 		}
 
-		if (!asn1_read_Integer(&data, &(lvrc->match.byOffset.contentCount))) {
+		if (!asn1_read_Integer(data, &(lvrc->match.byOffset.contentCount))) {
 			return False;
 		}
 
-		if (!asn1_end_tag(&data)) { /*SEQUENCE*/
+		if (!asn1_end_tag(data)) { /*SEQUENCE*/
 			return False;
 		}
 
-		if (!asn1_end_tag(&data)) { /*CONTEXT*/
+		if (!asn1_end_tag(data)) { /*CONTEXT*/
 			return False;
 		}
 
@@ -505,11 +505,11 @@ static BOOL decode_vlv_request(void *mem_ctx, DATA_BLOB in, void **out)
 
 		lvrc->type = 1;
 
-		if (!asn1_start_tag(&data, ASN1_CONTEXT(1))) {
+		if (!asn1_start_tag(data, ASN1_CONTEXT(1))) {
 			return False;
 		}
 
-		if (!asn1_read_OctetString(&data, &assertion_value)) {
+		if (!asn1_read_OctetString(data, mem_ctx, &assertion_value)) {
 			return False;
 		}
 		lvrc->match.gtOrEq.value_len = assertion_value.length;
@@ -523,13 +523,13 @@ static BOOL decode_vlv_request(void *mem_ctx, DATA_BLOB in, void **out)
 			lvrc->match.gtOrEq.value = NULL;
 		}
 
-		if (!asn1_end_tag(&data)) { /*CONTEXT*/
+		if (!asn1_end_tag(data)) { /*CONTEXT*/
 			return False;
 		}
 	}
 
-	if (asn1_peek_tag(&data, ASN1_OCTET_STRING)) {
-		if (!asn1_read_OctetString(&data, &context_id)) {
+	if (asn1_peek_tag(data, ASN1_OCTET_STRING)) {
+		if (!asn1_read_OctetString(data, mem_ctx, &context_id)) {
 			return False;
 		}
 		lvrc->ctxid_len = context_id.length;
@@ -547,7 +547,7 @@ static BOOL decode_vlv_request(void *mem_ctx, DATA_BLOB in, void **out)
 		lvrc->ctxid_len = 0;
 	}
 
-	if (!asn1_end_tag(&data)) {
+	if (!asn1_end_tag(data)) {
 		return False;
 	}
 
@@ -559,10 +559,10 @@ static BOOL decode_vlv_request(void *mem_ctx, DATA_BLOB in, void **out)
 static BOOL decode_vlv_response(void *mem_ctx, DATA_BLOB in, void **out)
 {
 	DATA_BLOB context_id;
-	struct asn1_data data;
+	struct asn1_data *data = asn1_init(mem_ctx);
 	struct ldb_vlv_resp_control *lvrc;
 
-	if (!asn1_load(&data, in)) {
+	if (!asn1_load(data, in)) {
 		return False;
 	}
 
@@ -571,24 +571,24 @@ static BOOL decode_vlv_response(void *mem_ctx, DATA_BLOB in, void **out)
 		return False;
 	}
 
-	if (!asn1_start_tag(&data, ASN1_SEQUENCE(0))) {
+	if (!asn1_start_tag(data, ASN1_SEQUENCE(0))) {
 		return False;
 	}
 
-	if (!asn1_read_Integer(&data, &(lvrc->targetPosition))) {
+	if (!asn1_read_Integer(data, &(lvrc->targetPosition))) {
 		return False;
 	}
 	
-	if (!asn1_read_Integer(&data, &(lvrc->contentCount))) {
+	if (!asn1_read_Integer(data, &(lvrc->contentCount))) {
 		return False;
 	}
 	
-	if (!asn1_read_enumerated(&data, &(lvrc->vlv_result))) {
+	if (!asn1_read_enumerated(data, &(lvrc->vlv_result))) {
 		return False;
 	}
 
