clean up sprintf usage and many other flawfinder issues; clean up compiler warnings on Linux; remove pam_passthru from DS 7.1

author: Rich Megginson <rmeggins@redhat.com> 2005-03-05 04:29:24 +0000
committer: Rich Megginson <rmeggins@redhat.com> 2005-03-05 04:29:24 +0000
commit: b352660e243c7b9b7d050f1c38cff1c9faf278b1 (patch)
tree: ede08019beb931c3206609ab2377a015d510bdb4
parent: f08951680ddfebc3f3df07e720ad0650fe473c0f (diff)
download: ds-b352660e243c7b9b7d050f1c38cff1c9faf278b1.tar.gz
ds-b352660e243c7b9b7d050f1c38cff1c9faf278b1.tar.xz
ds-b352660e243c7b9b7d050f1c38cff1c9faf278b1.zip
222 files changed, 1373 insertions, 2181 deletions
diff --git a/include/base/systems.h b/include/base/systems.h
index 21fab372..1e77faf2 100644
--- a/include/base/systems.h
+++ b/include/base/systems.h
@@ -298,8 +298,6 @@
 #define HAS_STATFS
 #define JAVA_STATIC_LINK
 #define SA_HANDLER_T(x) (void (*)(int))(x)
-#define SA_NOCLDWAIT 0 /* Linux doesn't have this */
-#define TCPLEN_T size_t
 
 #undef NEED_CRYPT_PROTO
 #define NET_SOCKETS
diff --git a/include/public/base/systems.h b/include/public/base/systems.h
index 2783aff0..64ccd05d 100644
--- a/include/public/base/systems.h
+++ b/include/public/base/systems.h
@@ -225,10 +225,6 @@ typedef void* PASSWD;
 #endif /* __cplusplus */
 #endif /* !NSPR_BEGIN_EXTERN_C */
 
-#ifndef TCPLEN_T
-#define TCPLEN_T int
-#endif
-
 #ifndef NSAPI_PUBLIC
 #define NSAPI_PUBLIC
 #endif /* !NSAPI_PUBLIC */
diff --git a/ldap/Makefile b/ldap/Makefile
index 94b2e0ad..9328b632 100644
--- a/ldap/Makefile
+++ b/ldap/Makefile
@@ -83,13 +83,3 @@ endif
 	cd clients/tools; $(MAKE) $(MFLAGS) clean
 
 veryclean:	clean
-
-$(LDAP_LIBDIR):
-	$(MKDIR) $(LDAP_LIBDIR)
-
-$(LDAP_BINDIR):
-	$(MKDIR) $(LDAP_BINDIR)
-
-$(LDAP_OBJDIR):
-	$(MKDIR) $(LDAP_OBJDIR)
-
diff --git a/ldap/admin/include/Makefile b/ldap/admin/include/Makefile
index 22b331eb..9d550875 100644
--- a/ldap/admin/include/Makefile
+++ b/ldap/admin/include/Makefile
@@ -25,9 +25,6 @@ BINS=$(addprefix $(HDRDEST)/,$(HEADERS))
 
 all: $(HDRDEST) $(BINS) 
 
-$(HDRDEST):
-	$(MKDIR) $(HDRDEST)
-
 strip:
 depend:
 
diff --git a/ldap/admin/lib/Makefile b/ldap/admin/lib/Makefile
index 7f5e7011..a7c35ced 100644
--- a/ldap/admin/lib/Makefile
+++ b/ldap/admin/lib/Makefile
@@ -29,10 +29,7 @@ SRCS	= dsalib_location.c dsalib_debug.c dsalib_updown.c dsalib_tailf.c \
 	dsalib_ldif.c dsalib_db.c dsalib_conf.c dsalib_html.c \
 	dsalib_filename.c dsalib_util.c dsalib_dn.c dsalib_confs.c dsalib_pw.c
 
-PWDOBJ=$(OBJDIR)/lib/libpwdstorage/ssha_pwd.o
-
-OBJS1 = $(addprefix $(OBJDEST)/, $(subst .c,.o,$(SRCS)))
-OBJS = $(OBJS1)  $(PWDOBJ)
+OBJS = $(addprefix $(OBJDEST)/, $(subst .c,.o,$(SRCS)))
 
 INCLUDES += -I$(LDAP_SRC)/admin/include
 ifdef FORTEZZA
@@ -95,13 +92,13 @@ endif
 veryclean: clean
 
 clean:
-	-$(RM) $(OBJS1)
+	-$(RM) $(OBJS)
 	-$(RM) $(LIBS)
 ifeq ($(ARCH), WINNT)
 	-$(RM) $(IMPLIB)
 endif
 
-$(OBJS1): $(OBJDEST)/%.o: %.c 
+$(OBJS): $(OBJDEST)/%.o: %.c 
 	$(CC) -c $(NONSHARED) $(CFLAGS) $(MCC_INCLUDE) $(OFFLAG)$(OBJDEST)/$*.o $*.c
 ifdef USE_LINT
 	$(LINT) $(LINTCCFLAGS) $(DEFS) $(MCC_SERVER) $(INCLUDES) $(MCC_INCLUDE) $*.c > $(OBJDEST)/$*.ln 2>&1
diff --git a/ldap/admin/lib/dsalib_conf.c b/ldap/admin/lib/dsalib_conf.c
index c9156020..0a03efdb 100644
--- a/ldap/admin/lib/dsalib_conf.c
+++ b/ldap/admin/lib/dsalib_conf.c
@@ -17,6 +17,8 @@
 #include "portable.h"
 #include <ctype.h>
 
+#include "nspr.h"
+
 #define CONF_FILE_NAME "config/dse.ldif"
 #define CONF_SUFFIX "cn=config"
 
@@ -49,7 +51,7 @@ ds_get_config(int type)
         return(NULL);
     }
 
-    sprintf(conffile, "%s/%s", root, CONF_FILE_NAME);
+    PR_snprintf(conffile, PATH_MAX, "%s/%s", root, CONF_FILE_NAME);
 
     if ( !(sf = fopen(conffile, "r")) )  {
         ds_send_error("could not read config file.", 1);
diff --git a/ldap/admin/lib/dsalib_confs.c b/ldap/admin/lib/dsalib_confs.c
index 565315dd..0545e2be 100644
--- a/ldap/admin/lib/dsalib_confs.c
+++ b/ldap/admin/lib/dsalib_confs.c
@@ -17,6 +17,7 @@
 #include <string.h>
 #include <ldif.h>
 #include <ctype.h>
+#include "nspr.h"
 #include "plstr.h"
 
 /*
@@ -32,11 +33,11 @@ ds_get_conf_from_file(FILE *conf)
     char *entry = 0;
     int lineno = 0;
 
-    while (entry = ldif_get_entry(conf, &lineno)) {
+    while ((entry = ldif_get_entry(conf, &lineno))) {
 	char *begin = entry;
 	if (!PL_strncasecmp(entry, config_entry, cfg_ent_len)) {
 	    char *line = entry;
-	    while (line = ldif_getline(&entry)) {
+	    while ((line = ldif_getline(&entry))) {
 		listsize++;
 		conf_list = (char **) realloc(conf_list, 
 					      ((listsize + 1) * sizeof(char *)));
@@ -120,6 +121,9 @@ ds_get_value(char **ds_config, char *parm, int phase, int occurance)
 			value = tmpvalue;
 		    }
 		    free(tmpline);
+			if (errmsg) {
+				PR_smprintf_free(errmsg);
+			}
 		    return value;
 		}
         }
diff --git a/ldap/admin/lib/dsalib_db.c b/ldap/admin/lib/dsalib_db.c
index dbef2a6f..dd483d33 100644
--- a/ldap/admin/lib/dsalib_db.c
+++ b/ldap/admin/lib/dsalib_db.c
@@ -22,6 +22,7 @@
 #define pclose _pclose
 #endif
 #include "portable.h"
+#include "nspr.h"
 
 /*
  * Get a listing of backup directories
@@ -42,7 +43,7 @@ ds_get_bak_dirs()
         return(bak_dirs);
     }
 
-    sprintf( format_str, "%s%cbak", root, FILE_SEP );
+    PR_snprintf( format_str, PATH_MAX, "%s%cbak", root, FILE_SEP );
 	bak_dirs = ds_get_file_list( format_str );
 	if( bak_dirs )
 	{
@@ -50,7 +51,7 @@ ds_get_bak_dirs()
 		{
 			/* Prepend the filename with the install root */
 			char filename[PATH_MAX];
-			sprintf( filename, "%s%cbak%c%s", root, FILE_SEP,
+			PR_snprintf( filename, PATH_MAX, "%s%cbak%c%s", root, FILE_SEP,
 					 FILE_SEP, bak_dirs[i] );
 			free( bak_dirs[i] );
 			bak_dirs[i] = strdup( filename );
@@ -103,8 +104,8 @@ ds_bak2db(char *file)
     }
 
     tmp_dir = ds_get_tmp_dir();
-    sprintf(statfile, "%s%cbak2db.%d", tmp_dir, FILE_SEP, (int)getpid());
-    sprintf(startup_line,
+    PR_snprintf(statfile, PATH_MAX, "%s%cbak2db.%d", tmp_dir, FILE_SEP, (int)getpid());
+    PR_snprintf(startup_line, BIG_LINE,
 			"%s%cbak2db "
 			"%s%s%s > "
 			"%s%s%s 2>&1",
@@ -169,7 +170,7 @@ ds_db2bak(char *file)
         file = NULL;
 
 	tmp_dir = ds_get_tmp_dir();
-    sprintf(statfile, "%s%cdb2bak.%d", tmp_dir, FILE_SEP, (int)getpid());
+    PR_snprintf(statfile, PATH_MAX, "%s%cdb2bak.%d", tmp_dir, FILE_SEP, (int)getpid());
 	
 					
 #if defined( XP_WIN32 )
@@ -178,7 +179,7 @@ ds_db2bak(char *file)
 		file = malloc( BIG_LINE );
 
 		time( &ltime );
-		sprintf( file, "%s", ctime( &ltime ) );
+		PR_snprintf( file, BIG_LINE, "%s", ctime( &ltime ) );
 		ds_timetofname( file );
 	}
 
@@ -204,7 +205,7 @@ ds_db2bak(char *file)
  */
 
 
-    sprintf(startup_line,
+    PR_snprintf(startup_line, sizeof(startup_line),
 			"%s%cdb2bak "
 			"%s%s%s > "
 			"%s%s%s 2>&1",
@@ -321,7 +322,7 @@ ds_vlvindex(char **backendList, char **vlvList)
         return DS_NO_SERVER_ROOT;
     }
 
-    sprintf(startup_line, "%s/bin/slapd/server/%s db2index "
+    PR_snprintf(startup_line, sizeof(startup_line), "%s/bin/slapd/server/%s db2index "
 			"-D %s%s/%s "
 			"-n %s ",
 			root, SLAPD_NAME,			
@@ -332,7 +333,7 @@ ds_vlvindex(char **backendList, char **vlvList)
 	/* Create vlv TAG */
 	vlvc=vlvList;
 	while( *vlvc != NULL ) {
-		sprintf( startup_line, "%s -T %s%s%s", startup_line,"\"",*vlvc,"\"" );
+		PR_snprintf( startup_line, sizeof(startup_line), "%s -T %s%s%s", startup_line,"\"",*vlvc,"\"" );
 		vlvc++;
 	}	
    
@@ -358,7 +359,7 @@ ds_addindex(char **attrList, char *backendName)
         return DS_NO_SERVER_ROOT;
     }
 
-	sprintf(startup_line, "%s/bin/slapd/server/%s db2index "
+	PR_snprintf(startup_line, sizeof(startup_line), "%s/bin/slapd/server/%s db2index "
 			"-D %s%s%s "
 			"-n %s",
 			root, SLAPD_NAME,			
@@ -366,7 +367,7 @@ ds_addindex(char **attrList, char *backendName)
 			backendName);
 
 	while( *attrList != NULL ) {
-		sprintf( startup_line, "%s -t %s", startup_line, *attrList );
+		PR_snprintf( startup_line, sizeof(startup_line), "%s -t %s", startup_line, *attrList );
 		attrList++;
 	}
 
diff --git a/ldap/admin/lib/dsalib_debug.c b/ldap/admin/lib/dsalib_debug.c
index fd0ae631..797b84dc 100644
--- a/ldap/admin/lib/dsalib_debug.c
+++ b/ldap/admin/lib/dsalib_debug.c
@@ -10,6 +10,7 @@
 #include <stdio.h>
 #include <string.h>
 #include <stdlib.h>
+#include "nspr.h"
 
 #if defined( XP_WIN32 )
 int ldap_debug = 0;
@@ -39,7 +40,7 @@ ds_log_env(char **envp)
         for ( i = 0; envp[i] != (char *) 0; i++ ) {
             char        envstr[200];
  
-            sprintf(envstr, "%s\n", envp[i]);
+            PR_snprintf(envstr, sizeof(envstr), "%s\n", envp[i]);
             fwrite(envstr, strlen(envstr), 1, file);
         }
         fclose(file);
diff --git a/ldap/admin/lib/dsalib_filename.c b/ldap/admin/lib/dsalib_filename.c
index bce6e3f4..6007176c 100644
--- a/ldap/admin/lib/dsalib_filename.c
+++ b/ldap/admin/lib/dsalib_filename.c
@@ -12,6 +12,8 @@
 #include <stdlib.h>
 #include <ctype.h>
 
+#include "nspr.h"
+
 static char *
 get_month_str(int month)
 {
@@ -89,7 +91,7 @@ ds_get_file_meaning(char *file)
         return(NULL);
     if ( (sec < 0) || (sec > 60) )
         return(NULL);
-    sprintf(meaning, "%s % 2d %02d:%02d:%02d %4d", get_month_str(month), 
+    PR_snprintf(meaning, sizeof(meaning), "%s % 2d %02d:%02d:%02d %4d", get_month_str(month), 
 	day, hour, minute, sec, year);
     return(meaning);
 }
diff --git a/ldap/admin/lib/dsalib_html.c b/ldap/admin/lib/dsalib_html.c
index 5ed44f0c..2732e225 100644
--- a/ldap/admin/lib/dsalib_html.c
+++ b/ldap/admin/lib/dsalib_html.c
@@ -26,11 +26,6 @@ static char **input = 0;
 */
 static int formattedOutput = 1;
 
-/* This is the separator string to use when outputting key/value pairs
-   to be read by the non-HTML front end (Java console)
-*/
-static const char *SEPARATOR = ":"; /* from AdmTask.java */
-
 DS_EXPORT_SYMBOL int
 ds_get_formatted_output(void)
 {
diff --git a/ldap/admin/lib/dsalib_ldif.c b/ldap/admin/lib/dsalib_ldif.c
index 262cbc9c..3a126ce8 100644
--- a/ldap/admin/lib/dsalib_ldif.c
+++ b/ldap/admin/lib/dsalib_ldif.c
@@ -19,6 +19,7 @@
 #include <stdlib.h>
 #include <string.h>
 #include <errno.h>
+#include "nspr.h"
 
 #ifndef XP_WIN32
 #define SCRIPT_SUFFIX "" /* shell scripts have no suffix */
@@ -163,21 +164,21 @@ importldif(char *file, int preserve, char *backend, char *subtree)
     }
 
 	if ( preserve ) {
-		sprintf(startup_line, "%s%cldif2db%s -i %s%s%s",
+		PR_snprintf(startup_line, BIG_LINE, "%s%cldif2db%s -i %s%s%s",
 				root, FILE_SEP, SCRIPT_SUFFIX,
 				ENQUOTE, file, ENQUOTE);
 	} else if (backend) {
-		sprintf(startup_line, "%s%cldif2db%s -n %s%s%s -i %s%s%s",
+		PR_snprintf(startup_line, BIG_LINE, "%s%cldif2db%s -n %s%s%s -i %s%s%s",
 				root, FILE_SEP, SCRIPT_SUFFIX,
 				ENQUOTE, backend, ENQUOTE,
 				ENQUOTE, file, ENQUOTE);
 	} else if (subtree) {
-		sprintf(startup_line, "%s%cldif2db%s -s %s%s%s -i %s%s%s",
+		PR_snprintf(startup_line, BIG_LINE, "%s%cldif2db%s -s %s%s%s -i %s%s%s",
 				root, FILE_SEP, SCRIPT_SUFFIX,
 				ENQUOTE, subtree, ENQUOTE,
 				ENQUOTE, file, ENQUOTE);
 	} else {
-		sprintf(startup_line, "%s%cldif2db%s -i %s%s%s -noconfig",
+		PR_snprintf(startup_line, BIG_LINE, "%s%cldif2db%s -i %s%s%s -noconfig",
 				root, FILE_SEP, SCRIPT_SUFFIX,
 				ENQUOTE, file, ENQUOTE);
 	}
@@ -206,13 +207,13 @@ importldif(char *file, int preserve, char *backend, char *subtree)
 			char sbuf[ BIG_LINE ];
 			char filename[ BIG_LINE ];
 			if ( strlen( db_files[ i ]) > 0 ) {
-				sprintf( filename, "%s%c%s", changelogdir,
+				PR_snprintf( filename, BIG_LINE, "%s%c%s", changelogdir,
 						 FILE_SEP, db_files[ i ]);
-				sprintf(sbuf, "Removing %s", filename);
+				PR_snprintf(sbuf, BIG_LINE, "Removing %s", filename);
 				ds_send_status( sbuf );
 				rc = unlink( filename);
 				if ( rc != 0 ) {
-					sprintf( errbuf, "Warning: some files in %s could not "
+					PR_snprintf( errbuf, BIG_LINE, "Warning: some files in %s could not "
 							 "be removed\n", changelogdir );
 					haderror++;
 				}
@@ -285,7 +286,7 @@ ds_db2ldif_subtree(char *file, char *subtree)
         file = NULL;
 
 	tmp_dir = ds_get_tmp_dir();
-	sprintf(statfile, "%s%cdb2ldif.%d", tmp_dir, FILE_SEP, (int) getpid());
+	PR_snprintf(statfile, PATH_MAX, "%s%cdb2ldif.%d", tmp_dir, FILE_SEP, (int) getpid());
 
 #if defined( XP_WIN32 )
 	if( file == NULL )
@@ -294,7 +295,7 @@ ds_db2ldif_subtree(char *file, char *subtree)
 		file = malloc( BIG_LINE );
 
 		time( &ltime );
-		sprintf( file, "%s", ctime( &ltime ) );
+		PR_snprintf( file, BIG_LINE, "%s", ctime( &ltime ) );
 		ds_timetofname( file );
 	}
 #endif
@@ -304,13 +305,13 @@ ds_db2ldif_subtree(char *file, char *subtree)
 	else
 		strcpy( outfile, file );
 
-	sprintf(scriptfile, "%s%cdb2ldif", root, FILE_SEP);
+	PR_snprintf(scriptfile, PATH_MAX, "%s%cdb2ldif", root, FILE_SEP);
 
 	PATH_FOR_PLATFORM( outfile );
 	PATH_FOR_PLATFORM( scriptfile );
 
 	if ( subtree == NULL ) {
-		sprintf(startup_line,
+		PR_snprintf(startup_line, sizeof(startup_line),
 				"%s "
 				"%s%s%s > "
 				"%s%s%s 2>&1",
@@ -318,7 +319,7 @@ ds_db2ldif_subtree(char *file, char *subtree)
 				ENQUOTE, outfile, ENQUOTE,
 				ENQUOTE, statfile, ENQUOTE);
 	} else {
-		sprintf(startup_line,
+		PR_snprintf(startup_line, sizeof(startup_line),
 				"%s "
 				"%s%s%s "
 				"-s \"%s\" > "
diff --git a/ldap/admin/lib/dsalib_location.c b/ldap/admin/lib/dsalib_location.c
index 53dc5a2f..600cc19c 100644
--- a/ldap/admin/lib/dsalib_location.c
+++ b/ldap/admin/lib/dsalib_location.c
@@ -10,6 +10,7 @@
 #include <stdio.h>
 #include <string.h>
 #include <stdlib.h>
+#include "nspr.h"
 