-	if (asn1_peek_tag(&data, ASN1_OCTET_STRING)) {
-		if (!asn1_read_OctetString(&data, &context_id)) {
+	if (asn1_peek_tag(data, ASN1_OCTET_STRING)) {
+		if (!asn1_read_OctetString(data, mem_ctx, &context_id)) {
 			return False;
 		}
 		lvrc->contextId = talloc_strndup(lvrc, (const char *)context_id.data, context_id.length);
@@ -601,7 +601,7 @@ static BOOL decode_vlv_response(void *mem_ctx, DATA_BLOB in, void **out)
 		lvrc->ctxid_len = 0;
 	}
 
-	if (!asn1_end_tag(&data)) {
+	if (!asn1_end_tag(data)) {
 		return False;
 	}
 
@@ -613,32 +613,31 @@ static BOOL decode_vlv_response(void *mem_ctx, DATA_BLOB in, void **out)
 static BOOL encode_server_sort_response(void *mem_ctx, void *in, DATA_BLOB *out)
 {
 	struct ldb_sort_resp_control *lsrc = talloc_get_type(in, struct ldb_sort_resp_control);
-	struct asn1_data data;
-
-	ZERO_STRUCT(data);
+	struct asn1_data *data = asn1_init(mem_ctx);
 
-	if (!asn1_push_tag(&data, ASN1_SEQUENCE(0))) {
+	if (!asn1_push_tag(data, ASN1_SEQUENCE(0))) {
 		return False;
 	}
 
-	if (!asn1_write_enumerated(&data, lsrc->result)) {
+	if (!asn1_write_enumerated(data, lsrc->result)) {
 		return False;
 	}
 
 	if (lsrc->attr_desc) {
-		if (!asn1_write_OctetString(&data, lsrc->attr_desc, strlen(lsrc->attr_desc))) {
+		if (!asn1_write_OctetString(data, lsrc->attr_desc, strlen(lsrc->attr_desc))) {
 			return False;
 		}
 	}
 
-	if (!asn1_pop_tag(&data)) {
+	if (!asn1_pop_tag(data)) {
 		return False;
 	}
 
-	*out = data_blob_talloc(mem_ctx, data.data, data.length);
+	*out = data_blob_talloc(mem_ctx, data->data, data->length);
 	if (out->data == NULL) {
 		return False;
 	}
+	talloc_free(data);
 
 	return True;
 }
@@ -646,49 +645,48 @@ static BOOL encode_server_sort_response(void *mem_ctx, void *in, DATA_BLOB *out)
 static BOOL encode_server_sort_request(void *mem_ctx, void *in, DATA_BLOB *out)
 {
 	struct ldb_server_sort_control **lssc = talloc_get_type(in, struct ldb_server_sort_control *);
-	struct asn1_data data;
+	struct asn1_data *data = asn1_init(mem_ctx);
 	int num;
 
-	ZERO_STRUCT(data);
-
-	if (!asn1_push_tag(&data, ASN1_SEQUENCE(0))) {
+	if (!asn1_push_tag(data, ASN1_SEQUENCE(0))) {
 		return False;
 	}
 
 	for (num = 0; lssc[num]; num++) {
-		if (!asn1_push_tag(&data, ASN1_SEQUENCE(0))) {
+		if (!asn1_push_tag(data, ASN1_SEQUENCE(0))) {
 			return False;
 		}
 		
-		if (!asn1_write_OctetString(&data, lssc[num]->attributeName, strlen(lssc[num]->attributeName))) {
+		if (!asn1_write_OctetString(data, lssc[num]->attributeName, strlen(lssc[num]->attributeName))) {
 			return False;
 		}
 
 		if (lssc[num]->orderingRule) {
-			if (!asn1_write_OctetString(&data, lssc[num]->orderingRule, strlen(lssc[num]->orderingRule))) {
+			if (!asn1_write_OctetString(data, lssc[num]->orderingRule, strlen(lssc[num]->orderingRule))) {
 				return False;
 			}
 		}
 
 		if (lssc[num]->reverse) {
-			if (!asn1_write_BOOLEAN(&data, lssc[num]->reverse)) {
+			if (!asn1_write_BOOLEAN(data, lssc[num]->reverse)) {
 				return False;
 			}
 		}
 
-		if (!asn1_pop_tag(&data)) {
+		if (!asn1_pop_tag(data)) {
 			return False;
 		}
 	}
 
-	if (!asn1_pop_tag(&data)) {
+	if (!asn1_pop_tag(data)) {
 		return False;
 	}
 
-	*out = data_blob_talloc(mem_ctx, data.data, data.length);
+	*out = data_blob_talloc(mem_ctx, data->data, data->length);
 	if (out->data == NULL) {
 		return False;
 	}
+	talloc_free(data);
 
 	return True;
 }
@@ -696,26 +694,25 @@ static BOOL encode_server_sort_request(void *mem_ctx, void *in, DATA_BLOB *out)
 static BOOL encode_extended_dn_request(void *mem_ctx, void *in, DATA_BLOB *out)
 {
 	struct ldb_extended_dn_control *ledc = talloc_get_type(in, struct ldb_extended_dn_control);
-	struct asn1_data data;
-
-	ZERO_STRUCT(data);
+	struct asn1_data *data = asn1_init(mem_ctx);
 
-	if (!asn1_push_tag(&data, ASN1_SEQUENCE(0))) {
+	if (!asn1_push_tag(data, ASN1_SEQUENCE(0))) {
 		return False;
 	}
 
-	if (!asn1_write_Integer(&data, ledc->type)) {
+	if (!asn1_write_Integer(data, ledc->type)) {
 		return False;
 	}
 
-	if (!asn1_pop_tag(&data)) {
+	if (!asn1_pop_tag(data)) {
 		return False;
 	}
 
-	*out = data_blob_talloc(mem_ctx, data.data, data.length);
+	*out = data_blob_talloc(mem_ctx, data->data, data->length);
 	if (out->data == NULL) {
 		return False;
 	}
+	talloc_free(data);
 
 	return True;
 }
@@ -723,26 +720,25 @@ static BOOL encode_extended_dn_request(void *mem_ctx, void *in, DATA_BLOB *out)
 static BOOL encode_sd_flags_request(void *mem_ctx, void *in, DATA_BLOB *out)
 {
 	struct ldb_sd_flags_control *lsdfc = talloc_get_type(in, struct ldb_sd_flags_control);
-	struct asn1_data data;
+	struct asn1_data *data = asn1_init(mem_ctx);
 
-	ZERO_STRUCT(data);
-
-	if (!asn1_push_tag(&data, ASN1_SEQUENCE(0))) {
+	if (!asn1_push_tag(data, ASN1_SEQUENCE(0))) {
 		return False;
 	}
 
-	if (!asn1_write_Integer(&data, lsdfc->secinfo_flags)) {
+	if (!asn1_write_Integer(data, lsdfc->secinfo_flags)) {
 		return False;
 	}
 
-	if (!asn1_pop_tag(&data)) {
+	if (!asn1_pop_tag(data)) {
 		return False;
 	}
 
-	*out = data_blob_talloc(mem_ctx, data.data, data.length);
+	*out = data_blob_talloc(mem_ctx, data->data, data->length);
 	if (out->data == NULL) {
 		return False;
 	}
+	talloc_free(data);
 
 	return True;
 }
@@ -750,26 +746,25 @@ static BOOL encode_sd_flags_request(void *mem_ctx, void *in, DATA_BLOB *out)
 static BOOL encode_search_options_request(void *mem_ctx, void *in, DATA_BLOB *out)
 {
 	struct ldb_search_options_control *lsoc = talloc_get_type(in, struct ldb_search_options_control);
-	struct asn1_data data;
+	struct asn1_data *data = asn1_init(mem_ctx);
 
-	ZERO_STRUCT(data);
-
-	if (!asn1_push_tag(&data, ASN1_SEQUENCE(0))) {
+	if (!asn1_push_tag(data, ASN1_SEQUENCE(0))) {
 		return False;
 	}
 