 /*
  * Returns the server root. Info is 
@@ -48,7 +49,7 @@ ds_get_install_root()
     if ( (ds_name = ds_get_server_name()) == NULL )
         return(NULL);
 
-    sprintf(install_root, "%s/%s", root, ds_name);
+    PR_snprintf(install_root, sizeof(install_root), "%s/%s", root, ds_name);
     return(install_root);
 }
 
@@ -67,7 +68,7 @@ ds_get_admserv_based_root()
         return(NULL);
     if ( (ds_name = ds_get_server_name()) == NULL )
         return(NULL);
-    sprintf(install_root, "%s/%s", root, ds_name);
+    PR_snprintf(install_root, sizeof(install_root), "%s/%s", root, ds_name);
     return(install_root);
 }
 
@@ -96,7 +97,7 @@ ds_get_logfile_name(int config_type)
 {
     char        *filename;
     char	**ds_config = NULL;
-    static char logfile[PATH_MAX];
+    static char logfile[PATH_MAX+1];
  
     if ( (ds_config = ds_get_config(DS_REAL_CONFIG)) == NULL ) {
 		/* For DS 4.0, no error output if file doesn't exist - that's
@@ -117,7 +118,7 @@ ds_get_logfile_name(int config_type)
 		free(filename);
         return(NULL);
     }
-    strcpy(logfile, filename);
+    strncpy(logfile, filename, PATH_MAX);
 	free(filename);
     return(logfile);
 }
diff --git a/ldap/admin/lib/dsalib_pw.c b/ldap/admin/lib/dsalib_pw.c
index 6b224514..4c560c92 100644
--- a/ldap/admin/lib/dsalib_pw.c
+++ b/ldap/admin/lib/dsalib_pw.c
@@ -20,7 +20,112 @@
 #include "dsalib.h"
 #include "dsalib_pw.h"
 
-extern char * salted_sha1_pw_enc(char *);
+#include "prtime.h"
+#include "prlong.h"
+#include "prmem.h"
+
+#if defined(NET_SSL)
+#include <pk11func.h>
+#include <pk11pqg.h>
+#endif /* NET_SSL */
+
+#define SHA1_SALT_LENGTH    8   /* number of bytes of data in salt */
+#define PWD_HASH_PREFIX_START   '{'
+#define PWD_HASH_PREFIX_END '}'
+
+#define SALTED_SHA1_SCHEME_NAME "SSHA"
+#define SALTED_SHA1_NAME_LEN        4
+
+/*
+  WARNING:  The following code is blatantly copied from the server
+  pwdstorage ssha_pwd.c plugin.  It would be nice to share this
+  code with the server.  The problem is that the server wants to
+  use slapi_ch_malloc to allocate the memory for the returned
+  password - this function is not available outside the server
+  (as in the setup programs that also want to hash the password)
+  We need to figure out a way to put this code into a library
+  in such a way that the memory allocation functions to use
+  can be passed in or set beforehand.
+*/
+
+static void
+ssha_rand_array(void *randx, size_t len)
+{
+    PK11_RandomUpdate(randx, len);
+    PK11_GenerateRandom((unsigned char *)randx, (int)len);
+}
+
+/*
+ * A salted SHA1 hash
+ * if salt is null, no salt is used (this is for backward compatibility)
+*/
+SECStatus
+sha1_salted_hash(unsigned char *hash_out, char *pwd, struct berval *salt)
+{
+    PK11Context *ctx;
+    unsigned int outLen;
+    SECStatus rc;
+
+    if (salt && salt->bv_len) {
+        ctx = PK11_CreateDigestContext(SEC_OID_SHA1);
+		if (ctx == NULL) {
+			rc = SECFailure;
+		}
+		else {
+        	PK11_DigestBegin(ctx);
+        	PK11_DigestOp(ctx, (unsigned char*)pwd, strlen(pwd));
+        	PK11_DigestOp(ctx, (unsigned char*)(salt->bv_val), salt->bv_len);
+        	PK11_DigestFinal(ctx, hash_out, &outLen, SHA1_LENGTH);
+        	PK11_DestroyContext(ctx, 1);
+        	if (outLen == SHA1_LENGTH)
+            	rc = SECSuccess;
+        	else
+            	rc = SECFailure;
+		}
+    }
+    else {
+        /*backward compatibility*/
+        rc = PK11_HashBuf(SEC_OID_SHA1, hash_out, (unsigned char *)pwd, strlen(pwd));
+    }
+
+    return rc;
+}
+
+char *
+salted_sha1_pw_enc( char *pwd )
+{
+    unsigned char hash[ SHA1_LENGTH + SHA1_SALT_LENGTH ];
+    unsigned char *salt = hash + SHA1_LENGTH;
+    struct berval saltval;
+    char *enc;
+
+    saltval.bv_val = (void*)salt;
+    saltval.bv_len = SHA1_SALT_LENGTH;
+
+    /* generate a new random salt */
+	/* Note: the uninitialized salt array provides a little extra entropy
+	 * to the random array generation, but it is not really needed since
+	 * PK11_GenerateRandom takes care of seeding. In any case, it doesn't
+	 * hurt. */
+	ssha_rand_array( salt, SHA1_SALT_LENGTH );
+
+    /* SHA1 hash the user's key */
+    if ( sha1_salted_hash( hash, pwd, &saltval ) != SECSuccess ) {
+        return( NULL );
+    }
+
+    if (( enc = PR_Malloc( 3 + SALTED_SHA1_NAME_LEN +
+        LDIF_BASE64_LEN(sizeof(hash)))) == NULL ) {
+        return( NULL );
+    }
+
+    sprintf( enc, "%c%s%c", PWD_HASH_PREFIX_START, SALTED_SHA1_SCHEME_NAME,
+        PWD_HASH_PREFIX_END );
+    (void)ldif_base64_encode( hash, enc + 2 + SALTED_SHA1_NAME_LEN,
+        sizeof(hash), -1 );
+
+    return( enc );
+}
 
 DS_EXPORT_SYMBOL char *
 ds_salted_sha1_pw_enc (char* pwd)
diff --git a/ldap/admin/lib/dsalib_updown.c b/ldap/admin/lib/dsalib_updown.c
index e151e963..b737406d 100644
--- a/ldap/admin/lib/dsalib_updown.c
+++ b/ldap/admin/lib/dsalib_updown.c
@@ -58,7 +58,7 @@ ds_get_updown_status()
 		fprintf(stderr, "ds_get_updown_status: could not get install root\n");
         return(DS_SERVER_UNKNOWN);
 	}
-    sprintf(pid_file_name, "%s/logs/pid", root);
+    PR_snprintf(pid_file_name, BIG_LINE, "%s/logs/pid", root);
     pidfile = fopen(pid_file_name, "r");
     if ( pidfile == NULL ) {
 /*
@@ -147,9 +147,9 @@ ds_bring_up_server_install(int verbose, char *root, char *errorlog)
 
 #if !defined( XP_WIN32 )
     tmp_dir = ds_get_tmp_dir();
-    sprintf(statfile, "%s%cstartup.%d", tmp_dir, FILE_SEP, (int)getpid());
+    PR_snprintf(statfile, PATH_MAX, "%s%cstartup.%d", tmp_dir, FILE_SEP, (int)getpid());
 
-    sprintf(startup_line, "%s%c%s > %s 2>&1",
+    PR_snprintf(startup_line, BIG_LINE, "%s%c%s > %s 2>&1",
 			root, FILE_SEP, START_SCRIPT, statfile);
     alter_startup_line(startup_line);
     error = system(startup_line);
@@ -244,7 +244,7 @@ ds_bring_up_server_install(int verbose, char *root, char *errorlog)
 		}
 		if (verbose) {
 			char str[100];
-			sprintf(str, "Had to retry %d times", tries);
+			PR_snprintf(str, sizeof(str), "Had to retry %d times", tries);
 			ds_send_status(str);
 		}
     }
@@ -351,7 +351,7 @@ IsService()
 	HKEY hServerKey;
 	DWORD dwType, ValueLength, Result;
 
-	sprintf(ServerKey,"%s\\%s\0", COMPANY_KEY, PRODUCT_KEY);
+	PR_snprintf(ServerKey,sizeof(ServerKey), "%s\\%s", COMPANY_KEY, PRODUCT_KEY);
 
 	Result = RegOpenKey(HKEY_LOCAL_MACHINE, ServerKey, &hServerKey);
 	if (Result != ERROR_SUCCESS) {
@@ -384,7 +384,7 @@ IsAdminService()
 	HKEY hAdminKey;
 	DWORD dwType, ValueLength, Result;
 
-	sprintf(AdminKey,"%s\\%s\0", COMPANY_KEY, ADMIN_REGISTRY_ROOT_KEY);
+	PR_snprintf(AdminKey,sizeof(AdminKey), "%s\\%s", COMPANY_KEY, ADMIN_REGISTRY_ROOT_KEY);
 
 	Result = RegOpenKey(HKEY_LOCAL_MACHINE, AdminKey, &hAdminKey);
 	if (Result != ERROR_SUCCESS) {
@@ -421,7 +421,7 @@ StartServer()
                 NULL,                   // database (NULL == default)
                 SC_MANAGER_ALL_ACCESS   // access required
                 ))) {
-            sprintf(ErrorString, 
+			PR_snprintf(ErrorString, sizeof(ErrorString),
                 "Error: Could not open the ServiceControlManager:%d "
                 "Please restart the server %s from the Services Program Item "
                 "in the Control Panel", ds_get_server_name(), GetLastError());
@@ -449,7 +449,7 @@ StopandRestartServer()
                 NULL,                   // database (NULL == default)
                 SC_MANAGER_ALL_ACCESS   // access required
                 ))) {
-            sprintf(ErrorString, 
+            PR_snprintf(ErrorString, sizeof(ErrorString),
                 "Error: Could not restart server."
                 "Please restart the server %s from the Services Program Item "
                 "in the Control Panel", ds_get_server_name());
@@ -483,7 +483,7 @@ StopServer()
                 NULL,                   // database (NULL == default)
                 SC_MANAGER_ALL_ACCESS   // access required
                 ))) {
-            sprintf(ErrorString, 
+            PR_snprintf(ErrorString, sizeof(ErrorString),
                 "Error: Could not open the ServiceControlManager:%d "
                 "Please restart the server %s from the Services Program Item "
                 "in the Control Panel", ds_get_server_name(), GetLastError());
@@ -507,14 +507,14 @@ StartNetscapeProgram()
 	PROCESS_INFORMATION piProcInfo;
     FILE *CmdFile;
 
-    ZeroMemory(line, BIG_LINE);
+    ZeroMemory(line, sizeof(line));
 
-    sprintf(line, "%s\\startsrv.bat", tmp);
+    PR_snprintf(line, BIG_LINE, "%s\\startsrv.bat", tmp);
     
     CmdFile = fopen(line, "r");
     if (!CmdFile) 
 	{
-        sprintf(ErrorString, "Error:Tried to start Netscape server %s "
+        PR_snprintf(ErrorString, sizeof(ErrorString), "Error:Tried to start Netscape server %s "
             ": Could not open the startup script %s :Error %d. Please "
             "run startsrv.bat from the server's root directory.",
             ds_get_server_name(), line, errno);
@@ -522,10 +522,10 @@ StartNetscapeProgram()
         return(DS_SERVER_DOWN);
     }
 
-    ZeroMemory(cmd, BIG_LINE);
+    ZeroMemory(cmd, sizeof(cmd));
     if (!fread(cmd, 1, BIG_LINE, CmdFile)) 
 	{
-        sprintf(ErrorString, "Error:Tried to start Netscape server %s "
+        PR_snprintf(ErrorString, sizeof(ErrorString), "Error:Tried to start Netscape server %s "
             ": Could not read the startup script %s :Error %d. Please "
             "run startsrv.bat from the server's root directory.",
             ds_get_server_name(), line, errno);
@@ -542,7 +542,7 @@ StartNetscapeProgram()
 	if (!CreateProcess(NULL, cmd, NULL, NULL, FALSE,
 		0, NULL, NULL, &siStartInfo, &piProcInfo)) 
 	{
-        sprintf(ErrorString, "Error:Tried to start Netscape server %s "
+        PR_snprintf(ErrorString, sizeof(ErrorString), "Error:Tried to start Netscape server %s "
             ": Could not start up the startup script %s :Error %d. Please "
             "run startsrv.bat from the server's root directory.",
             ds_get_server_name(), line, GetLastError());
@@ -565,7 +565,7 @@ StopNetscapeProgram()
     hEvent = CreateEvent(NULL, TRUE, FALSE, servid);  
     if(!SetEvent(hEvent)) 
 	{
-        sprintf(ErrorString, "Tried to stop existing Netscape server %s"
+        PR_snprintf(ErrorString, sizeof(ErrorString), "Tried to stop existing Netscape server %s"
             ": Could not signal it to stop :Error %d",
             servid, GetLastError());
         ds_send_error(ErrorString, 0);
@@ -588,7 +588,7 @@ StopNetscapeService()
  
     if (schService == NULL) 
 	{
-        PR_snprintf(ErrorString, 512, "Tried to open Netscape service"
+        PR_snprintf(ErrorString, sizeof(ErrorString), "Tried to open Netscape service"
             " %s: Error %d (%s). Please"
             " stop the server from the Services Item in the Control Panel",
             serviceName, GetLastError(), ds_system_errmsg());
@@ -613,7 +613,7 @@ StopNetscapeService()
     } 
     else if (Error != ERROR_SERVICE_NOT_ACTIVE) 
 	{
-        PR_snprintf(ErrorString, 512, "Tried to stop Netscape service"
+        PR_snprintf(ErrorString, sizeof(ErrorString), "Tried to stop Netscape service"
             " %s: Error %d (%s)."
             " Please stop the server from the Services Item in the"
             " Control Panel", serviceName, Error, ds_system_errmsg());
@@ -638,7 +638,7 @@ StartNetscapeService()
     if (schService == NULL) 
 	{
         CloseServiceHandle(schService);
-        sprintf(ErrorString, "Tried to start"
+        PR_snprintf(ErrorString, sizeof(ErrorString),"Tried to start"
             " the Netscape service %s: Error %d. Please"
             " start the server from the Services Item in the Control Panel",
             serviceName, GetLastError());
@@ -649,7 +649,7 @@ StartNetscapeService()
     if (!StartService(schService, 0, NULL)) 
 	{
         CloseServiceHandle(schService);
-        sprintf(ErrorString, "StartService:Could not start "
+        PR_snprintf(ErrorString, sizeof(ErrorString), "StartService:Could not start "
             "the Directory service %s: Error %d. Please restart the server "
             "from the Services Item in the Control Panel",
             serviceName, GetLastError());
@@ -671,8 +671,7 @@ WaitForServertoStop()
 
 RETRY:
 
-    newServiceName = (PCHAR)malloc(strlen(serviceName) + 5);
-    sprintf(newServiceName, "NS_%s\0", serviceName);
+	newServiceName = PR_smprintf("NS_%s", serviceName);
 
     hServDoneSemaphore = CreateSemaphore(
         NULL,   // security attributes    
@@ -680,7 +679,7 @@ RETRY:
         1,      // maximum count for semaphore
         newServiceName);
 
-    free(newServiceName);
+    PR_smprintf_free(newServiceName);
 
     if ( hServDoneSemaphore == NULL) {
         result = GetLastError();
diff --git a/ldap/admin/lib/dsalib_util.c b/ldap/admin/lib/dsalib_util.c
index 6c6f336c..0b92acf7 100644
--- a/ldap/admin/lib/dsalib_util.c
+++ b/ldap/admin/lib/dsalib_util.c
@@ -23,7 +23,9 @@
 #include <string.h>
 #include <sys/stat.h>
 #include <ctype.h>
-#include <nspr.h>
+
+#include "nspr.h"
+#include "plstr.h"
 
 #define COPY_BUFFER_SIZE        4096
 /* This is the separator string to use when outputting key/value pairs
@@ -98,7 +100,7 @@ ds_mkdir_p(char *dir, int mode)
         if(t) *t = '\0';
         if(stat(dir, &fi) == -1) {
             if(ds_mkdir(dir, mode) == -1) {
-                sprintf(errmsg, "mkdir %s failed (%s)", dir, ds_system_errmsg());
+                PR_snprintf(errmsg, sizeof(errmsg), "mkdir %s failed (%s)", dir, ds_system_errmsg());
                 return errmsg;
             }
         }
@@ -164,8 +166,8 @@ ds_get_file_list( char *dir )
     if( ( ret = malloc( sizeof( char * ) ) ) == NULL ) 
 		return NULL;
 
-	strcpy(szWildcardFileSpec, dir);
-	strcat(szWildcardFileSpec, "/*");
+	PL_strncpyz(szWildcardFileSpec, dir, sizeof(szWildcardFileSpec));
+	PL_strcatn(szWildcardFileSpec, sizeof(szWildcardFileSpec), "/*");
 
 	hFile = _findfirst( szWildcardFileSpec, &fileinfo);
 	if( hFile == -1 )
@@ -226,14 +228,14 @@ ds_cp_file(char *sfile, char *dfile, int mode)
     umask(022);
 
     if( (sfd = open(sfile, O_RDONLY)) == -1) {
-        sprintf(error, "Can't open file %s for reading.", sfile);
+        PR_snprintf(error, sizeof(error), "Can't open file %s for reading.", sfile);
         ds_send_error(error, 1);
 	return(0);
     }
 
     fstat(sfd, &fi);
     if (!(S_ISREG(fi.st_mode))) {
-        sprintf(error, "File %s is not a regular file.", sfile);
+        PR_snprintf(error, sizeof(error), "File %s is not a regular file.", sfile);
         ds_send_error(error, 1);
         close(sfd);
 	return(0);
@@ -241,7 +243,7 @@ ds_cp_file(char *sfile, char *dfile, int mode)
     len = fi.st_size;
 
     if( (dfd = open(dfile, O_RDWR | O_CREAT | O_TRUNC, mode)) == -1) {
-        sprintf(error, "can't write to file %s", dfile);
+        PR_snprintf(error, sizeof(error), "can't write to file %s", dfile);
         ds_send_error(error, 1);
         close(sfd);
 	return(0);
@@ -250,7 +252,7 @@ ds_cp_file(char *sfile, char *dfile, int mode)
         read_len = len>COPY_BUFFER_SIZE?COPY_BUFFER_SIZE:len;
 
         if ( (read_len = read(sfd, copy_buffer, read_len)) == -1) {
-            sprintf(error, "Error reading file %s for copy.", sfile);
+            PR_snprintf(error, sizeof(error), "Error reading file %s for copy.", sfile);
             ds_send_error(error, 1);
             close(sfd);
             close(dfd);
@@ -258,7 +260,7 @@ ds_cp_file(char *sfile, char *dfile, int mode)
         }
 
         if ( write(dfd, copy_buffer, read_len) != read_len) {
-            sprintf(error, "Error writing file %s for copy.", dfile);
+            PR_snprintf(error, sizeof(error), "Error writing file %s for copy.", dfile);
             ds_send_error(error, 1);
             close(sfd);
             close(dfd);
@@ -279,8 +281,6 @@ ds_get_tmp_dir()
 {
 	static char tmpdir[] = "/tmp";
 	static char tmp[256] = {0};
-	unsigned ilen;
-	char pch;
  	char* instanceDir = ds_get_install_root();
  	
 	if(instanceDir == NULL)
@@ -298,7 +298,7 @@ ds_get_tmp_dir()
 		#endif
 	}
 	
-	sprintf(tmp,"%s/tmp",instanceDir);
+	PR_snprintf(tmp, sizeof(tmp), "%s/tmp",instanceDir);
 	
 #if defined( XP_WIN32 )
 	for(ilen=0;ilen < strlen(tmp); ilen++)
@@ -637,7 +637,7 @@ alter_startup_line(char *startup_line)
 #if (defined Linux && !defined LINUX2_4)
         char temp_startup_line[BIG_LINE+40];
  
-        sprintf(temp_startup_line, "/bin/sh -c \"%s\"", startup_line);
+        PR_snprintf(temp_startup_line, sizeof(temp_startup_line), "/bin/sh -c \"%s\"", startup_line);
         strcpy(startup_line, temp_startup_line);
 #else
 	/* do nothing */
@@ -654,7 +654,7 @@ ds_send_error(char *errstr, int print_errno)
 
     fflush(stdout);
 
-	if (logfp = get_logfp()) {
+	if ((logfp = get_logfp())) {
 		fprintf(logfp, "error%s%s\n", SEPARATOR, errstr);
 		if (print_errno && errno)
 			fprintf(logfp, "system_errno%s%d\n", SEPARATOR, errno);
@@ -670,7 +670,7 @@ ds_send_status(char *str)
     fprintf(stdout, "[%s]: %s\n", ds_get_server_name(), str);
     fflush(stdout);
 
-	if (logfp = get_logfp()) {
+	if ((logfp = get_logfp())) {
 	    fprintf(logfp, "[%s]: %s\n", ds_get_server_name(), str);
 		fclose(logfp);
 	}
@@ -689,11 +689,11 @@ report_error(int type, char *msg, char *details, int doexit)
 
 	if (msg)
 	{
-		strcat(error, msg);
-		strcat(error, SEPARATOR);
+		PL_strcatn(error, BIG_LINE*4, msg);
+		PL_strcatn(error, BIG_LINE*4, SEPARATOR);
 	}
 	if (details)
-		strcat(error, details);
+		PL_strcatn(error, BIG_LINE*4, details);
 	ds_send_error(error, 1);
 }
 
@@ -721,7 +721,7 @@ ds_show_message(const char *message)
 	printf("%s\n", message);
 	fflush(stdout);
 
-	if (logfp = get_logfp()) {
+	if ((logfp = get_logfp())) {
 		fprintf(logfp, "%s\n", message);
 		fclose(logfp);
 	}
@@ -735,7 +735,7 @@ ds_show_key_value(char *key, char *value)
 	FILE *logfp;
 	printf("%s%s%s\n", key, SEPARATOR, value);
 
-	if (logfp = get_logfp()) {
+	if ((logfp = get_logfp())) {
 		fprintf(logfp, "%s%s%s\n", key, SEPARATOR, value);
 		fclose(logfp);
 	}
@@ -813,7 +813,7 @@ ds_system_errmsg(void)
 	msglen = strlen(lmsg);
 
 	min = msglen > BUFSIZ ? BUFSIZ : msglen;
-	strncpy(static_error, lmsg, min);
+	strncpy(static_error, lmsg, min-1);
 	static_error[min-1] = 0;
     }
 
@@ -863,7 +863,6 @@ rm_db_dirs(char *fullpath, DS_RM_RF_ERR_FUNC ds_rm_rf_err_func, void *arg)
 {
 	FILE *fp = fopen(fullpath, "r");
 	char buf[2][MAXPATHLEN];
-	char rmbuf[MAXPATHLEN];
 	char *bufp, *nextbufp;
 	char *retp;
 	int readit = 0;
@@ -969,7 +968,6 @@ static int
 internal_rm_rf(const char *path, DS_RM_RF_ERR_FUNC ds_rm_rf_err_func, void *arg)
 {
 	struct PRFileInfo prfi;
-	char *fullpath = NULL;
 	int retval = 0;
 
 	if (PR_GetFileInfo(path, &prfi) != PR_SUCCESS) {
@@ -990,7 +988,7 @@ internal_rm_rf(const char *path, DS_RM_RF_ERR_FUNC ds_rm_rf_err_func, void *arg)
 			return 0;
 		}
 			
-		while (dirent = PR_ReadDir(dir, PR_SKIP_BOTH)) {
+		while ((dirent = PR_ReadDir(dir, PR_SKIP_BOTH))) {
 			char *fullpath = PR_smprintf("%s%c%s", path, FILE_PATHSEP, dirent->name);
 			if (PR_GetFileInfo(fullpath, &prfi) != PR_SUCCESS) {
 				if (!ds_rm_rf_err_func(fullpath, "reading file", arg)) {
@@ -1053,7 +1051,6 @@ default_err_func(const char *path, const char *op, void *arg)
 DS_EXPORT_SYMBOL int
 ds_rm_rf(const char *dir, DS_RM_RF_ERR_FUNC ds_rm_rf_err_func, void *arg)
 {
-	int retval = 0;
 	struct PRFileInfo prfi;
 
 	if (!dir) {
diff --git a/ldap/admin/src/addindex.c b/ldap/admin/src/addindex.c
index 71813524..608bef6f 100644
--- a/ldap/admin/src/addindex.c
+++ b/ldap/admin/src/addindex.c
@@ -15,6 +15,7 @@
 #include "dsalib.h"
 #include "init_ds_env.h"
 #include <string.h>
+#include "nspr.h"
 
 int main(int argc, char *argv[])
 {
@@ -71,7 +72,7 @@ int main(int argc, char *argv[])
 		status = 0;
 	} else {
 		char msg[BIG_LINE];
-		sprintf( msg,"[%s] %s", backendName, attributes);
+		PR_snprintf( msg, sizeof(msg), "[%s] %s", backendName, attributes);
 		rpt_err( status, msg, NULL,  NULL );
 		status = 1;
 	}
diff --git a/ldap/admin/src/cfg_sspt.c b/ldap/admin/src/cfg_sspt.c
index d6cb060a..9143792b 100644
--- a/ldap/admin/src/cfg_sspt.c
+++ b/ldap/admin/src/cfg_sspt.c
@@ -316,16 +316,10 @@ add_aci(LDAP* ld, char* DN, char* privilege)
 	err = ldap_modify_s (ld, DN, mods);
 	if (err != LDAP_SUCCESS && err != LDAP_TYPE_OR_VALUE_EXISTS) {
 		char* exp = "can't add privilege. ";
-		char* format;
-		char* errmsg;
-		char* explanation;
-		format = "%s (%i) returned from ldap_modify_s(%s, %i). Privilege: %s";
-		errmsg = ldap_err2string (err);
-		explanation = (char*)malloc (strlen (format) + strlen (errmsg) +
-									 9 + strlen (DN) + 10 + strlen(aci[0]));
-		sprintf (explanation, format, errmsg, err, DN, LDAP_MOD_ADD, aci[0]);
+		char* explanation = PR_smprintf("%s (%i) returned from ldap_modify_s(%s, %i). Privilege: %s",
+										ldap_err2string (err), err, DN, LDAP_MOD_ADD, aci[0]);
 		ds_report_warning (DS_INCORRECT_USAGE, exp, explanation);
-		free (explanation);
+		PR_smprintf_free (explanation);
 		ret = 1;
 	}
 
@@ -342,7 +336,6 @@ int
 add_aci_v(LDAP* ld, char* DN, char* format, ...)
 {
 	char* acistring = NULL;
-	int ii = 0;
 	int len = 0;
 	int status = 0;
 	int fudge = 10; /* a little extra just to make sure */
@@ -442,7 +435,7 @@ admin_user_exists(LDAP* ld, char* base, char *userID)
 
 	struct timeval sto = { 10L, 0L };
 	LDAPMessage* pLdapResult;
-	sprintf (search_str, "uid=%s*", userID ? userID : "admin");
+	PR_snprintf (search_str, sizeof(search_str), "uid=%s*", userID ? userID : "admin");
 
 	err = ldap_search_st(ld, base, LDAP_SCOPE_SUBTREE, 
 						 search_str, NULL, 0, &sto, &pLdapResult);
@@ -497,7 +490,7 @@ getUIDFromDN(const char *userID, char *uid)
 		return;
 
 	rdnListNoTypes = ldap_explode_dn(userID, 1);
-	strcpy(uid, rdnListNoTypes[uidindex]);
+	PL_strncpyz(uid, rdnListNoTypes[uidindex], 1024);
 	ldap_value_free(rdnListNoTypes);
 
 	return;
@@ -527,21 +520,21 @@ create_ssadmin_user(LDAP* ld, char *base, char* userID, char* password)
 	getUIDFromDN(userID, realuid);
 	if (realuid[0])
 	{
-		sprintf(entrydn, userID);
+		PL_strncpyz(entrydn, userID, sizeof(entrydn));
 		if (entry_exists(ld, entrydn))
 			admin_dn = entrydn;
 	}
 	else
 	{
-		sprintf(entrydn, "%s=%s, %s", name_uid, userID, base);
+		PR_snprintf(entrydn, sizeof(entrydn), "%s=%s, %s", name_uid, userID, base);
 		admin_dn = admin_user_exists(ld, base, userID);
-		strcpy(realuid, userID);
+		PL_strncpyz(realuid, userID, sizeof(realuid));
 	}
 
 	if (admin_dn) 
 	{
 		char error[BIG_LINE];
-		sprintf(error, "A user with uid=%s \"%s\" already exists in the directory"
+		PR_snprintf(error, sizeof(error), "A user with uid=%s \"%s\" already exists in the directory"
 				" and will not be overwritten.", realuid[0] ? realuid : "admin", admin_dn);
 		ds_send_error(error, 0);
 		return admin_dn;
@@ -611,14 +604,11 @@ create_ssadmin_user(LDAP* ld, char *base, char* userID, char* password)
 
 		if (err != LDAP_SUCCESS) 
 		{
-			char* format = "Unable to create administrative user."
-				" (%s (%i) returned from ldap_add_s(%s))";
-			char* errmsg = ldap_err2string (err);
-			char* explanation = (char*)malloc (strlen (format) + strlen (errmsg) +
-											   9 + strlen (entrydn));
-			sprintf (explanation, format, errmsg, err, entrydn);
+			char *explanation = PR_smprintf("Unable to create administrative user."
+											" (%s (%i) returned from ldap_add_s(%s))",
+											ldap_err2string (err), err, entrydn);
 			ds_report_warning (DS_NETWORK_ERROR, " can't create user", explanation);
-			free (explanation);
+			PR_smprintf_free (explanation);
 			ret = NULL;
 		}
 	}
@@ -676,15 +666,12 @@ create_base_entry(
 
 		if (err != LDAP_SUCCESS) 
 		{
-			char* format = "Unable to create base entry."
-				" (%s (%i) returned from ldap_add_s(%s))";
-			char* errmsg = ldap_err2string (err);
-			char* explanation = (char*)malloc (strlen (format) + strlen (errmsg) + 
-											   9 + strlen (basedn));
-			sprintf (explanation, format, errmsg, err, basedn);
+			char* explanation = PR_smprintf("Unable to create base entry."
+											" (%s (%i) returned from ldap_add_s(%s))",
+											ldap_err2string (err), err, basedn);
 			ds_report_warning (DS_NETWORK_ERROR, " can't create base entry",
 							   explanation);
-			free (explanation);
+			PR_smprintf_free (explanation);
 			ret = 1;
 		}
 	}
@@ -794,15 +781,12 @@ create_organizational_unit(LDAP* ld, char* base, char* unit, char *description,
 
 		if (err != LDAP_SUCCESS) 
 		{
-			char* format = "Unable to create organizational unit."
-				" (%s (%i) returned from ldap_add_s(%s))";
-			char* errmsg = ldap_err2string (err);
-			char* explanation = (char*)malloc (strlen (format) + strlen (errmsg) + 
-											   9 + strlen (entrydn));
-			sprintf (explanation, format, errmsg, err, entrydn);
+			char* explanation = PR_smprintf("Unable to create organizational unit."
+											" (%s (%i) returned from ldap_add_s(%s))",
+											ldap_err2string (err), err, entrydn);
 			ds_report_warning (DS_NETWORK_ERROR, " can't create organizational unit",
 							   explanation);
-			free (explanation);
+			PR_smprintf_free (explanation);
 			ret = 1;
 		}
 	}
@@ -859,7 +843,7 @@ create_base(LDAP* ld, char* base)
 	if (!rdnList)
 	{
 		char error[BIG_LINE];
-		sprintf(error, "The given base suffix [%s] is not a valid DN", base);
+		PR_snprintf(error, sizeof(error), "The given base suffix [%s] is not a valid DN", base);
 		ds_send_error(error, 0);
 		return -1;
 	}
@@ -1000,16 +984,13 @@ create_NetscapeRoot(LDAP* ld, const char *DN)
 
 		if (err != LDAP_SUCCESS) 
 		{
-			char* format = "Unable to create %s."
-				" (%s (%i) returned from ldap_add_s(%s))";
-			char* errmsg = ldap_err2string (err);
-			char* explanation = (char*)malloc (strlen (format) + strlen (errmsg) + 
-											   9 + strlen (name_netscaperoot));
-			sprintf (explanation, format, name_netscaperoot, errmsg, err,
-					 DN);
+			char* explanation = PR_smprintf("Unable to create %s."
+											" (%s (%i) returned from ldap_add_s(%s))",
+											name_netscaperoot, ldap_err2string (err), err,
+											DN);
 			ds_report_warning (DS_NETWORK_ERROR, " can't create NetscapeRoot",
 							   explanation);
-			free (explanation);
+			PR_smprintf_free (explanation);
 			ret = 1;
 		}
 
@@ -1069,15 +1050,12 @@ create_configEntry(LDAP* ld)
 
 		if (err != LDAP_SUCCESS) 
 		{
-			char* format = "Unable to create %s."
-				" (%s (%i) returned from ldap_add_s(%s))";
-			char* errmsg = ldap_err2string (err);
-			char* explanation = (char*)malloc (strlen (format) + strlen (errmsg) + 
-											   9 + strlen (name_netscaperoot));
-			sprintf (explanation, format, value_config40, errmsg, err, entrydn);
+			char* explanation = PR_smprintf("Unable to create %s."
+											" (%s (%i) returned from ldap_add_s(%s))",
+											value_config40, ldap_err2string (err), err, entrydn);
 			ds_report_warning (DS_NETWORK_ERROR, " can't create config40",
 							   explanation);
-			free (explanation);
+			PR_smprintf_free (explanation);
 			ret = 1;
 		}
 
@@ -1135,14 +1113,11 @@ create_group(LDAP* ld, char* base, char* group)
 
 		if (err != LDAP_SUCCESS) 
 		{
-			char* format = "Unable to create group."
-				" (%s (%i) returned from ldap_add_s(%s))";
-			char* errmsg = ldap_err2string (err);
-			char* explanation = (char*)malloc (strlen (format) + strlen (errmsg) +
-											   9 + strlen (entrydn));
-			sprintf (explanation, format, errmsg, err, entrydn);
+			char* explanation = PR_smprintf("Unable to create group."
+											" (%s (%i) returned from ldap_add_s(%s))",
+											ldap_err2string (err), err, entrydn);
 			ds_report_warning (DS_NETWORK_ERROR, " can't create group", explanation);
-			free (explanation);
+			PR_smprintf_free (explanation);
 			ret = 1;
 		}
 	}
@@ -1230,14 +1205,11 @@ create_consumer_dn(LDAP* ld, char* dn, char* hashedpw)
 
 		if (err != LDAP_SUCCESS) 
 		{
-			char* format = "Unable to create consumer dn."
-				" (%s (%i) returned from ldap_add_s(%s))";
-			char* errmsg = ldap_err2string (err);
-			char* explanation = (char*)malloc (strlen (format) + strlen (errmsg) +
-											   9 + strlen (dn));
-			sprintf (explanation, format, errmsg, err, dn);
+			char* explanation = PR_smprintf("Unable to create consumer dn."
+											" (%s (%i) returned from ldap_add_s(%s))",
+											ldap_err2string (err), err, dn);
 			ds_report_warning (DS_NETWORK_ERROR, " can't create consumer dn", explanation);
-			free (explanation);
+			PR_smprintf_free (explanation);
 			ret = 1;
 		}
 	}
@@ -1277,16 +1249,10 @@ add_group_member(LDAP* ld, char* DN, char* attr, char* member)
 	err = ldap_modify_s (ld, DN, mods);
 	if (err != LDAP_SUCCESS && err != LDAP_TYPE_OR_VALUE_EXISTS) {
 		char* exp = "can't add member. ";
-		char* format;
-		char* errmsg;
-		char* explanation;
-		format = "%s (%i) returned from ldap_modify_s(%s, %i).";
-		errmsg = ldap_err2string (err);
-		explanation = (char*)malloc (strlen (format) + strlen (errmsg) +
-									 9 + strlen (DN) + 10);
-		sprintf (explanation, format, errmsg, err, DN, LDAP_MOD_ADD);
+		char* explanation = PR_smprintf("%s (%i) returned from ldap_modify_s(%s, %i).",
+										ldap_err2string (err), err, DN, LDAP_MOD_ADD);
 		ds_report_warning (DS_INCORRECT_USAGE, exp, explanation);
-		free (explanation);
+		PR_smprintf_free (explanation);
 		ret = 1;
 	}
 
@@ -1321,15 +1287,12 @@ do_bind(SLAPD_CONFIG* slapd, char* rootdn, char* rootpw)
 		char* format = " Cannot connect to server.";
 		ds_report_warning (DS_NETWORK_ERROR, format, "");
 	} else if (err != LDAP_SUCCESS) {
-		char* errmsg = ldap_err2string (err);
-		char* format = "Unable to bind to server."
-				" (%s (%i) returned from ldap_simple_bind_s(%s))";
-		char* explanation = malloc (strlen (format) + strlen (errmsg) +
-										9 + strlen (rootdn) + 1);
-		sprintf (explanation, format, errmsg, err, rootdn);
+		char* explanation = PR_smprintf("Unable to bind to server."
+										" (%s (%i) returned from ldap_simple_bind_s(%s))",
+										ldap_err2string (err), err, rootdn);
 		ds_report_warning (DS_NETWORK_ERROR, " can't bind to server",
 							   explanation);
-		free (explanation);
+		PR_smprintf_free (explanation);
 		ldap_unbind (connection);
 		connection = NULL;
 	}
@@ -1344,10 +1307,7 @@ write_ldap_info(SLAPD_CONFIG* slapd, char* base, char* admnm)
 	int ret = 0;
 
 	char* fmt = "%s/shared/config/ldap.conf";
-	char* infoFileName;
-
-	infoFileName = (char*)malloc(strlen(fmt) + strlen(slapd->slapd_server_root) + 1);
-	sprintf(infoFileName, fmt, slapd->slapd_server_root);
+	char* infoFileName = PR_smprintf(fmt, slapd->slapd_server_root);
 
 	if ((fp = fopen(infoFileName, "w")) == NULL)
 	{
@@ -1368,7 +1328,7 @@ write_ldap_info(SLAPD_CONFIG* slapd, char* base, char* admnm)
 		fclose(fp);
 	}
   
-	free(infoFileName);
+	PR_smprintf_free(infoFileName);
 
 	return ret;
 }
diff --git a/ldap/admin/src/configure_instance.cpp b/ldap/admin/src/configure_instance.cpp
index 860e8c78..f2d6b70d 100644
--- a/ldap/admin/src/configure_instance.cpp
+++ b/ldap/admin/src/configure_instance.cpp
@@ -46,7 +46,8 @@ extern "C" {
 #include "dsalib.h"
 }
 