-	if (!asn1_write_Integer(&data, lsoc->search_options)) {
+	if (!asn1_write_Integer(data, lsoc->search_options)) {
 		return False;
 	}
 
-	if (!asn1_pop_tag(&data)) {
+	if (!asn1_pop_tag(data)) {
 		return False;
 	}
 
-	*out = data_blob_talloc(mem_ctx, data.data, data.length);
+	*out = data_blob_talloc(mem_ctx, data->data, data->length);
 	if (out->data == NULL) {
 		return False;
 	}
+	talloc_free(data);
 
 	return True;
 }
@@ -777,30 +772,29 @@ static BOOL encode_search_options_request(void *mem_ctx, void *in, DATA_BLOB *ou
 static BOOL encode_paged_results_request(void *mem_ctx, void *in, DATA_BLOB *out)
 {
 	struct ldb_paged_control *lprc = talloc_get_type(in, struct ldb_paged_control);
-	struct asn1_data data;
+	struct asn1_data *data = asn1_init(mem_ctx);
 
-	ZERO_STRUCT(data);
-
-	if (!asn1_push_tag(&data, ASN1_SEQUENCE(0))) {
+	if (!asn1_push_tag(data, ASN1_SEQUENCE(0))) {
 		return False;
 	}
 
-	if (!asn1_write_Integer(&data, lprc->size)) {
+	if (!asn1_write_Integer(data, lprc->size)) {
 		return False;
 	}
 
-	if (!asn1_write_OctetString(&data, lprc->cookie, lprc->cookie_len)) {
+	if (!asn1_write_OctetString(data, lprc->cookie, lprc->cookie_len)) {
 		return False;
 	}	
 
-	if (!asn1_pop_tag(&data)) {
+	if (!asn1_pop_tag(data)) {
 		return False;
 	}
 
-	*out = data_blob_talloc(mem_ctx, data.data, data.length);
+	*out = data_blob_talloc(mem_ctx, data->data, data->length);
 	if (out->data == NULL) {
 		return False;
 	}
+	talloc_free(data);
 
 	return True;
 }
@@ -811,33 +805,32 @@ static BOOL encode_paged_results_request(void *mem_ctx, void *in, DATA_BLOB *out
 static BOOL encode_asq_control(void *mem_ctx, void *in, DATA_BLOB *out)
 {
 	struct ldb_asq_control *lac = talloc_get_type(in, struct ldb_asq_control);
-	struct asn1_data data;
+	struct asn1_data *data = asn1_init(mem_ctx);
 
-	ZERO_STRUCT(data);
-
-	if (!asn1_push_tag(&data, ASN1_SEQUENCE(0))) {
+	if (!asn1_push_tag(data, ASN1_SEQUENCE(0))) {
 		return False;
 	}
 
 	if (lac->request) {
 
-		if (!asn1_write_OctetString(&data, lac->source_attribute, lac->src_attr_len)) {
+		if (!asn1_write_OctetString(data, lac->source_attribute, lac->src_attr_len)) {
 			return False;
 		}
 	} else {
-		if (!asn1_write_enumerated(&data, lac->result)) {
+		if (!asn1_write_enumerated(data, lac->result)) {
 			return False;
 		}
 	}
 
-	if (!asn1_pop_tag(&data)) {
+	if (!asn1_pop_tag(data)) {
 		return False;
 	}
 
-	*out = data_blob_talloc(mem_ctx, data.data, data.length);
+	*out = data_blob_talloc(mem_ctx, data->data, data->length);
 	if (out->data == NULL) {
 		return False;
 	}
+	talloc_free(data);
 
 	return True;
 }
@@ -845,34 +838,33 @@ static BOOL encode_asq_control(void *mem_ctx, void *in, DATA_BLOB *out)
 static BOOL encode_dirsync_request(void *mem_ctx, void *in, DATA_BLOB *out)
 {
 	struct ldb_dirsync_control *ldc = talloc_get_type(in, struct ldb_dirsync_control);
-	struct asn1_data data;
+	struct asn1_data *data = asn1_init(mem_ctx);
 