-#include "prprf.h"
+#include "nspr.h"
+#include "plstr.h"
 
 #include "setupapi.h"
 #ifdef XP_UNIX
@@ -342,7 +343,7 @@ normalizeDNs()
 			if (dn)
 			{
 				char port[6];
-				sprintf(port, "%d", desc->lud_port);
+				PR_snprintf(port, sizeof(port), "%d", desc->lud_port);
 				NSString newurl = NSString("ldap") +
 					(isSSL ? "s" : "") +
 					"://" + desc->lud_host +
@@ -366,46 +367,13 @@ featureIsEnabled(const char *s)
 	return 1; // feature is enabled
 }
 
-/*
- * The following escape LDAP URL is from ldapserver/ldap/clients/dsgw/htmlout.c
- */
-
-#define HREF_CHAR_ACCEPTABLE( c )       (( c >= '-' && c <= '9' ) ||    \
-                                         ( c >= '@' && c <= 'Z' ) ||    \
-                                         ( c == '_' ) ||                \
-                                         ( c >= 'a' && c <= 'z' ))
-static void
-escape_ldap_uri(char *s1, const char *s2)
-{
-	unsigned char *q;
-	char *p;
-	const char *hexdig = "0123456789ABCDEF";
-
-	p = s1 + strlen(s1);
-	for (q = (unsigned char *) s2; *q != '\0'; ++q)
-	{
-		if (HREF_CHAR_ACCEPTABLE(*q))
-		{
-			*p++ = *q;
-		}
-		else
-		{
-			*p++ = '%';
-			*p++ = hexdig[*q >> 4];
-			*p++ = hexdig[*q & 0x0F];
-		}
-	}
-
-	*p = '\0';
-}
-
 static LdapErrorCode
 add_sample_entries(const char *sroot, LdapEntry *ldapEntry)
 {
    char tmp[MED_BUF];
 
    if (sroot)
-	   sprintf(tmp, "%s%s%s", sroot, FILE_PATHSEP, SAMPLE_LDIF);
+	   PR_snprintf(tmp, MED_BUF, "%s%s%s", sroot, FILE_PATHSEP, SAMPLE_LDIF);
    else
 	   strcpy(tmp, "test.ldif");
    
@@ -499,12 +467,12 @@ add_org_entries(const char *sroot, LdapEntry *ldapEntry,
    {
 	   if (!initialLdifFile || !*initialLdifFile ||
 		   !strncasecmp(initialLdifFile, "suggest", strlen(initialLdifFile)))
-		   sprintf(tmp, "%s%s%s", sroot, FILE_PATHSEP, TEMPLATE_LDIF);
+		   PR_snprintf(tmp, sizeof(tmp), "%s%s%s", sroot, FILE_PATHSEP, TEMPLATE_LDIF);
 	   else
-		   strcpy(tmp, initialLdifFile);
+		   PL_strncpyz(tmp, initialLdifFile, sizeof(tmp));
    }
    else
-	   strcpy(tmp, "test.ldif");
+	   PL_strncpyz(tmp, "test.ldif", sizeof(tmp));
    
    LdifEntry ldif(tmp);
    
@@ -609,7 +577,7 @@ add_org_entries(const char *sroot, LdapEntry *ldapEntry,
 
       if (ldapError != OKAY)
       {
-         sprintf(tmp, "%d", ldapError.errorCode());
+         PR_snprintf(tmp, sizeof(tmp), "%d", ldapError.errorCode());
 		 dsLogMessage(SETUP_LOG_WARN, "Slapd", "Could not write entry %s (%s:%s)", dn, tmp, ldapError.msg());
       }
 	  delete [] dn;
@@ -1290,7 +1258,7 @@ init_from_config(server_config_s *cf)
 		const char *suffix = DEFAULT_ROOT_DN;
 		int isSSL = !strncmp(cf->config_ldap_url, "ldaps:", strlen("ldaps:"));
 		char port[6];
-		sprintf(port, "%d", desc->lud_port);
+		PR_snprintf(port, sizeof(port), "%d", desc->lud_port);
 		NSString url = NSString("ldap") +
 			(isSSL ? "s" : "") +
 			"://" + desc->lud_host +
@@ -1424,7 +1392,7 @@ extern "C" int create_config_from_inf(
 		const char *suffix = DEFAULT_ROOT_DN;
 		int isSSL = !strncmp(cf->config_ldap_url, "ldaps:", strlen("ldaps:"));
 		char port[6];
-		sprintf(port, "%d", desc->lud_port);
+		PR_snprintf(port, sizeof(port), "%d", desc->lud_port);
 		NSString url = NSString("ldap") +
 			(isSSL ? "s" : "") +
 			"://" + desc->lud_host +
@@ -1434,7 +1402,7 @@ extern "C" int create_config_from_inf(
 		ldap_free_urldesc(desc);
 	}
 
-	if (test = installInfo->get(SLAPD_KEY_USER_GROUP_LDAP_URL))
+	if ((test = installInfo->get(SLAPD_KEY_USER_GROUP_LDAP_URL)))
 		cf->user_ldap_url = my_c_strdup(test);
 	else
 		cf->user_ldap_url = my_c_strdup(cf->config_ldap_url);
@@ -1457,12 +1425,12 @@ extern "C" int create_config_from_inf(
 
 	/* we also have to setup the environment to mimic a CGI */
 	static char netsiteRoot[PATH_MAX+32];
-	PR_snprintf(netsiteRoot, PATH_MAX+32, "NETSITE_ROOT=%s", cf->sroot);
+	PR_snprintf(netsiteRoot, sizeof(netsiteRoot), "NETSITE_ROOT=%s", cf->sroot);
 	putenv(netsiteRoot);
 
 	/* set the admin SERVER_NAMES = slapd-slapdIdentifier */
 	static char serverNames[PATH_MAX+32];
-	PR_snprintf(serverNames, PATH_MAX+32, "SERVER_NAMES=slapd-%s", cf->servid);
+	PR_snprintf(serverNames, sizeof(serverNames), "SERVER_NAMES=slapd-%s", cf->servid);
 	putenv(serverNames);
 
 	/* get and set the log file */
@@ -1473,11 +1441,11 @@ extern "C" int create_config_from_inf(
 		static char s_logfile[PATH_MAX+32];
 		if (logFile)
 		{
-			PR_snprintf(s_logfile, PATH_MAX+32, "DEBUG_LOGFILE=%s", logFile);
+			PR_snprintf(s_logfile, sizeof(s_logfile), "DEBUG_LOGFILE=%s", logFile);
 		}
 		else
 		{
-			PR_snprintf(s_logfile, PATH_MAX+32, "DEBUG_LOGFILE=%s", test);
+			PR_snprintf(s_logfile, sizeof(s_logfile), "DEBUG_LOGFILE=%s", test);
 			/* also init the C++ api message log */
 			initMessageLog(test);
 		}
@@ -1560,16 +1528,16 @@ configure_instance()
 #else
 		/* stevross: figure out NT equivalent */
 #endif
-		strcpy(hn, h);
+		PL_strncpyz(hn, h, BUFSIZ);
 		installInfo->set(SLAPD_KEY_FULL_MACHINE_NAME, hn);
 	}
 	else
 	{
-		strcpy(hn,installInfo->get(SLAPD_KEY_FULL_MACHINE_NAME));
+		PL_strncpyz(hn,installInfo->get(SLAPD_KEY_FULL_MACHINE_NAME), BUFSIZ);
 	}
 
 	NSString sieDN;
-	if (status = create_ss_dir_tree(hn, sieDN))
+	if ((status = create_ss_dir_tree(hn, sieDN)))
 	{
 		dsLogMessage(SETUP_LOG_FATAL, "Slapd",
 			   "Did not add Directory Server information to Configuration Server.");
@@ -1690,7 +1658,6 @@ extern "C" int
 reconfigure_instance(int argc, char *argv[])
 {
 	char hn[BUFSIZ];
-	int status = 0;
 
 	dsLogMessage(SETUP_LOG_START, "Slapd", "Starting Slapd server reconfiguration.");
 
@@ -1733,12 +1700,12 @@ reconfigure_instance(int argc, char *argv[])
 #else
 		/* stevross: figure out NT equivalent */
 #endif
-		strcpy(hn, h);
+		PL_strncpyz(hn, h, BUFSIZ);
 		installInfo->set(SLAPD_KEY_FULL_MACHINE_NAME, hn);
 	}
 	else
 	{
-		strcpy(hn,installInfo->get(SLAPD_KEY_FULL_MACHINE_NAME));
+		PL_strncpyz(hn,installInfo->get(SLAPD_KEY_FULL_MACHINE_NAME), BUFSIZ);
 	}
 
 	// search for the app entry for the DS installation we just replaced
diff --git a/ldap/admin/src/create_instance.c b/ldap/admin/src/create_instance.c
index ce713040..d2a332ac 100644
--- a/ldap/admin/src/create_instance.c
+++ b/ldap/admin/src/create_instance.c
@@ -165,7 +165,7 @@ static char *make_error(char *fmt, ...)
     va_list args;
 
     va_start(args, fmt);
-    vsprintf(errbuf, fmt, args);
+    PR_vsnprintf(errbuf, sizeof(errbuf), fmt, args);
     va_end(args);
     return errbuf;
 }
@@ -211,7 +211,7 @@ static int getSuiteSpotUserGroup(server_config_s* cf)
     if (cf->servuser)
         return 0;
 
-    sprintf(realFile, "%s/%s", cf->sroot, ssUsersFile);
+    PR_snprintf(realFile, sizeof(realFile), "%s/%s", cf->sroot, ssUsersFile);
     if (!(fp = fopen(realFile, "r")))
         return 1;
 
@@ -256,8 +256,7 @@ void set_defaults(char *sroot, char *hn, server_config_s *conf)
     {
         if( (t = strchr(hn, '.')) )
             *t = '\0';
-        id = (char *) malloc(strlen(hn) + 1);
-        sprintf(id, "%s", hn);
+		id = PR_smprintf("%s", hn);
         if(t)
             *t = '.';
     }
@@ -471,7 +470,7 @@ static char *sanity_check(server_config_s *cf, char *param_name)
         }
     }
     /* has that identifier already been used? */
-    sprintf(fn, "%s%c%s-%s", cf->sroot, FILE_PATHSEP, 
+    PR_snprintf(fn, sizeof(fn), "%s%c%s-%s", cf->sroot, FILE_PATHSEP, 
             PRODUCT_NAME, cf->servid);
 
 /* Not an error to upgrade! ???
@@ -649,7 +648,7 @@ char *chownlogs(char *sroot, char *user)
         if(!(pw = getpwnam(user)))
             return make_error("Could not find UID and GID of user '%s'.", 
                               user);
-        sprintf(fn, "%s%clogs", sroot, FILE_PATHSEP);
+        PR_snprintf(fn, sizeof(fn), "%s%clogs", sroot, FILE_PATHSEP);
         return chownfile (pw, fn);
     }
     return NULL;
@@ -663,7 +662,7 @@ char *chownconfig(char *sroot, char *user)
         if(!(pw = getpwnam(user)))
             return make_error("Could not find UID and GID of user '%s'.", 
                               user);
-        sprintf(fn, "%s%cconfig", sroot, FILE_PATHSEP);
+        PR_snprintf(fn, sizeof(fn), "%s%cconfig", sroot, FILE_PATHSEP);
         return chownfile (pw, fn);
     }
     return NULL;
@@ -685,7 +684,7 @@ char *gen_script(char *s_root, char *name, char *fmt, ...)
     char *shell = "/bin/sh";
     va_list args;
 
-    sprintf(fn, "%s%c%s", s_root, FILE_PATHSEP, name);
+    PR_snprintf(fn, sizeof(fn), "%s%c%s", s_root, FILE_PATHSEP, name);
     if(!(f = fopen(fn, "w")))  
         return make_error("Could not write to %s (%s).", fn, ds_system_errmsg());
     va_start(args, fmt);
@@ -737,8 +736,8 @@ char *gen_perl_script(char *s_root, char *cs_path, char *name, char *fmt, ...)
     FILE *f;
     va_list args;
 
-    sprintf(fn, "%s%c%s", cs_path, FILE_PATHSEP, name);
-    sprintf(myperl, "%s%cbin%cslapd%cadmin%cbin%cperl",
+    PR_snprintf(fn, sizeof(fn), "%s%c%s", cs_path, FILE_PATHSEP, name);
+    PR_snprintf(myperl, sizeof(myperl), "%s%cbin%cslapd%cadmin%cbin%cperl",
                     s_root, FILE_PATHSEP, FILE_PATHSEP,
                     FILE_PATHSEP, FILE_PATHSEP, FILE_PATHSEP);
     if(!(f = fopen(fn, "w")))  
@@ -778,11 +777,11 @@ char *gen_perl_script_auto(char *s_root, char *cs_path, char *name,
     char fn[PATH_SIZE], ofn[PATH_SIZE];
     const char *table[10][2];
 
-    sprintf(ofn, "%s%cbin%cslapd%cadmin%cscripts%ctemplate-%s", s_root,
+    PR_snprintf(ofn, sizeof(ofn), "%s%cbin%cslapd%cadmin%cscripts%ctemplate-%s", s_root,
             FILE_PATHSEP, FILE_PATHSEP, FILE_PATHSEP, FILE_PATHSEP,
             FILE_PATHSEP, name);
-    sprintf(fn, "%s%c%s", cs_path, FILE_PATHSEP, name);
-    sprintf(myperl, "!%s%cbin%cslapd%cadmin%cbin%cperl",
+    PR_snprintf(fn, sizeof(fn), "%s%c%s", cs_path, FILE_PATHSEP, name);
+    PR_snprintf(myperl, sizeof(myperl), "!%s%cbin%cslapd%cadmin%cbin%cperl",
             s_root, FILE_PATHSEP, FILE_PATHSEP,
             FILE_PATHSEP, FILE_PATHSEP, FILE_PATHSEP);
 
@@ -831,12 +830,12 @@ char *gen_perl_script_auto_for_migration(char *s_root, char *cs_path, char *name
     char fn[PATH_SIZE], ofn[PATH_SIZE];
     const char *table[10][2];
 
-    sprintf(ofn, "%s%cbin%cslapd%cadmin%cscripts%ctemplate-%s", s_root,
+    PR_snprintf(ofn, sizeof(ofn), "%s%cbin%cslapd%cadmin%cscripts%ctemplate-%s", s_root,
             FILE_PATHSEP, FILE_PATHSEP, FILE_PATHSEP, FILE_PATHSEP,
             FILE_PATHSEP, name);
-    sprintf(fn, "%s%cbin%cslapd%cadmin%cbin%c%s", s_root, FILE_PATHSEP, 
+    PR_snprintf(fn, sizeof(fn), "%s%cbin%cslapd%cadmin%cbin%c%s", s_root, FILE_PATHSEP, 
             FILE_PATHSEP, FILE_PATHSEP, FILE_PATHSEP, FILE_PATHSEP, name);
-    sprintf(myperl, "!%s%cbin%cslapd%cadmin%cbin%cperl",
+    PR_snprintf(myperl, sizeof(myperl), "!%s%cbin%cslapd%cadmin%cbin%cperl",
             s_root, FILE_PATHSEP, FILE_PATHSEP,
             FILE_PATHSEP, FILE_PATHSEP, FILE_PATHSEP);
 
@@ -888,7 +887,7 @@ service_exists(char *servid)
 {
     DWORD status, lasterror = 0;
     char szServiceName[MAX_PATH] = {0};
-    sprintf(szServiceName,"%s-%s", SVR_ID_SERVICE, servid);
+    PR_snprintf(szServiceName, sizeof(szServiceName),"%s-%s", SVR_ID_SERVICE, servid);
     /* if the service already exists, error */
     status = SERVICE_GetNTServiceStatus(szServiceName, &lasterror );
     if ( (lasterror == ERROR_SERVICE_DOES_NOT_EXIST) || 
@@ -910,7 +909,7 @@ void setup_nteventlogging(char *szServiceId, char *szMessageFile)
     char szKey[MAX_PATH];
     DWORD dwData;
 
-    sprintf(szKey, "SYSTEM\\CurrentControlSet\\Services\\EventLog\\Application\\%s", szServiceId);
+    PR_snprintf(szKey, sizeof(szKey), "SYSTEM\\CurrentControlSet\\Services\\EventLog\\Application\\%s", szServiceId);
 
     if(RegCreateKey(HKEY_LOCAL_MACHINE, szKey, &hKey) == ERROR_SUCCESS)
     {
@@ -930,10 +929,10 @@ char *add_ntservice(server_config_s *cf)
     char szServiceExe[MAX_PATH], szServiceDisplayName[MAX_PATH], szServiceName[MAX_PATH];
     DWORD dwLastError;
     
-    sprintf ( szServiceExe, "%s/bin/%s/server/%s", cf->sroot, 
+    PR_snprintf(szServiceExe, sizeof(szServiceExe), "%s/bin/%s/server/%s", cf->sroot, 
               SVR_DIR_ROOT, SVR_EXE);
-    sprintf ( szServiceName,"%s-%s", SVR_ID_SERVICE, cf->servid);
-    sprintf ( szServiceDisplayName, "%s (%s)", SVR_NAME_FULL_VERSION, 
+    PR_snprintf(szServiceName, sizeof(szServiceName),"%s-%s", SVR_ID_SERVICE, cf->servid);
+    PR_snprintf(szServiceDisplayName, sizeof(szServiceDisplayName), "%s (%s)", SVR_NAME_FULL_VERSION, 
               cf->servid);
 
     /* install new service - if already installed, try and remove and 
@@ -947,7 +946,7 @@ char *add_ntservice(server_config_s *cf)
     }
 
     // setup event logging registry keys, do this after service creation
-    sprintf(szMessageFile, "%s\\bin\\%s\\server\\%s", cf->sroot, 
+    PR_snprintf(szMessageFile, sizeof(szMessageFile), "%s\\bin\\%s\\server\\%s", cf->sroot, 
         SVR_DIR_ROOT, "slapdmessages30.dll");
     setup_nteventlogging(szServiceName, szMessageFile);
 
@@ -970,16 +969,16 @@ char *setup_ntserver(server_config_s *cf)
     DWORD sizeof_value_data_buffer;
 
     /* MLM - Adding ACL directories authdb and authdb/default */
-    sprintf(subdir, "%s%cauthdb", sroot, FILE_PATHSEP); 
+    PR_snprintf(subdir, sizeof(subdir), "%s%cauthdb", sroot, FILE_PATHSEP); 
     if( (create_instance_mkdir(subdir, NEWDIR_MODE)) )
         return make_error("mkdir %s failed (%s)", subdir, ds_system_errmsg());
 
-    sprintf(subdir, "%s%cauthdb%cdefault", sroot, FILE_PATHSEP, FILE_PATHSEP); 
+    PR_snprintf(subdir, sizeof(subdir), "%s%cauthdb%cdefault", sroot, FILE_PATHSEP, FILE_PATHSEP); 
     if( (create_instance_mkdir(subdir, NEWDIR_MODE)) )
         return make_error("mkdir %s failed (%s)", subdir, ds_system_errmsg());
 
     /* Create DS-nickname (corresponding to ServiceID) key in registry */
-    sprintf(line, "%s\\%s\\%s-%s", KEY_SOFTWARE_NETSCAPE, SVR_KEY_ROOT, 
+    PR_snprintf(line, sizeof(line), "%s\\%s\\%s-%s", KEY_SOFTWARE_NETSCAPE, SVR_KEY_ROOT, 
         SVR_ID_SERVICE, cf->servid);
 
     Result = RegCreateKey(HKEY_LOCAL_MACHINE, line, &hServerKey);
@@ -990,14 +989,14 @@ char *setup_ntserver(server_config_s *cf)
     
     // note that SVR_ID_PRODUCT is being used here, which is of the form dsX
     // as opposed to SVR_ID_SERVICE, which is of the form dsX30
-    sprintf(line, "%s\\%s-%s\\config", sroot, SVR_ID_PRODUCT, cf->servid);
+    PR_snprintf(line, sizeof(line), "%s\\%s-%s\\config", sroot, SVR_ID_PRODUCT, cf->servid);
     Result = RegSetValueEx(hServerKey, VALUE_CONFIG_PATH, 0, REG_SZ, 
         line, strlen(line) + 1);
 
     RegCloseKey(hServerKey);
 
      /* Create SNMP key in registry */
-    sprintf(line, "%s\\%s\\%s", KEY_SOFTWARE_NETSCAPE, SVR_KEY_ROOT, 
+    PR_snprintf(line, sizeof(line), "%s\\%s\\%s", KEY_SOFTWARE_NETSCAPE, SVR_KEY_ROOT, 
         KEY_SNMP_CURRENTVERSION);
 
     Result = RegCreateKey(HKEY_LOCAL_MACHINE, line, &hServerKey);
@@ -1008,13 +1007,13 @@ char *setup_ntserver(server_config_s *cf)
     
     
     /* Create the SNMP Pathname value */
-    sprintf(line, "%s\\%s", sroot, SNMP_PATH);
+    PR_snprintf(line, sizeof(line), "%s\\%s", sroot, SNMP_PATH);
     Result = RegSetValueEx(hServerKey, VALUE_APP_PATH, 0, REG_SZ, 
         line, strlen(line) + 1);    
     RegCloseKey(hServerKey);
 
     /* write SNMP extension agent value to Microsoft SNMP Part of Registry)  */
-    sprintf(line, "%s\\%s", KEY_SERVICES, KEY_SNMP_SERVICE); 
+    PR_snprintf(line, sizeof(line), "%s\\%s", KEY_SERVICES, KEY_SNMP_SERVICE); 
     Result = RegOpenKeyEx(HKEY_LOCAL_MACHINE, 
                           line,
                           0,
@@ -1027,7 +1026,7 @@ char *setup_ntserver(server_config_s *cf)
         make sure it doesn't already exist, find last one and increment 
         value for new key */
 
-        sprintf(line, "%s\\%s\\%s",    KEY_SOFTWARE_NETSCAPE, SVR_KEY_ROOT, KEY_SNMP_CURRENTVERSION);
+        PR_snprintf(line, sizeof(line), "%s\\%s\\%s",    KEY_SOFTWARE_NETSCAPE, SVR_KEY_ROOT, KEY_SNMP_CURRENTVERSION);
 
         Result = RegQueryInfoKey(hServerKey, NULL, NULL, NULL, NULL, NULL,
                                  NULL, &NumValues, NULL, NULL, NULL, NULL);
@@ -1044,7 +1043,7 @@ char *setup_ntserver(server_config_s *cf)
                    and it would not find the key if it was already there
                 */
                 sizeof_value_data_buffer=MAX_PATH;
-                sprintf(NumValuesBuf, "%d", iterator);
+                PR_snprintf(NumValuesBuf, sizeof(NumValuesBuf), "%d", iterator);
                 Result = RegQueryValueEx(hServerKey,
                                       NumValuesBuf,
                                       NULL,
@@ -1062,7 +1061,7 @@ char *setup_ntserver(server_config_s *cf)
                 
         if(!value_already_exists)
         {
-              sprintf(NumValuesBuf, "%d", NumValues + 1); 
+              PR_snprintf(NumValuesBuf, sizeof(NumValuesBuf), "%d", NumValues + 1); 
             Result = RegSetValueEx(hServerKey, NumValuesBuf, 0, REG_SZ,
                                  line, strlen(line) + 1);
 
@@ -1125,7 +1124,7 @@ char *create_server(server_config_s *cf, char *param_name)
      * <server_root>/.native_solaris file acts as the flag
      */
     if (!iDSISolaris) {
-        sprintf(otherline, "%s%c.native_solaris", sroot, FILE_PATHSEP);    
+        PR_snprintf(otherline, sizeof(otherline), "%s%c.native_solaris", sroot, FILE_PATHSEP);    
         if (create_instance_exists(otherline)) {
             iDSISolaris = 1;
         }
@@ -1137,11 +1136,11 @@ char *create_server(server_config_s *cf, char *param_name)
      */
         sub = sub_token(sroot,"/usr/iplanet/",13,"/var/",5);
         if (sub) {
-            sprintf(subdirvar, "%s/"PRODUCT_NAME"-%s", sub, cf->servid);
+            PR_snprintf(subdirvar, sizeof(subdirvar), "%s/"PRODUCT_NAME"-%s", sub, cf->servid);
             free(sub);
         }
         else {
-            sprintf(subdirvar, "%s/"PRODUCT_NAME"-%s", SOLARIS_VAR_DIR, cf->servid);
+            PR_snprintf(subdirvar, sizeof(subdirvar), "%s/"PRODUCT_NAME"-%s", SOLARIS_VAR_DIR, cf->servid);
         }
         if( (create_instance_mkdir_p(subdirvar, NEWDIR_MODE)) )
             return make_error("mkdir %s failed (%s)", subdirvar, ds_system_errmsg());
@@ -1151,64 +1150,64 @@ char *create_server(server_config_s *cf, char *param_name)
          */
         sub = sub_token(sroot,"/usr/",5,"/etc/",5);
         if (sub) {
-            sprintf(subdiretc, "%s/"PRODUCT_NAME"-%s", sub, cf->servid);
+            PR_snprintf(subdiretc, sizeof(subdiretc), "%s/"PRODUCT_NAME"-%s", sub, cf->servid);
             free(sub);
         }
         else {
-            sprintf(subdiretc, "%s/"PRODUCT_NAME"-%s", SOLARIS_ETC_DIR, cf->servid);
+            PR_snprintf(subdiretc, sizeof(subdiretc), "%s/"PRODUCT_NAME"-%s", SOLARIS_ETC_DIR, cf->servid);
         }
         if( (create_instance_mkdir_p(subdiretc, NEWDIR_MODE)) )
             return make_error("mkdir %s failed (%s)", subdiretc, ds_system_errmsg());
-        sprintf(subdir, "%s%c"PRODUCT_NAME"-%s", sroot, FILE_PATHSEP,
+        PR_snprintf(subdir, sizeof(subdir), "%s%c"PRODUCT_NAME"-%s", sroot, FILE_PATHSEP,
                  cf->servid);
         if( (create_instance_symlink(subdirvar, subdir)) )
             return make_error("symlink %s ==> %s failed (%s)", subdir, subdirvar, ds_system_errmsg());
     }
     else {
-        sprintf(subdir, "%s%c"PRODUCT_NAME"-%s", sroot, FILE_PATHSEP, 
+        PR_snprintf(subdir, sizeof(subdir), "%s%c"PRODUCT_NAME"-%s", sroot, FILE_PATHSEP, 
                  cf->servid);
         if( (create_instance_mkdir(subdir, NEWDIR_MODE)) )
             return make_error("mkdir %s failed (%s)", subdir, ds_system_errmsg());
     }      
 #else 
-    sprintf(subdir, "%s%c"PRODUCT_NAME"-%s", sroot, FILE_PATHSEP, 
+    PR_snprintf(subdir, sizeof(subdir), "%s%c"PRODUCT_NAME"-%s", sroot, FILE_PATHSEP, 
                  cf->servid);
     if( (create_instance_mkdir(subdir, NEWDIR_MODE)) )
         return make_error("mkdir %s failed (%s)", subdir, ds_system_errmsg());
 #endif /* SOLARIS */
     
     /* Create slapd-nickname/config directory */
-    sprintf(line, "%s%cconfig", subdir, FILE_PATHSEP);
+    PR_snprintf(line, sizeof(line), "%s%cconfig", subdir, FILE_PATHSEP);
     if( (create_instance_mkdir(line, NEWDIR_MODE)) ) 
         return make_error("mkdir %s failed (%s)", line, ds_system_errmsg());
 #if defined( SOLARIS )
     if (iDSISolaris) {
-        sprintf(line, "%s%cconfig", subdirvar, FILE_PATHSEP);
-        sprintf(otherline, "%s%cconfig", subdiretc, FILE_PATHSEP);
+        PR_snprintf(line, sizeof(line), "%s%cconfig", subdirvar, FILE_PATHSEP);
+        PR_snprintf(otherline, sizeof(otherline), "%s%cconfig", subdiretc, FILE_PATHSEP);
         if( (create_instance_symlink(line, otherline)) )
             return make_error("symlink %s ==> %s failed (%s)", otherline, line, ds_system_errmsg());
     }
 #endif /* SOLARIS */
 
     /* Create slapd-nickname/config/schema directory */
-    sprintf(line, "%s%cconfig%cschema", subdir, FILE_PATHSEP, FILE_PATHSEP);
+    PR_snprintf(line, sizeof(line), "%s%cconfig%cschema", subdir, FILE_PATHSEP, FILE_PATHSEP);
     if( (create_instance_mkdir(line, NEWDIR_MODE)) ) 
         return make_error("mkdir %s failed (%s)", line, ds_system_errmsg());
 
 #if defined (BUILD_PRESENCE)
     /* Create slapd-nickname/config/presence directory */
-    sprintf(line, "%s%cconfig%cpresence", subdir, FILE_PATHSEP, FILE_PATHSEP);
+    PR_snprintf(line, sizeof(line), "%s%cconfig%cpresence", subdir, FILE_PATHSEP, FILE_PATHSEP);
     if( (create_instance_mkdir(line, NEWDIR_MODE)) ) 
         return make_error("mkdir %s failed (%s)", line, ds_system_errmsg());
 #endif
 
     /* Create slapd-nickname/logs directory */
-    sprintf(line, "%s%clogs", subdir, FILE_PATHSEP);
+    PR_snprintf(line, sizeof(line), "%s%clogs", subdir, FILE_PATHSEP);
     if( (create_instance_mkdir(line, NEWSECDIR_MODE)) )
         return make_error("mkdir %s failed (%s)", line, ds_system_errmsg());
 
     /* Create httpacl directory */
-    sprintf(line, "%s%chttpacl", cf->sroot, FILE_PATHSEP); 
+    PR_snprintf(line, sizeof(line), "%s%chttpacl", cf->sroot, FILE_PATHSEP); 
     if( (create_instance_mkdir(line, NEWDIR_MODE)) )
         return make_error("mkdir %s failed (%s)", line, ds_system_errmsg());
 #if defined( SOLARIS )
@@ -1599,7 +1598,7 @@ char *create_instance_mkdir_p(char *dir, int mode)
         if(t) *t = '\0';
         if(stat(dir, &fi) == -1) {
             if(create_instance_mkdir(dir, mode) == -1) {
-                sprintf(errmsg, "mkdir %s failed (%s)", dir, ds_system_errmsg());
+                PR_snprintf(errmsg, sizeof(errmsg), "mkdir %s failed (%s)", dir, ds_system_errmsg());
                 return errmsg;
             }
         }
@@ -1708,7 +1707,7 @@ int tryuser(char *user)
     if(geteuid())
         return 0;
 
-    sprintf(fn, "/tmp/trychown.%ld", (long)getpid());
+    PR_snprintf(fn, sizeof(fn), "/tmp/trychown.%ld", (long)getpid());
     if( (fd = creat(fn, 0777)) == -1)
         return 0;         /* Hmm. */
     ret = chown(fn, pw->pw_uid, pw->pw_gid);
@@ -1871,15 +1870,12 @@ file_is_type_x(const char *dirname, const char *filename, PRFileType x)
 {
     struct PRFileInfo inf;
     int status = 0;
-    int size = strlen(dirname) + strlen(filename) + 2; /* 1 for slash + 1 for null */
-    char *fullpath = calloc(sizeof(char), size);
-
-    sprintf(fullpath, "%s/%s", dirname, filename);
+    char *fullpath = PR_smprintf("%s/%s", dirname, filename);
     if (PR_SUCCESS == PR_GetFileInfo(fullpath, &inf) &&
         inf.type == x)
         status = 1;
 
-    free(fullpath);
+    PR_smprintf_free(fullpath);
 
     return status;
 }
@@ -1915,11 +1911,11 @@ ds_copy_group_files_using_mode(char *src_dir, char *dest_dir,
     while( (d = PR_ReadDir(ds, 0)) ) {
         if(d->name[0] != '.') {
             if(!filter || strstr(d->name, filter)) {
-                sprintf(fullname, "%s/%s", src_dir, d->name);
+                PR_snprintf(fullname, sizeof(fullname), "%s/%s", src_dir, d->name);
                 if(PR_SUCCESS != PR_Access(fullname, PR_ACCESS_EXISTS))
                     continue;
-                sprintf(src_file,  "%s%c%s", src_dir,  FILE_PATHSEP, d->name);
-                sprintf(dest_file, "%s%c%s", dest_dir, FILE_PATHSEP, d->name);
+                PR_snprintf(src_file, sizeof(src_file),  "%s%c%s", src_dir,  FILE_PATHSEP, d->name);
+                PR_snprintf(dest_file, sizeof(dest_file), "%s%c%s", dest_dir, FILE_PATHSEP, d->name);
                 if(is_a_dir(src_dir, d->name)) {
                     char *sub_src_dir = strdup(src_file);
                     char *sub_dest_dir = strdup(dest_file);
@@ -1986,45 +1982,45 @@ char *ds_cre_subdirs(char *sroot, server_config_s *cf, char *cs_path,
     char subdir[PATH_SIZE], *t = NULL;
 
     /* create subdir <a_server>/db */
-    sprintf(subdir, "%s%cdb", cs_path, FILE_PATHSEP);
+    PR_snprintf(subdir, sizeof(subdir), "%s%cdb", cs_path, FILE_PATHSEP);
     if( (t = create_instance_mkdir_p(subdir, NEWDIR_MODE)) )
         return(t);
     chownfile (pw, subdir);
 
     /* create subdir <a_server>/ldif */
-    sprintf(subdir, "%s%cldif", cs_path, FILE_PATHSEP);
+    PR_snprintf(subdir, sizeof(subdir), "%s%cldif", cs_path, FILE_PATHSEP);
     if( (t = create_instance_mkdir_p(subdir, NEWDIR_MODE)) )
         return(t);
     chownfile (pw, subdir);
 
     /* create subdir <a_server>/dsml */
-    sprintf(subdir, "%s%cdsml", cs_path, FILE_PATHSEP);
+    PR_snprintf(subdir, sizeof(subdir), "%s%cdsml", cs_path, FILE_PATHSEP);
     if( (t = create_instance_mkdir_p(subdir, NEWDIR_MODE)) )
         return(t);
     chownfile (pw, subdir);
 
     /* create subdir <a_server>/bak */
-    sprintf(subdir, "%s%cbak", cs_path, FILE_PATHSEP);
+    PR_snprintf(subdir, sizeof(subdir), "%s%cbak", cs_path, FILE_PATHSEP);
     if( (t = create_instance_mkdir_p(subdir, NEWDIR_MODE)) )
         return(t);
     chownfile (pw, subdir);
 
     /* Create slapd-nickname/confbak directory */
-    sprintf(subdir, "%s%cconfbak", cs_path, FILE_PATHSEP);
+    PR_snprintf(subdir, sizeof(subdir), "%s%cconfbak", cs_path, FILE_PATHSEP);
     if( (t=create_instance_mkdir_p(subdir, NEWDIR_MODE)) )
         return(t);
     chownfile (pw, subdir);
 
     /* create subdir <server_root>/dsgw/context */
-    sprintf(subdir, "%s%cclients", sroot, FILE_PATHSEP);
+    PR_snprintf(subdir, sizeof(subdir), "%s%cclients", sroot, FILE_PATHSEP);
     if (is_a_dir(subdir, "dsgw")) { /* only create dsgw stuff if we are installing it */
-        sprintf(subdir, "%s%cclients%cdsgw%ccontext", sroot, FILE_PATHSEP,FILE_PATHSEP,FILE_PATHSEP);
+        PR_snprintf(subdir, sizeof(subdir), "%s%cclients%cdsgw%ccontext", sroot, FILE_PATHSEP,FILE_PATHSEP,FILE_PATHSEP);
         if( (t = create_instance_mkdir_p(subdir, NEWDIR_MODE)) )
             return(t);
     }
 
   /* create subdir <server_root>/bin/slapd/authck */
-    sprintf(subdir, "%s%cbin%cslapd%cauthck", sroot, FILE_PATHSEP, FILE_PATHSEP, FILE_PATHSEP);
+    PR_snprintf(subdir, sizeof(subdir), "%s%cbin%cslapd%cauthck", sroot, FILE_PATHSEP, FILE_PATHSEP, FILE_PATHSEP);
     if( (t = create_instance_mkdir_p(subdir, NEWDIR_MODE)) )
         return(t);
 #if defined( SOLARIS )
@@ -2119,10 +2115,10 @@ char *ds_gen_scripts(char *sroot, server_config_s *cf, char *cs_path)
     mysroot = sroot;
     mycs_path = cs_path;
 
-    sprintf(server, "%s/bin/"PRODUCT_NAME"/server", sroot);    
-    sprintf(admin, "%s/bin/"PRODUCT_NAME"/admin/bin", sroot);    
-    sprintf(tools, "%s/shared/bin", sroot);    
-    sprintf(cgics_path, "%s%cbin%cadmin%cadmin%cbin", sroot,
+    PR_snprintf(server, sizeof(server), "%s/bin/"PRODUCT_NAME"/server", sroot);    
+    PR_snprintf(admin, sizeof(admin), "%s/bin/"PRODUCT_NAME"/admin/bin", sroot);    
+    PR_snprintf(tools, sizeof(tools), "%s/shared/bin", sroot);    
+    PR_snprintf(cgics_path, sizeof(cgics_path), "%s%cbin%cadmin%cadmin%cbin", sroot,
             FILE_PATHSEP, FILE_PATHSEP, FILE_PATHSEP, FILE_PATHSEP);
 
     t = gen_script(cs_path, "monitor", 
@@ -2491,7 +2487,7 @@ char *ds_gen_scripts(char *sroot, server_config_s *cf, char *cs_path)
          */
         if (iDSISolaris)
         { 
-            sprintf(fn, "%s/%s", server, cl_scripts[cls]);
+            PR_snprintf(fn, sizeof(fn), "%s/%s", server, cl_scripts[cls]);
             logUninstallInfo(sroot, PRODUCT_NAME, PRODUCT_NAME, fn);
         }
 #endif /* SOLARIS */
@@ -2542,10 +2538,10 @@ char *ds_gen_scripts(char *sroot, server_config_s *cf, char *cs_path)
         *q = '\0';
     }
 
-    sprintf(server, "%s/bin/"PRODUCT_NAME"/server", sroot);    
-    sprintf(admin, "%s/bin/"PRODUCT_NAME"/admin/bin", sroot);    
-    sprintf(tools, "%s/shared/bin", sroot);    
-    sprintf(cgics_path, "%s/bin/admin/admin/bin", sroot);
+    PR_snprintf(server, sizeof(server), "%s/bin/"PRODUCT_NAME"/server", sroot);    
+    PR_snprintf(admin, sizeof(admin), "%s/bin/"PRODUCT_NAME"/admin/bin", sroot);    
+    PR_snprintf(tools, sizeof(tools), "%s/shared/bin", sroot);    
+    PR_snprintf(cgics_path, sizeof(cgics_path), "%s/bin/admin/admin/bin", sroot);
 
     ds_unixtodospath( cs_path );
     ds_unixtodospath( server );
@@ -3141,7 +3137,6 @@ char *ds_gen_scripts(char *sroot, server_config_s *cf, char *cs_path)
 void
 suffix_gen_conf(FILE* f, char * suffix, char *be_name)
 {
-    int l;
     char* belowdn;
     
     fprintf(f, "dn: cn=%s,cn=ldbm database,cn=plugins,cn=config\n", be_name);
@@ -3193,10 +3188,9 @@ suffix_gen_conf(FILE* f, char * suffix, char *be_name)
     fprintf(f, "cn: index\n");
     fprintf(f, "\n");
 