-	ZERO_STRUCT(data);
-
-	if (!asn1_push_tag(&data, ASN1_SEQUENCE(0))) {
+	if (!asn1_push_tag(data, ASN1_SEQUENCE(0))) {
 		return False;
 	}
 
-	if (!asn1_write_Integer(&data, ldc->flags)) {
+	if (!asn1_write_Integer(data, ldc->flags)) {
 		return False;
 	}
 
-	if (!asn1_write_Integer(&data, ldc->max_attributes)) {
+	if (!asn1_write_Integer(data, ldc->max_attributes)) {
 		return False;
 	}
 
-	if (!asn1_write_OctetString(&data, ldc->cookie, ldc->cookie_len)) {
+	if (!asn1_write_OctetString(data, ldc->cookie, ldc->cookie_len)) {
 		return False;
 	}	
 
-	if (!asn1_pop_tag(&data)) {
+	if (!asn1_pop_tag(data)) {
 		return False;
 	}
 
-	*out = data_blob_talloc(mem_ctx, data.data, data.length);
+	*out = data_blob_talloc(mem_ctx, data->data, data->length);
 	if (out->data == NULL) {
 		return False;
 	}
+	talloc_free(data);
 
 	return True;
 }
@@ -930,74 +922,73 @@ static BOOL encode_manageDSAIT_request(void *mem_ctx, void *in, DATA_BLOB *out)
 static BOOL encode_vlv_request(void *mem_ctx, void *in, DATA_BLOB *out)
 {
 	struct ldb_vlv_req_control *lvrc = talloc_get_type(in, struct ldb_vlv_req_control);
-	struct asn1_data data;
+	struct asn1_data *data = asn1_init(mem_ctx);
 
-	ZERO_STRUCT(data);
-
-	if (!asn1_push_tag(&data, ASN1_SEQUENCE(0))) {
+	if (!asn1_push_tag(data, ASN1_SEQUENCE(0))) {
 		return False;
 	}
 
-	if (!asn1_write_Integer(&data, lvrc->beforeCount)) {
+	if (!asn1_write_Integer(data, lvrc->beforeCount)) {
 		return False;
 	}
 
-	if (!asn1_write_Integer(&data, lvrc->afterCount)) {
+	if (!asn1_write_Integer(data, lvrc->afterCount)) {
 		return False;
 	}
 
 	if (lvrc->type == 0) {
-		if (!asn1_push_tag(&data, ASN1_CONTEXT(0))) {
+		if (!asn1_push_tag(data, ASN1_CONTEXT(0))) {
 			return False;
 		}
 		
-		if (!asn1_push_tag(&data, ASN1_SEQUENCE(0))) {
+		if (!asn1_push_tag(data, ASN1_SEQUENCE(0))) {
 			return False;
 		}
 		
-		if (!asn1_write_Integer(&data, lvrc->match.byOffset.offset)) {
+		if (!asn1_write_Integer(data, lvrc->match.byOffset.offset)) {
 			return False;
 		}
 
-		if (!asn1_write_Integer(&data, lvrc->match.byOffset.contentCount)) {
+		if (!asn1_write_Integer(data, lvrc->match.byOffset.contentCount)) {
 			return False;
 		}
 
-		if (!asn1_pop_tag(&data)) { /*SEQUENCE*/
+		if (!asn1_pop_tag(data)) { /*SEQUENCE*/
 			return False;
 		}
 
-		if (!asn1_pop_tag(&data)) { /*CONTEXT*/
+		if (!asn1_pop_tag(data)) { /*CONTEXT*/
 			return False;
 		}
 	} else {
-		if (!asn1_push_tag(&data, ASN1_CONTEXT(1))) {
+		if (!asn1_push_tag(data, ASN1_CONTEXT(1))) {
 			return False;
 		}
 		