-    l = strlen("cn=index,cn=") + strlen(be_name) + strlen(",cn=ldbm database,cn=plugins,cn=config");
-    belowdn = (char *)malloc(l + 1);
-    sprintf(belowdn, "cn=index,cn=%s,cn=ldbm database,cn=plugins,cn=config", be_name);
+    belowdn = PR_smprintf("cn=index,cn=%s,cn=ldbm database,cn=plugins,cn=config", be_name);
     ds_gen_index(f, belowdn);
+	PR_smprintf_free(belowdn);
     
     /* done with ldbm entries */
 }
@@ -3224,7 +3218,7 @@ char *ds_gen_confs(char *sroot, server_config_s *cf,
     int  rootdse = 0;
     char *shared_lib;
 
-    sprintf(fn, "%s%cconfig%cdse.ldif", cs_path, FILE_PATHSEP, FILE_PATHSEP);
+    PR_snprintf(fn, sizeof(fn), "%s%cconfig%cdse.ldif", cs_path, FILE_PATHSEP, FILE_PATHSEP);
     if(!(f = fopen(fn, "w")))
         return make_error("Can't write to %s (%s)", fn, ds_system_errmsg());
 
@@ -3727,6 +3721,7 @@ char *ds_gen_confs(char *sroot, server_config_s *cf,
         }
     }
 
+#ifdef BUILD_PAM_PASSTHRU
 #if !defined( XP_WIN32 )
 	/* PAM Pass Through Auth plugin - off by default */
 	fprintf(f, "dn: cn=PAM Pass Through Auth,cn=plugins,cn=config\n");
@@ -3752,6 +3747,7 @@ char *ds_gen_confs(char *sroot, server_config_s *cf,
 	fprintf(f, "pamService: ldapserver\n");
 	fprintf(f, "\n");
 #endif /* NO PAM FOR WINDOWS */
+#endif /* BUILD_PAM_PASSTHRU */
 
     fprintf(f, "dn: cn=ldbm database,cn=plugins,cn=config\n");
     fprintf(f, "objectclass: top\n");
@@ -3946,17 +3942,17 @@ char *ds_gen_confs(char *sroot, server_config_s *cf,
 
     fclose (f);
     
-    sprintf(src, "%s%cconfig%cdse.ldif", cs_path, FILE_PATHSEP, FILE_PATHSEP);
-    sprintf(fn, "%s%cconfig%cdse_original.ldif", cs_path, FILE_PATHSEP, FILE_PATHSEP);
+    PR_snprintf(src, sizeof(src), "%s%cconfig%cdse.ldif", cs_path, FILE_PATHSEP, FILE_PATHSEP);
+    PR_snprintf(fn, sizeof(fn), "%s%cconfig%cdse_original.ldif", cs_path, FILE_PATHSEP, FILE_PATHSEP);
     create_instance_copy(src, fn, 0600);
 
     /*
      * generate slapd-collations.conf
      */
-    sprintf(src, "%s%cbin%c"PRODUCT_NAME"%cinstall%cconfig%c%s-collations.conf",
+    PR_snprintf(src, sizeof(src), "%s%cbin%c"PRODUCT_NAME"%cinstall%cconfig%c%s-collations.conf",
             sroot, FILE_PATHSEP, FILE_PATHSEP, FILE_PATHSEP, FILE_PATHSEP, 
             FILE_PATHSEP, PRODUCT_NAME);
-    sprintf(dest, "%s%cconfig%c%s-collations.conf", cs_path, FILE_PATHSEP,
+    PR_snprintf(dest, sizeof(dest), "%s%cconfig%c%s-collations.conf", cs_path, FILE_PATHSEP,
             FILE_PATHSEP, PRODUCT_NAME);
     if (!(srcf = fopen(src, "r"))) {
         return make_error("Can't read from %s (%s)", src, ds_system_errmsg());
@@ -3976,20 +3972,20 @@ char *ds_gen_confs(char *sroot, server_config_s *cf,
     fclose(srcf);
     fclose(f);
 
-    sprintf(src, "%s/bin/slapd/install/schema", sroot);
-    sprintf(dest, "%s/config/schema", cs_path);
+    PR_snprintf(src, sizeof(src), "%s/bin/slapd/install/schema", sroot);
+    PR_snprintf(dest, sizeof(dest), "%s/config/schema", cs_path);
     if (NULL != (t = ds_copy_group_files(src, dest, 0)))
         return t;
         
 #if defined (BUILD_PRESENCE)
-    sprintf(src, "%s/bin/slapd/install/presence", sroot);
-    sprintf(dest, "%s/config/presence", cs_path);
+    PR_snprintf(src, sizeof(src), "%s/bin/slapd/install/presence", sroot);
+    PR_snprintf(dest, sizeof(dest), "%s/config/presence", cs_path);
     if (t = ds_copy_group_files(src, dest, 0))
         return t;
 #endif
 
     /* Generate the orgchart configuration */
-    sprintf(src, "%s/clients", sroot);
+    PR_snprintf(src, sizeof(src), "%s/clients", sroot);
     if (is_a_dir(src, "orgchart")) {
         if (NULL != (t = ds_gen_orgchart_conf(sroot, cs_path, cf))) {
             return t;
@@ -3997,7 +3993,7 @@ char *ds_gen_confs(char *sroot, server_config_s *cf,
     }
         
     /* Generate dsgw.conf */
-    sprintf(src, "%s/clients", sroot);
+    PR_snprintf(src, sizeof(src), "%s/clients", sroot);
     if (is_a_dir(src, "dsgw")) {
         if (NULL != (t = ds_gen_gw_conf(sroot, cs_path, cf, GW_CONF))) {
             return t;
@@ -4045,7 +4041,7 @@ ds_gen_gw_conf(char *sroot, char *cs_path, server_config_s *cf, int conf_type)
      * copying the rest from NS-HOME/dsgw/config/dsgw.tmpl
      */
 
-    sprintf(dest, "%s%cclients%cdsgw%ccontext%c%s.conf", sroot, FILE_PATHSEP,FILE_PATHSEP,
+    PR_snprintf(dest, sizeof(dest), "%s%cclients%cdsgw%ccontext%c%s.conf", sroot, FILE_PATHSEP,FILE_PATHSEP,
         FILE_PATHSEP, FILE_PATHSEP, ctxt);
 
 
@@ -4082,10 +4078,10 @@ ds_gen_gw_conf(char *sroot, char *cs_path, server_config_s *cf, int conf_type)
 
     /* copy in template */
     if (conf_type == GW_CONF) {
-        sprintf(src, "%s%cclients%cdsgw%cconfig%cdsgw.tmpl",
+        PR_snprintf(src, sizeof(src), "%s%cclients%cdsgw%cconfig%cdsgw.tmpl",
             sroot, FILE_PATHSEP, FILE_PATHSEP, FILE_PATHSEP, FILE_PATHSEP);
     } else if (conf_type == PB_CONF) {
-        sprintf(src, "%s%cclients%cdsgw%cpbconfig%cpb.tmpl",
+        PR_snprintf(src, sizeof(src), "%s%cclients%cdsgw%cpbconfig%cpb.tmpl",
             sroot, FILE_PATHSEP,FILE_PATHSEP, FILE_PATHSEP, FILE_PATHSEP);
     } else {
         /*This should never, ever happen if this function is called correctly*/
@@ -4123,7 +4119,7 @@ ds_gen_gw_conf(char *sroot, char *cs_path, server_config_s *cf, int conf_type)
         }
 #endif
 
-        sprintf(defaultconf, "%s%cclients%cdsgw%ccontext%cdefault.conf", sroot, 
+        PR_snprintf(defaultconf, sizeof(defaultconf), "%s%cclients%cdsgw%ccontext%cdefault.conf", sroot, 
           FILE_PATHSEP,FILE_PATHSEP, FILE_PATHSEP, FILE_PATHSEP);
 
         create_instance_copy(dest, defaultconf, NEWFILE_MODE);
@@ -4159,9 +4155,9 @@ ds_gen_orgchart_conf(char *sroot, char *cs_path, server_config_s *cf)
      * install-specific config. file lines at the start of file, and then
      * copying the rest from NS-HOME/clients/orgchart/config.tmpl
      */
-    sprintf(dest, "%s%cclients%corgchart%cconfig.txt", sroot, FILE_PATHSEP,
+    PR_snprintf(dest, sizeof(dest), "%s%cclients%corgchart%cconfig.txt", sroot, FILE_PATHSEP,
         FILE_PATHSEP, FILE_PATHSEP );
-    sprintf(src, "%s%cclients%corgchart%cconfig.tmpl", sroot, FILE_PATHSEP, 
+    PR_snprintf(src, sizeof(src), "%s%cclients%corgchart%cconfig.tmpl", sroot, FILE_PATHSEP, 
         FILE_PATHSEP, FILE_PATHSEP);
 
     /* If the config file already exists, just return success */
@@ -4229,9 +4225,9 @@ static char *gen_presence_init_script(char *sroot, server_config_s *cf,
     char dir[PATH_SIZE];
     FILE *f;
 
-    sprintf(dir, "%s%cconfig%cpresence",
+    PR_snprintf(dir, sizeof(dir), "%s%cconfig%cpresence",
             cs_path, FILE_PATHSEP, FILE_PATHSEP);
-    sprintf(fn, "%s%c%s",
+    PR_snprintf(fn, sizeof(fn), "%s%c%s",
             dir, FILE_PATHSEP, PRESENCE_LDIF);
 
     if(!(f = fopen(fn, "w")))  
@@ -4309,13 +4305,13 @@ static int init_presence(char *sroot, server_config_s *cf, char *cs_path)
     char precmd[PATH_SIZE];
 
     precmd[0] = 0;
-    sprintf(tools, "%s%cshared%cbin", sroot, FILE_PATHSEP, FILE_PATHSEP);    
+    PR_snprintf(tools, sizeof(tools), "%s%cshared%cbin", sroot, FILE_PATHSEP, FILE_PATHSEP);    
 
 #ifdef XP_UNIX
-    sprintf(precmd, "cd %s;", tools);
+    PR_snprintf(precmd, sizeof(precmd), "cd %s;", tools);
 #endif
 
-    sprintf(cmd, "%s%s%cldapmodify -q -p %d -b -D \"%s\" -w \"%s\" "
+    PR_snprintf(cmd, sizeof(cmd), "%s%s%cldapmodify -q -p %d -b -D \"%s\" -w \"%s\" "
             "-f %s%s%cconfig%cpresence%c%s%s",
             precmd,
             tools, FILE_PATHSEP,
@@ -4342,6 +4338,7 @@ static void
 ds_gen_index(FILE* f, char* belowdn)
 {
 #define MKINDEX(_name, _inst, _sys, _type1, _type2, _type3) do { \
+	char *_type2str = (_type2), *_type3str = (_type3); \
     fprintf(f, "dn: cn=%s,%s\n", (_name), (_inst)); \
     fprintf(f, "objectclass: top\n"); \
     fprintf(f, "objectclass: nsIndex\n"); \
@@ -4349,10 +4346,10 @@ ds_gen_index(FILE* f, char* belowdn)
     fprintf(f, "nssystemindex: %s\n", (_sys) ? "true" : "false"); \
 	if (_type1) \
         fprintf(f, "nsindextype: %s\n", (_type1)); \
-    if (_type2) \
-        fprintf(f, "nsindextype: %s\n", (_type2)); \
-    if (_type3) \
-        fprintf(f, "nsindextype: %s\n", (_type3)); \
+    if (_type2str) \
+        fprintf(f, "nsindextype: %s\n", _type2str); \
+    if (_type3str) \
+        fprintf(f, "nsindextype: %s\n", _type3str); \
     fprintf(f, "\n"); \
 } while (0)
 
@@ -4409,7 +4406,7 @@ static char *install_ds(char *sroot, server_config_s *cf, char *param_name)
     }
 #endif
     
-    sprintf(cs_path, "%s%c"PRODUCT_NAME"-%s", sroot, FILE_PATHSEP, cf->servid);
+    PR_snprintf(cs_path, sizeof(cs_path), "%s%c"PRODUCT_NAME"-%s", sroot, FILE_PATHSEP, cf->servid);
 
     /* create all <a_server>/<subdirs> */
     if ( (t = ds_cre_subdirs(sroot, cf, cs_path, pw)) )
@@ -4428,46 +4425,46 @@ static char *install_ds(char *sroot, server_config_s *cf, char *param_name)
     if ( (t = ds_gen_confs(sroot, cf, cs_path)) )
         return(t);
 
-    sprintf(src, "%s%cbin%c"PRODUCT_NAME"%cinstall%cldif%cExample.ldif", sroot, FILE_PATHSEP, FILE_PATHSEP, FILE_PATHSEP, FILE_PATHSEP, 
+    PR_snprintf(src, sizeof(src), "%s%cbin%c"PRODUCT_NAME"%cinstall%cldif%cExample.ldif", sroot, FILE_PATHSEP, FILE_PATHSEP, FILE_PATHSEP, FILE_PATHSEP, 
         FILE_PATHSEP);
-    sprintf(dest, "%s%cldif%cExample.ldif", cs_path, FILE_PATHSEP, FILE_PATHSEP);
+    PR_snprintf(dest, sizeof(dest), "%s%cldif%cExample.ldif", cs_path, FILE_PATHSEP, FILE_PATHSEP);
     create_instance_copy(src, dest, NEWFILE_MODE);
     chownfile (pw, dest);
 
-    sprintf(src, "%s%cbin%c"PRODUCT_NAME"%cinstall%cldif%cExample-roles.ldif", sroot, FILE_PATHSEP, FILE_PATHSEP, FILE_PATHSEP, FILE_PATHSEP, 
+    PR_snprintf(src, sizeof(src), "%s%cbin%c"PRODUCT_NAME"%cinstall%cldif%cExample-roles.ldif", sroot, FILE_PATHSEP, FILE_PATHSEP, FILE_PATHSEP, FILE_PATHSEP, 
         FILE_PATHSEP);
-    sprintf(dest, "%s%cldif%cExample-roles.ldif", cs_path, FILE_PATHSEP, FILE_PATHSEP);
+    PR_snprintf(dest, sizeof(dest), "%s%cldif%cExample-roles.ldif", cs_path, FILE_PATHSEP, FILE_PATHSEP);
     create_instance_copy(src, dest, NEWFILE_MODE);
     chownfile (pw, dest);
 
-    sprintf(src, "%s%cbin%c"PRODUCT_NAME"%cinstall%cldif%cExample-views.ldif", sroot, FILE_PATHSEP, FILE_PATHSEP, FILE_PATHSEP, FILE_PATHSEP, 
+    PR_snprintf(src, sizeof(src), "%s%cbin%c"PRODUCT_NAME"%cinstall%cldif%cExample-views.ldif", sroot, FILE_PATHSEP, FILE_PATHSEP, FILE_PATHSEP, FILE_PATHSEP, 
         FILE_PATHSEP);
-    sprintf(dest, "%s%cldif%cExample-views.ldif", cs_path, FILE_PATHSEP, FILE_PATHSEP);
+    PR_snprintf(dest, sizeof(dest), "%s%cldif%cExample-views.ldif", cs_path, FILE_PATHSEP, FILE_PATHSEP);
     create_instance_copy(src, dest, NEWFILE_MODE);
     chownfile (pw, dest);
 
-    sprintf(src, "%s%cbin%c"PRODUCT_NAME"%cinstall%cldif%cEuropean.ldif", sroot, FILE_PATHSEP, FILE_PATHSEP, FILE_PATHSEP, FILE_PATHSEP, 
+    PR_snprintf(src, sizeof(src), "%s%cbin%c"PRODUCT_NAME"%cinstall%cldif%cEuropean.ldif", sroot, FILE_PATHSEP, FILE_PATHSEP, FILE_PATHSEP, FILE_PATHSEP, 
     FILE_PATHSEP);
-    sprintf(dest, "%s%cldif%cEuropean.ldif", cs_path, FILE_PATHSEP, FILE_PATHSEP);
+    PR_snprintf(dest, sizeof(dest), "%s%cldif%cEuropean.ldif", cs_path, FILE_PATHSEP, FILE_PATHSEP);
     create_instance_copy(src, dest, NEWFILE_MODE);
     chownfile (pw, dest);
 
     /* new code for dsml sample files */
-    sprintf(src, "%s%cbin%c"PRODUCT_NAME"%cinstall%cdsml%cExample.dsml", sroot, FILE_PATHSEP, FILE_PATHSEP, FILE_PATHSEP, FILE_PATHSEP, 
+    PR_snprintf(src, sizeof(src), "%s%cbin%c"PRODUCT_NAME"%cinstall%cdsml%cExample.dsml", sroot, FILE_PATHSEP, FILE_PATHSEP, FILE_PATHSEP, FILE_PATHSEP, 
         FILE_PATHSEP);
-    sprintf(dest, "%s%cdsml%cExample.dsml", cs_path, FILE_PATHSEP, FILE_PATHSEP);
+    PR_snprintf(dest, sizeof(dest), "%s%cdsml%cExample.dsml", cs_path, FILE_PATHSEP, FILE_PATHSEP);
     create_instance_copy(src, dest, NEWFILE_MODE);
     chownfile (pw, dest);
 
-    sprintf(src, "%s%cbin%c"PRODUCT_NAME"%cinstall%cdsml%cExample-roles.dsml", sroot, FILE_PATHSEP, FILE_PATHSEP, FILE_PATHSEP, FILE_PATHSEP, 
+    PR_snprintf(src, sizeof(src), "%s%cbin%c"PRODUCT_NAME"%cinstall%cdsml%cExample-roles.dsml", sroot, FILE_PATHSEP, FILE_PATHSEP, FILE_PATHSEP, FILE_PATHSEP, 
         FILE_PATHSEP);
-    sprintf(dest, "%s%cdsml%cExample-roles.dsml", cs_path, FILE_PATHSEP, FILE_PATHSEP);
+    PR_snprintf(dest, sizeof(dest), "%s%cdsml%cExample-roles.dsml", cs_path, FILE_PATHSEP, FILE_PATHSEP);
     create_instance_copy(src, dest, NEWFILE_MODE);
     chownfile (pw, dest);
 
-    sprintf(src, "%s%cbin%c"PRODUCT_NAME"%cinstall%cdsml%cEuropean.dsml", sroot, FILE_PATHSEP, FILE_PATHSEP, FILE_PATHSEP, FILE_PATHSEP, 
+    PR_snprintf(src, sizeof(src), "%s%cbin%c"PRODUCT_NAME"%cinstall%cdsml%cEuropean.dsml", sroot, FILE_PATHSEP, FILE_PATHSEP, FILE_PATHSEP, FILE_PATHSEP, 
         FILE_PATHSEP);
-    sprintf(dest, "%s%cdsml%cEuropean.dsml", cs_path, FILE_PATHSEP, FILE_PATHSEP);
+    PR_snprintf(dest, sizeof(dest), "%s%cdsml%cEuropean.dsml", cs_path, FILE_PATHSEP, FILE_PATHSEP);
     create_instance_copy(src, dest, NEWFILE_MODE);
     chownfile (pw, dest);
 
@@ -4480,10 +4477,10 @@ static char *install_ds(char *sroot, server_config_s *cf, char *param_name)
     char msg[2*PATH_SIZE] = {0};
     int status = ds_ldif2db_backend_subtree(cf->install_ldif_file, NULL, cf->suffix);
     if (status)
-        sprintf(msg, "The file %s could not be loaded",
+        PR_snprintf(msg, sizeof(msg), "The file %s could not be loaded",
             cf->install_ldif_file);
     else
-        sprintf(msg, "The file %s was successfully loaded",
+        PR_snprintf(msg, sizeof(msg), "The file %s was successfully loaded",
             cf->install_ldif_file);
     ds_show_message(msg);
     free(cf->install_ldif_file);
@@ -4500,7 +4497,7 @@ static char *install_ds(char *sroot, server_config_s *cf, char *param_name)
     if(needToStartServer(cf) &&
        !(t = create_instance_checkport(cf->bindaddr, cf->servport)))
     {
-    sprintf(big_line,"SERVER_NAMES=slapd-%s",cf->servid);
+    PR_snprintf(big_line, sizeof(big_line),"SERVER_NAMES=slapd-%s",cf->servid);
     putenv(big_line);
 
     isrunning = ds_get_updown_status();
@@ -4514,10 +4511,10 @@ static char *install_ds(char *sroot, server_config_s *cf, char *param_name)
         if (getenv("USE_DEBUGGER"))
         verbose = 0;
         /* slapd-nickname directory */
-        sprintf(instance_dir, "%s%c"PRODUCT_NAME"-%s", sroot, FILE_PATHSEP, 
+        PR_snprintf(instance_dir, sizeof(instance_dir), "%s%c"PRODUCT_NAME"-%s", sroot, FILE_PATHSEP, 
             cf->servid);
         /* error log file */
-        sprintf(errorlog, "%s%clogs%cerrors", instance_dir, FILE_PATHSEP,
+        PR_snprintf(errorlog, sizeof(errorlog), "%s%clogs%cerrors", instance_dir, FILE_PATHSEP,
             FILE_PATHSEP);
         start_status = ds_bring_up_server_install(verbose, instance_dir, errorlog);
 
@@ -4575,7 +4572,7 @@ static char *install_ds(char *sroot, server_config_s *cf, char *param_name)
         char szTmp[512];
     /*replaced errno > -1 && errno < sys_nerr ? sys_errlist[errno] :
                     "unknown" with strerror(errno)*/
-        sprintf(szTmp, "Error: Windows Sockets initialization failed errno %d (%s)<br>\n", errno,
+        PR_snprintf(szTmp, sizeof(szTmp), "Error: Windows Sockets initialization failed errno %d (%s)<br>\n", errno,
             strerror(errno), 0 );
             
         fprintf (stdout, szTmp);
@@ -4658,8 +4655,7 @@ write_ldap_info( char *slapd_server_root, server_config_s *cf)
       return -1;
     }
     
-    infoFileName = (char*)malloc(strlen(fmt) + strlen(slapd_server_root) + 1);
-    sprintf(infoFileName, fmt, slapd_server_root);
+    infoFileName = PR_smprintf(fmt, slapd_server_root);
 
     if ((fp = fopen(infoFileName, "w")) == NULL)
     {
@@ -4689,7 +4685,7 @@ write_ldap_info( char *slapd_server_root, server_config_s *cf)
         logUninstallInfo(slapd_server_root, PRODUCT_NAME, PRODUCT_NAME, infoFileName);
   
 #endif /* SOLARIS */
-    free(infoFileName);
+    PR_smprintf_free(infoFileName);
 
     return ret;
 }
diff --git a/ldap/admin/src/ds_db2bak.c b/ldap/admin/src/ds_db2bak.c
index 2a40273d..be11e937 100644
--- a/ldap/admin/src/ds_db2bak.c
+++ b/ldap/admin/src/ds_db2bak.c
@@ -19,6 +19,7 @@
 #ifdef XP_UNIX
 #include <unistd.h>
 #endif
+#include "nspr.h"
 
 int main(int argc, char *argv[])
 {
@@ -50,7 +51,7 @@ int main(int argc, char *argv[])
 		FILE *f;
 		/* Now attempt to create a file there (the directory might
 		   already have existed */
-		sprintf( foo, "%s%c%s", filename, FILE_PATHSEP, "foo" );
+		PR_snprintf( foo, sizeof(foo), "%s%c%s", filename, FILE_PATHSEP, "foo" );
 		f = fopen(foo, "w");
 		if ( NULL != f ) {
 			status = 0;
diff --git a/ldap/admin/src/ds_ldif2db.c b/ldap/admin/src/ds_ldif2db.c
index ef1ee4f0..c0c91815 100644
--- a/ldap/admin/src/ds_ldif2db.c
+++ b/ldap/admin/src/ds_ldif2db.c
@@ -16,6 +16,9 @@
 #include "dsalib.h"
 #include "init_ds_env.h"
 #include <string.h>
+#ifdef XP_UNIX
+#include <unistd.h>
+#endif
 
 int main(int argc, char *argv[])
 {
diff --git a/ldap/admin/src/ds_remove.c b/ldap/admin/src/ds_remove.c
index bb920ab9..be538d58 100644
--- a/ldap/admin/src/ds_remove.c
+++ b/ldap/admin/src/ds_remove.c
@@ -167,7 +167,7 @@ int main(int argc, char *argv[])
 	if((isRunning = ds_get_updown_status()) == DS_SERVER_UP) {
 		if ((status = ds_bring_down_server()) != DS_SERVER_DOWN) {
 			char buf[1024];
-			sprintf(buf, "Could not stop server: error %d", status);
+			PR_snprintf(buf, sizeof(buf), "Could not stop server: error %d", status);
 			ds_report_error (DS_GENERAL_FAILURE, servername, buf);
 			return 1;
 		}
@@ -182,8 +182,8 @@ int main(int argc, char *argv[])
 		   and try again */
 		status = ds_rm_rf(installroot, rm_rf_err_func, NULL);
 		while (status && try_rm_rf_again && busy_retries) {
-			sprintf(line, "Some files or directories in %s are still in use.  Will sleep for 30 seconds and try again.",
-					installroot);
+			PR_snprintf(line, sizeof(line), "Some files or directories in %s are still in use.  Will sleep for 30 seconds and try again.",
+						installroot);
 			ds_show_message(line);
 			PR_Sleep(PR_SecondsToInterval(30));
 			try_rm_rf_again = 0;
@@ -191,8 +191,8 @@ int main(int argc, char *argv[])
 			status = ds_rm_rf(installroot, rm_rf_err_func, NULL);
 		}
 		if (status) {
-			sprintf(line, "Could not remove %s.  Please check log messages and try again.",
-					installroot);
+			PR_snprintf(line, sizeof(line), "Could not remove %s.  Please check log messages and try again.",
+						installroot);
 			ds_send_error(line, 0);
 		}
 	}
@@ -221,12 +221,12 @@ int main(int argc, char *argv[])
 
 	if (status == 0) {
 		char buf[1024];
-		sprintf(buf, "Server %s was successfully removed", servername);
+		PR_snprintf(buf, sizeof(buf), "Server %s was successfully removed", servername);
 		ds_show_message(buf);
 		rpt_success("");
 	} else {
 		char buf[1024];
-		sprintf(buf, "Could not remove server %s", servername);
+		PR_snprintf(buf, sizeof(buf), "Could not remove server %s", servername);
 		ds_send_error(buf, 0);
 	}
 
diff --git a/ldap/admin/src/ds_remove_uninst.cpp b/ldap/admin/src/ds_remove_uninst.cpp
index a2495f43..981534eb 100644
--- a/ldap/admin/src/ds_remove_uninst.cpp
+++ b/ldap/admin/src/ds_remove_uninst.cpp
@@ -58,7 +58,7 @@ dsLogMessage(const char *level, const char *which,
 	char bigbuf[BIG_BUF*4];
 	va_list ap;
 	va_start(ap, format);
-	PR_vsnprintf(bigbuf, BIG_BUF*4, format, ap);
+	PR_vsnprintf(bigbuf, sizeof(bigbuf), format, ap);
 	va_end(ap);
 #ifdef _WIN32 // always output to stdout (for CGIs), and always log
 	// if a log is available
@@ -175,7 +175,6 @@ int removeInstanceLDAPEntries(const char *pszLdapHost,
 							   const char *pszInstanceHost,
 							   const char *pszServerRoot)
 {
-	LDAP *ld			= NULL;
 	char szSearchBase[] = "o=NetscapeRoot";
 
 	/* open LDAP connection */
@@ -263,26 +262,26 @@ int ds_uninst_set_cgi_env(char *pszInfoFileName)
 		serverID = ds_get_server_name();
 
 	if (serverID)
-		sprintf(szQueryString, "QUERY_STRING=InstanceName=%s",
-				serverID);
+		PR_snprintf(szQueryString, sizeof(szQueryString), "QUERY_STRING=InstanceName=%s",
+					serverID);
 
 	putenv(szQueryString);
 
 	if (instanceInfo->get(SLAPD_KEY_SERVER_ROOT))
-		sprintf(szNetsiteRoot, "NETSITE_ROOT=%s",
-				instanceInfo->get(SLAPD_KEY_SERVER_ROOT));
+		PR_snprintf(szNetsiteRoot, sizeof(szNetsiteRoot), "NETSITE_ROOT=%s",
+					instanceInfo->get(SLAPD_KEY_SERVER_ROOT));
 	putenv(szNetsiteRoot);
 
 	if (serverID)
-		sprintf(szScriptName, "SCRIPT_NAME=/%s/Tasks/Operation/Remove",
-				serverID);
+		PR_snprintf(szScriptName, sizeof(szScriptName), "SCRIPT_NAME=/%s/Tasks/Operation/Remove",
+					serverID);
 	putenv(szScriptName);
 
 	// remove SIE entry
 	const char *host = instanceInfo->get(SLAPD_KEY_K_LDAP_HOST);
 	char port[20] = {0};
 	if (instanceInfo->get(SLAPD_KEY_K_LDAP_PORT))
-		strcpy(port, instanceInfo->get(SLAPD_KEY_K_LDAP_PORT));
+		strncpy(port, instanceInfo->get(SLAPD_KEY_K_LDAP_PORT), sizeof(port)-1);
 	const char *suffix = instanceInfo->get(SLAPD_KEY_SUFFIX);
 	const char *ldapurl = instanceInfo->get(SLAPD_KEY_K_LDAP_URL);
 	LDAPURLDesc *desc = 0;
@@ -290,16 +289,16 @@ int ds_uninst_set_cgi_env(char *pszInfoFileName)
 		if (!host)
 			host = desc->lud_host;
 		if (port[0] == 0)
-			sprintf(port, "%d", desc->lud_port);
+			PR_snprintf(port, sizeof(port), "%d", desc->lud_port);
 		if (!suffix)
 			suffix = desc->lud_dn;
 	}
 
 	// get and set the log file
-	if (tmp = instanceInfo->get(SLAPD_INSTALL_LOG_FILE_NAME))
+	if ((tmp = instanceInfo->get(SLAPD_INSTALL_LOG_FILE_NAME)))
 	{
 		static char s_logfile[PATH_MAX+32];
-		PR_snprintf(s_logfile, PATH_MAX+32, "DEBUG_LOGFILE=%s", tmp);
+		PR_snprintf(s_logfile, sizeof(s_logfile), "DEBUG_LOGFILE=%s", tmp);
 		putenv(s_logfile);
 		installLog = new InstallLog(tmp);
 	}
diff --git a/ldap/admin/src/ds_rmdb.c b/ldap/admin/src/ds_rmdb.c
index a2701781..70cc950b 100644
--- a/ldap/admin/src/ds_rmdb.c
+++ b/ldap/admin/src/ds_rmdb.c
@@ -20,6 +20,7 @@
 #ifdef XP_UNIX
 #include <unistd.h>
 #endif
+#include "nspr.h"
 
 #ifndef MAXPATHLEN
 #define MAXPATHLEN	1024
@@ -29,8 +30,6 @@ int main(int argc, char *argv[], char *envp[])
 {
     char *del_file = NULL;
     char **bak_files;
-    int	file_count = 0;
-    int err = 0;
 
     fprintf(stdout, "Content-type: text/html\n\n");
 
@@ -56,7 +55,7 @@ int main(int argc, char *argv[], char *envp[])
 		int j;
 		char buf[ MAXPATHLEN ];
 		for ( j = 0; bak_files[ j ] != NULL; j++ ) {
-			sprintf( buf, "%s/%s", del_file, bak_files[ j ]);
+			PR_snprintf( buf, sizeof(buf), "%s/%s", del_file, bak_files[ j ]);
 			if (  unlink(buf) != 0 ) {
 				rpt_err( DS_CANNOT_DELETE_FILE, buf, NULL, NULL );
 				return 1;
diff --git a/ldap/admin/src/ds_snmpctrl.c b/ldap/admin/src/ds_snmpctrl.c
index 83c32a1d..9dfe1e6c 100644
--- a/ldap/admin/src/ds_snmpctrl.c
+++ b/ldap/admin/src/ds_snmpctrl.c
@@ -16,6 +16,7 @@
 #include "libadminutil/admutil.h"
 #include "dsalib.h"
 #include "init_ds_env.h"
+#include "nspr.h"
 
 #if !defined(_WIN32)
 #include <signal.h>
@@ -51,7 +52,6 @@ int nsldapagt_restart(void);
 int main(int argc, char *argv[])
 {
 	char *action_type     = NULL;
-    int haderror=0;
 	int status = 1;
 
 	fprintf(stdout, "Content-type: text/html\n\n");
@@ -94,7 +94,7 @@ get_nsldapagt_pid(pid_t *pid)
    *pid = -1;
 
    SLAPD_ROOT = ds_get_install_root();
-   sprintf(path, "%s/logs/%s", SLAPD_ROOT, NSLDAPAGT_PID);
+   PR_snprintf(path, sizeof(path), "%s/logs/%s", SLAPD_ROOT, NSLDAPAGT_PID);
    if (!ds_file_exists(path)) {
       return(-1);
    }
@@ -193,7 +193,7 @@ smux_master_is_running()
    sin.sin_family = AF_INET;
    sin.sin_addr.s_addr = INADDR_ANY;
 
-   if (pse = getservbyname("smux", "tcp")) {
+   if ((pse = getservbyname("smux", "tcp"))) {
       sin.sin_port = ntohs(pse->s_port);
    } else {
       sin.sin_port = 199;
@@ -245,7 +245,7 @@ nsldapagt_start()
 	   char *SLAPD_ROOT = ds_get_install_root();
 	   char command[1024];
 
-	   sprintf(command, "cd %s/%s; ./%s -d %s", NETSITE_ROOT, SUBAGT_PATH,
+	   PR_snprintf(command, sizeof(command), "cd %s/%s; ./%s -d %s", NETSITE_ROOT, SUBAGT_PATH,
            SUBAGT_NAME, SLAPD_ROOT);
 
 	   (void) system(command);
diff --git a/ldap/admin/src/init_ds_env.c b/ldap/admin/src/init_ds_env.c
index f2eed60c..9803762e 100644
--- a/ldap/admin/src/init_ds_env.c
+++ b/ldap/admin/src/init_ds_env.c
@@ -22,8 +22,8 @@ int init_ds_env()
     char *m = getenv("REQUEST_METHOD");
     char *qs              = NULL;
 	int proceed = 0;
-    int _ai = ADMUTIL_Init();
 
+	(void)ADMUTIL_Init();
 	if ( m != NULL ) {
 		if( !strcmp(m, "GET") )  {
 			qs = GET_QUERY_STRING();
@@ -42,7 +42,7 @@ int init_ds_env()
  
 	if(!proceed) {
 		char msg[2000];
-		sprintf(msg, "ErrorString: REQUEST_METHOD=%s,"
+		PR_snprintf(msg, sizeof(msg), "ErrorString: REQUEST_METHOD=%s,"
 				"QUERY_STRING=%s\n", 
 				(m == NULL) ? "<undefined>" : m, 
 				(qs == NULL) ? "<undefined>" : qs);
diff --git a/ldap/admin/src/instindex.cpp b/ldap/admin/src/instindex.cpp
index 181b4962..04ef1998 100644
--- a/ldap/admin/src/instindex.cpp
+++ b/ldap/admin/src/instindex.cpp
@@ -89,12 +89,10 @@ static int check_passwords(char *pw1, char *pw2)
 
 static int parse_form(server_config_s *cf)
 {
-    char *sroot=NULL, *servname=NULL;
     char *rm = getenv("REQUEST_METHOD");
     char *qs = getenv("QUERY_STRING");
     char* cfg_sspt_uid_pw1;
     char* cfg_sspt_uid_pw2;
-    int len = 0;
     LDAPURLDesc *desc = 0;
     char *temp = 0;
 
@@ -271,24 +269,18 @@ static int parse_form(server_config_s *cf)
 	char *suffix = dn_normalize_convert(strdup(cf->netscaperoot));
 	/* the config ds connection may require SSL */
 	int isSSL = !strncmp(temp, "ldaps:", strlen("ldaps:"));
-	len = strlen("ldap://") + 1 + strlen(desc->lud_host) + strlen(":") +
-	    6 + strlen("/") + strlen(suffix);
-	cf->config_ldap_url = (char *)calloc(len+1, 1);
-	sprintf(cf->config_ldap_url, "ldap%s://%s:%d/%s",
-		(isSSL ? "s" : ""), desc->lud_host, desc->lud_port, suffix);
+	cf->config_ldap_url = PR_smprintf("ldap%s://%s:%d/%s",
+									  (isSSL ? "s" : ""), desc->lud_host,
+									  desc->lud_port, suffix);
 	ldap_free_urldesc(desc);
     }
 
     /* if being called as a CGI, the user_ldap_url will be the directory
        we're creating */
-    len = strlen("ldap://") + strlen(cf->servname) + strlen(":") +
-	strlen(cf->servport) + strlen("/") + strlen(cf->suffix);
-    cf->user_ldap_url = (char *)calloc(len+1, 1);
     /* this is the directory we're creating, and we cannot create an ssl
-       directory, so we don't have to worry about ldap vs ldaps here */
-    
-    sprintf(cf->user_ldap_url, "ldap://%s:%s/%s", cf->servname,
-	    cf->servport, cf->suffix);
+       directory, so we don't have to worry about ldap vs ldaps here */    
+    cf->user_ldap_url = PR_smprintf("ldap://%s:%s/%s", cf->servname,
+									cf->servport, cf->suffix);
 
     cf->samplesuffix = NULL;
 
@@ -330,7 +322,8 @@ int main(int argc, char *argv[], char */*envp*/[])
 	int reconfig = 0;
 	int ii = 0;
 	int cgi = 0;
-	int _ai = ADMUTIL_Init();
+
+	(void)ADMUTIL_Init();
 	
 	/* Initialize NSS to make ds_salted_sha1_pw_enc() happy */
 	if (NSS_NoDB_Init(NULL) != SECSuccess) {
diff --git a/ldap/admin/src/latest_file.c b/ldap/admin/src/latest_file.c
index 5703d794..bb9af07d 100644
--- a/ldap/admin/src/latest_file.c
+++ b/ldap/admin/src/latest_file.c
@@ -69,12 +69,12 @@ int main (int argc, char **argv)
 		return -1;
 	}
 