-		if (!asn1_write_OctetString(&data, lvrc->match.gtOrEq.value, lvrc->match.gtOrEq.value_len)) {
+		if (!asn1_write_OctetString(data, lvrc->match.gtOrEq.value, lvrc->match.gtOrEq.value_len)) {
 			return False;
 		}
 
-		if (!asn1_pop_tag(&data)) { /*CONTEXT*/
+		if (!asn1_pop_tag(data)) { /*CONTEXT*/
 			return False;
 		}
 	}
 
 	if (lvrc->ctxid_len) {
-		if (!asn1_write_OctetString(&data, lvrc->contextId, lvrc->ctxid_len)) {
+		if (!asn1_write_OctetString(data, lvrc->contextId, lvrc->ctxid_len)) {
 			return False;
 		}
 	}
 
-	if (!asn1_pop_tag(&data)) {
+	if (!asn1_pop_tag(data)) {
 		return False;
 	}
 
-	*out = data_blob_talloc(mem_ctx, data.data, data.length);
+	*out = data_blob_talloc(mem_ctx, data->data, data->length);
 	if (out->data == NULL) {
 		return False;
 	}
+	talloc_free(data);
 
 	return True;
 }
@@ -1005,40 +996,39 @@ static BOOL encode_vlv_request(void *mem_ctx, void *in, DATA_BLOB *out)
 static BOOL encode_vlv_response(void *mem_ctx, void *in, DATA_BLOB *out)
 {
 	struct ldb_vlv_resp_control *lvrc = talloc_get_type(in, struct ldb_vlv_resp_control);
-	struct asn1_data data;
+	struct asn1_data *data = asn1_init(mem_ctx);
 
-	ZERO_STRUCT(data);
-
-	if (!asn1_push_tag(&data, ASN1_SEQUENCE(0))) {
+	if (!asn1_push_tag(data, ASN1_SEQUENCE(0))) {
 		return False;
 	}
 
-	if (!asn1_write_Integer(&data, lvrc->targetPosition)) {
+	if (!asn1_write_Integer(data, lvrc->targetPosition)) {
 		return False;
 	}
 
-	if (!asn1_write_Integer(&data, lvrc->contentCount)) {
+	if (!asn1_write_Integer(data, lvrc->contentCount)) {
 		return False;
 	}
 
-	if (!asn1_write_enumerated(&data, lvrc->vlv_result)) {
+	if (!asn1_write_enumerated(data, lvrc->vlv_result)) {
 		return False;
 	}
 
 	if (lvrc->ctxid_len) {
-		if (!asn1_write_OctetString(&data, lvrc->contextId, lvrc->ctxid_len)) {
+		if (!asn1_write_OctetString(data, lvrc->contextId, lvrc->ctxid_len)) {
 			return False;
 		}
 	}
 
-	if (!asn1_pop_tag(&data)) {
+	if (!asn1_pop_tag(data)) {
 		return False;
 	}
 
-	*out = data_blob_talloc(mem_ctx, data.data, data.length);
+	*out = data_blob_talloc(mem_ctx, data->data, data->length);
 	if (out->data == NULL) {
 		return False;
 	}
+	talloc_free(data);
 
 	return True;
 }
@@ -1093,7 +1083,7 @@ BOOL ldap_decode_control_wrapper(void *mem_ctx, struct asn1_data *data, struct l
 		return False;
 	}
 
-	if (!asn1_read_OctetString(data, &oid)) {
+	if (!asn1_read_OctetString(data, mem_ctx, &oid)) {
 		return False;
 	}
 	ctrl->oid = talloc_strndup(mem_ctx, (char *)oid.data, oid.length);
@@ -1117,7 +1107,7 @@ BOOL ldap_decode_control_wrapper(void *mem_ctx, struct asn1_data *data, struct l
 		goto end_tag;
 	}
 
-	if (!asn1_read_OctetString(data, value)) {
+	if (!asn1_read_OctetString(data, mem_ctx, value)) {
 		return False;
 	}