-	sprintf( latest, "%s\\%s", dir, fileinfo.name );
+	PR_snprintf( latest, sizeof(latest), "%s\\%s", dir, fileinfo.name );
 	latest_time = fileinfo.time_create;
 
 	while( _findnext( hFile, &fileinfo ) == 0 ) {
 		if ( fileinfo.time_create > latest_time ) {
-			sprintf( latest, "%s\\%s", dir, fileinfo.name );
+			PR_snprintf( latest, sizeof(latest)-1, "%s\\%s", dir, fileinfo.name );
 			latest_time = fileinfo.time_create;
 		}
 	}
diff --git a/ldap/admin/src/namegen.c b/ldap/admin/src/namegen.c
index 3b24873b..bdb8c4e1 100644
--- a/ldap/admin/src/namegen.c
+++ b/ldap/admin/src/namegen.c
@@ -46,7 +46,7 @@ int main (int argc, char **argv)
 	strftime(szDate, sizeof (szDateFile), "%Y_%m_%d_%H%M%S", 
              sCurTime);
 
-    sprintf (szDateFile, "%s.bat", szDate);
+    PR_snprintf (szDateFile, sizeof(szDateFile), "%s.bat", szDate);
 
     /* create date batch file */
     fBatch = fopen (szDateFile, "w");
@@ -73,7 +73,7 @@ int main (int argc, char **argv)
         exit (1);
     }
 
-    sprintf (szCmd, "call %s", szDate);
+    PR_snprintf (szCmd, sizeof(szCmd), "call %s", szDate);
 
     rt = fwrite (szCmd, strlen (szCmd), 1, fBatch);
     if (rt != 1)
@@ -92,7 +92,7 @@ int main (int argc, char **argv)
         exit (1);
     }
 
-    sprintf (szCmd, "del %s\ndel bstart.bat\nset DATESTR=", szDateFile);
+    PR_snprintf (szCmd, sizeof(szCmd), "del %s\ndel bstart.bat\nset DATESTR=", szDateFile);
 
     rt = fwrite (szCmd, strlen(szCmd), 1, fBatch);
     if (rt != 1)
diff --git a/ldap/admin/src/start.c b/ldap/admin/src/start.c
index 011289f8..31a24ff8 100644
--- a/ldap/admin/src/start.c
+++ b/ldap/admin/src/start.c
@@ -19,12 +19,9 @@
 #include "init_ds_env.h"
 
 
-static char buf[1024];
-
 int main(int argc, char *argv[])
 {
     int status = -1;
-	char *instanceName = 0;
 
     fprintf(stdout, "Content-type: text/html\n\n");
 
diff --git a/ldap/clients/dsgw/cgiutil.c b/ldap/clients/dsgw/cgiutil.c
index be2ba3db..a95fa441 100644
--- a/ldap/clients/dsgw/cgiutil.c
+++ b/ldap/clients/dsgw/cgiutil.c
@@ -380,7 +380,6 @@ dsgw_convert(
     const char *mySource;
     const char *destLimit;
     const char *sourceLimit;
-    int32_t destCapacity=0;
     int destAlloc = 0; /* set to true if we allocated *dest */
 
     *pErrorCode = U_ZERO_ERROR;
diff --git a/ldap/clients/dsgw/collate.c b/ldap/clients/dsgw/collate.c
index 23ef759e..0e421a9b 100644
--- a/ldap/clients/dsgw/collate.c
+++ b/ldap/clients/dsgw/collate.c
@@ -38,7 +38,6 @@ SetUnicodeStringFromUTF_8 (UChar** U, int32_t* Ulen, int *isAlloced, const char
        Ulen is set to the number of UChars in the array (not necessarily the number of bytes!)
     */
 {
-    size_t n;
     int32_t len = 0; /* length of non-space string */
     int32_t needLen = 0; /* number of bytes needed for string */
     UErrorCode err = U_ZERO_ERROR;
@@ -363,7 +362,7 @@ dsgw_strkeygen (int flavor, const char* s)
 	int uisAlloced = 0;
 	if (SetUnicodeStringFromUTF_8 (&u, &uLen, &uisAlloced, s) == U_ZERO_ERROR) {
 	    char keyBuffer[128]; /* try to use static space buffer to avoid malloc */
-	    int32_t keyLen = u_strlen(keyBuffer);
+	    int32_t keyLen = sizeof(keyBuffer);
 	    char* key = keyBuffer; /* but key can grow if necessary */
 	    int32_t realLen = ucol_getSortKey(collator, u, uLen, (uint8_t *)key, keyLen);
 	    if (realLen > keyLen) { /* need more space */
diff --git a/ldap/clients/dsgw/cookie.c b/ldap/clients/dsgw/cookie.c
index 97c18b0d..5206a751 100644
--- a/ldap/clients/dsgw/cookie.c
+++ b/ldap/clients/dsgw/cookie.c
@@ -814,8 +814,6 @@ dsgw_encDec(CK_ATTRIBUTE_TYPE operation, const char *msg)
   SECItem keyItem = { siBuffer, dsgw_tmmdi, sizeof dsgw_tmmdi };
   int noGood = 0;
   unsigned int inlen;
-  FILE *pptr;
-  int i;
 
   if (msg == NULL) {
     return NULL;
diff --git a/ldap/clients/dsgw/doauth.c b/ldap/clients/dsgw/doauth.c
index a621f534..41d5f4f8 100644
--- a/ldap/clients/dsgw/doauth.c
+++ b/ldap/clients/dsgw/doauth.c
@@ -34,7 +34,10 @@ int main( argc, argv, env )
 static void
 post_request()
 {
-    char	*binddn, *password, *authdesturl, *ufn, *encodeddn, *lderrtxt;
+    char	*binddn, *password, *authdesturl, *encodeddn, *lderrtxt;
+#ifdef NOTFORNOW
+	char    *ufn;
+#endif
     LDAP	*ld;
     int		rc;
 	int		password_expiring = -1;
diff --git a/ldap/clients/dsgw/dsgwutil.c b/ldap/clients/dsgw/dsgwutil.c
index 99e7f2aa..88bc4d9a 100644
--- a/ldap/clients/dsgw/dsgwutil.c
+++ b/ldap/clients/dsgw/dsgwutil.c
@@ -1029,7 +1029,10 @@ dsgw_quote_emptyFrame()
 void 
 dsgw_password_expired_alert( char *dn )
 {
-    char *ufn, *encodeddn = dsgw_strdup_escaped( dn );
+#ifdef NOTFORNOW
+    char *ufn;
+#endif
+    char *encodeddn = dsgw_strdup_escaped( dn );
 
 	dsgw_send_header();
 	dsgw_emits( "<HTML>" );
@@ -1269,7 +1272,7 @@ AcceptLangList(const char* AcceptLanguage,
     cPtr = strtok(input,",");
     while (cPtr) {
       qvalue[countLang] = 1.0f;
-      if (cPtr1 = strchr(cPtr,';')) {
+      if ((cPtr1 = strchr(cPtr,';'))) {
         sscanf(cPtr1,";q=%f",&qvalue[countLang]);
         *cPtr1 = '\0';
       }
diff --git a/ldap/cm/newinst/ux-config.cc b/ldap/cm/newinst/ux-config.cc
index 9ce37470..e8a5f0bb 100644
--- a/ldap/cm/newinst/ux-config.cc
+++ b/ldap/cm/newinst/ux-config.cc
@@ -23,6 +23,7 @@ extern "C" {
 #ifdef AIX
 #include <strings.h>
 #endif
+#include "nspr.h"
 }
 /* Newer g++ wants the new std header forms */
 #if defined( Linux )
@@ -47,7 +48,6 @@ extern "C" {
 
 extern const char *DEFAULT_SYSUSER = "root";
 extern const char *DEFAULT_OLDROOT = "/usr/ns-home";
-static const char *DEFAULT_SLAPDCONF = "slapd.conf";
 
 const int RECONFIG_EXIT_CODE = 7;
 
@@ -57,25 +57,6 @@ const int RECONFIG_EXIT_CODE = 7;
  */
 int iDSISolaris = 0;
 
-static int
-isLiteMode()
-{
-	int ret = 0;
-	InstallInfo infFile("slapd/slapd.inf");
-	InstallInfo *slapdInf = infFile.getSection("slapd");
-	if (!slapdInf || !slapdInf->get("IsDirLite"))
-	{
-		infFile.read("slapd.inf");
-		slapdInf = infFile.getSection("slapd");
-	}
-
-	const char *tmp;
-	ret = (slapdInf && (tmp = slapdInf->get("IsDirLite")) &&
-		   !strcasecmp(tmp, "true"));
-
-	return ret;
-}
-
 static char *
 my_strdup(const char *s)
 {
@@ -183,7 +164,7 @@ SlapdPreInstall::getOptions(int argc, char **argv)
 int
 SlapdPreInstall::init()
 {
-   char errMsg[40];
+   char errMsg[256];
    struct stat fi;
    Bool shell = True;
 
@@ -203,7 +184,7 @@ SlapdPreInstall::init()
    if ((installMode() == Silent && _infoFile == (char *) NULL) || 
        (_infoFile != (char *) NULL && InstUtil::fileExists(_infoFile) == False))
    {
-      sprintf(errMsg, "ERROR: answer cache not found\n");
+      PR_snprintf(errMsg, sizeof(errMsg), "ERROR: answer cache not found\n");
       if (installMode() == Silent)
       {
          printf(errMsg);
@@ -224,7 +205,7 @@ SlapdPreInstall::init()
          // Not executing from the Shell, check if this is the server
          if (stat ("admin-serv", &fi) != 0)
          {
-            sprintf(errMsg, "ERROR: %s is not a server root\n",_serverRoot.data());
+            PR_snprintf(errMsg, sizeof(errMsg), "ERROR: %s is not a server root\n",_serverRoot.data());
             DialogAlert alert(errMsg);
             alert.execute();
             return -1;
@@ -262,10 +243,10 @@ SlapdPreInstall::init()
       if (initDefaultConfig() == -1) {
 	    const char *guess_host = InstUtil::guessHostname();
 	    if (guess_host) {
-	      sprintf(errMsg, "ERROR: %s is not an addressable hostname\n",
-		      guess_host);
+			PR_snprintf(errMsg, sizeof(errMsg), "ERROR: %s is not an addressable hostname\n",
+						guess_host);
 	    } else {
-	      sprintf(errMsg, "ERROR: cannot determine an addressable hostname\n");
+			PR_snprintf(errMsg, sizeof(errMsg), "ERROR: cannot determine an addressable hostname\n");
 	    }
             DialogAlert alert(errMsg);
             alert.execute();
@@ -275,9 +256,9 @@ SlapdPreInstall::init()
 	    const char *guess_domain = InstUtil::guessDomain();	
 
 	    if (guess_domain == NULL) {
-	      sprintf(errMsg, "ERROR: cannot determine domainname\n");
+			PR_snprintf(errMsg, sizeof(errMsg), "ERROR: cannot determine domainname\n");
 	    } else {
-	      sprintf(errMsg, "ERROR: domainname is not valid for DNS\n");
+			PR_snprintf(errMsg, sizeof(errMsg), "ERROR: domainname is not valid for DNS\n");
 	    }
             DialogAlert alert(errMsg);
             alert.execute();
@@ -432,27 +413,6 @@ SlapdPreInstall::start()
 	   &askPopulate,
 	   &askDisableSchemaChecking
    };
-   Dialog *advancedDialogLiteList[] = {
-	   &askUseExistingMC,
-	   &askMCHost,
-	   &askMCPort,
-	   &askMCDN,
-	   &askMCAdminDomain,
-	   &askUseExistingUG,
-	   &askUGHost,
-	   &askUGPort,
-	   &askUGSuffix,
-	   &askUGDN,
-	   &askSlapdPort,
-	   &askSlapdServerID,
-	   &askMCAdminID,
-	   &askSlapdSuffix,
-	   &askSlapdRootDN,
-	   &askAdminDomain,
-	   &askSample,
-	   &askPopulate,
-	   &askDisableSchemaChecking
-   };
    Dialog *advancediDSISolarisForceUGDialogList[] = {
 	   &askSlapdPort,
 	   &askSlapdServerID,
@@ -520,13 +480,11 @@ SlapdPreInstall::start()
    const int nExpressForceUGDialogs = sizeof(expressForceUGDialogList) / sizeof(expressForceUGDialogList[0]);
    const int nExpressiDSISolarisForceUGDialogs = sizeof(expressiDSISolarisForceUGDialogList) / sizeof(expressiDSISolarisForceUGDialogList[0]);
    const int nAdvancedDialogs = sizeof(advancedDialogList) / sizeof(advancedDialogList[0]);
-   const int nAdvancedLiteDialogs = sizeof(advancedDialogLiteList) / sizeof(advancedDialogLiteList[0]);
    const int nAdvancediDSISolarisForceUGDialogs = sizeof(advancediDSISolarisForceUGDialogList) / sizeof(advancediDSISolarisForceUGDialogList[0]);
    const int nReconfigDialogs = sizeof(reconfigDialogList) / sizeof(reconfigDialogList[0]);
    const int nNormalForceUGDialogs = sizeof(normalForceUGDialogList) / sizeof(normalForceUGDialogList[0]);
    const int nNormaliDSISolarisForceUGDialogs = sizeof(normaliDSISolarisForceUGDialogList) / sizeof(normaliDSISolarisForceUGDialogList[0]);
 
-   int liteMode = 0;
    int nDialogs = nNormalDialogs;
    Dialog** dialogList = normalDialogList;
    if (_reconfig)
@@ -541,16 +499,8 @@ SlapdPreInstall::start()
    }
    else if (installType() == Custom)
    {
-	   if (liteMode = isLiteMode())
-	   {
-		   nDialogs = nAdvancedLiteDialogs;
-		   dialogList = advancedDialogLiteList;
-	   }
-	   else
-	   {
-		   nDialogs = nAdvancedDialogs;
-		   dialogList = advancedDialogList;
-	   }
+	   nDialogs = nAdvancedDialogs;
+	   dialogList = advancedDialogList;
    }
    else if (!iDSISolaris && featureIsEnabled(SLAPD_KEY_USE_EXISTING_MC))
    {
@@ -1015,7 +965,7 @@ SlapdPreInstall::getDefaultSuffix() const
 	}
 	*sptr = 0;
 	if (!*suffix)
-		sprintf(suffix, "%s%s", SUF, "unknown-domain");
+		PR_snprintf(suffix, sizeof(suffix), "%s%s", SUF, "unknown-domain");
 
 	return suffix;
 }
@@ -1029,9 +979,9 @@ SlapdPreInstall::getConsumerDN() const
 	const char *suffix = 
 		getDefaultScript()->get(SLAPD_KEY_SUFFIX);
 	if (suffix)
-		sprintf(dn, "cn=Replication Consumer, %s", suffix);
+		PR_snprintf(dn, sizeof(dn), "cn=Replication Consumer, %s", suffix);
 	else
-		sprintf(dn, "cn=Replication Consumer");
+		PR_snprintf(dn, sizeof(dn), "cn=Replication Consumer");
 
 	return dn;
 }
@@ -1063,7 +1013,7 @@ SlapdPreInstall::shutdownServers()
 		return;
 
 	struct dirent* entry = 0;
-	while (entry = readdir(srootdir))
+	while ((entry = readdir(srootdir)))
 	{
 		// look for instance directories
 		if (!strncasecmp(entry->d_name, nick, len))
@@ -1138,7 +1088,7 @@ SlapdPreInstall::normalizeDNs()
 			if (dn)
 			{
 				char port[6];
-				sprintf(port, "%d", desc->lud_port);
+				PR_snprintf(port, sizeof(port), "%d", desc->lud_port);
 				NSString newurl = NSString("ldap://") + desc->lud_host +
 					":" + port + "/" + dn;
 				_installInfo->set(attr, newurl);
diff --git a/ldap/cm/newinst/ux-dialog.cc b/ldap/cm/newinst/ux-dialog.cc
index 294b0468..7d0db74c 100644
--- a/ldap/cm/newinst/ux-dialog.cc
+++ b/ldap/cm/newinst/ux-dialog.cc
@@ -41,6 +41,7 @@ using std::ostrstream;
 #include "install_keywords.h"
 extern "C" {
 #include "dsalib.h"
+#include "nspr.h"
 }
 
 static const char *DEFAULT_SLAPDUSER = "cn=Directory Manager";
@@ -51,26 +52,12 @@ static const char *DEFAULT_SLAPDUSER = "cn=Directory Manager";
 ** Forward References
 */
 
-static DialogAction yesNoDefaultNo (const char *answer);
-static DialogAction askReconfigNext (Dialog *me);
-static DialogAction askSlapdServerNameSetup (Dialog *me);
-static DialogAction askSlapdServerNameNext(Dialog *me);
-static DialogAction askAdminPortSetup (Dialog *me);
-static DialogAction askAdminPortNext(Dialog *me);
 static DialogAction askSlapdPortSetup (Dialog *me);
 static DialogAction askSlapdPortNext(Dialog *me);
-static DialogAction askSecurityNext (Dialog *me);
-static DialogAction askSlapdSecPortSetup (Dialog *me);
-static DialogAction askSlapdSecPortNext(Dialog *me);
 static DialogAction askSlapdServerIDSetup (Dialog *me);
 static DialogAction askSlapdServerIDNext(Dialog *me);
-static DialogAction askSr2xInfoSetup(Dialog *me);
-static DialogAction askSr2xInfoNext(Dialog *me);
 static DialogAction askSlapdRootDNSetup(Dialog *me);
 static DialogAction askSlapdRootDNNext (Dialog *me);
-static DialogAction askSlapdSysUserSetup (Dialog *me);
-static DialogAction askSlapdSysUserNext (Dialog *me);
-static DialogAction askConfigForMCNext (Dialog *me);
 static DialogAction askMCAdminIDSetup (Dialog *me);
 static DialogAction askMCAdminIDNext (Dialog *me);
 static DialogAction askReconfigMCAdminPwdSetup (Dialog *me);
@@ -293,17 +280,6 @@ isValidYesNo(const char *s)
 	return 1;
 }
 
-static DialogAction
-yesNoDefaultNo(const char *answer)
-{
-   if (answer[0] == '\0' || answer[0] == '\n')
-      return DIALOG_EXIT;
-   else if (answer[0] != 'y' && answer[0] != 'Y')
-      return DIALOG_EXIT;
-   else
-      return DIALOG_NEXT;
-}
-
 static int
 dialogSetup (Dialog *me, const char *which, const char *defaultAns)
 {
@@ -363,7 +339,7 @@ askSlapdPortSetup(Dialog *me)
 		port = atoi(defPort);
 	}
 	else
-		sprintf(tmp, "%d", port);
+		PR_snprintf(tmp, sizeof(tmp), "%d", port);
 
 	// see if default port is available
 	if (InstUtil::portAvailable(port) == False)
@@ -435,17 +411,17 @@ askSlapdPortNext(Dialog *me)
 	getManager(me)->getDefaultScript()->set(SLAPD_KEY_SERVER_PORT, tmp);
 
 	port = atoi(tmp);
-	sprintf(testbuf, "%d", port);
+	PR_snprintf(testbuf, sizeof(testbuf), "%d", port);
 	if (strncmp(testbuf, tmp, 6) || port > MAXPORT || port < 1)
 	{
-		sprintf(testbuf, "OVERFLOW ERROR: Unable to bind to port %d\n"
+		PR_snprintf(testbuf, sizeof(testbuf), "OVERFLOW ERROR: Unable to bind to port %d\n"
 				"Please choose another port between 1 and %d.\n\n",
 				port, MAXPORT);
 		err = -1;
 	} 
 	else if (InstUtil::portAvailable(port) == False)
 	{
-		sprintf(testbuf, "ERROR: Unable to bind to port %d\n"
+		PR_snprintf(testbuf, sizeof(testbuf), "ERROR: Unable to bind to port %d\n"
 				"Please choose another port.\n\n", port);
 		err = -1;
 	}
@@ -484,7 +460,7 @@ askSlapdServerIDSetup(Dialog *me)
 	// extract the hostname part of the FQDN
 	const char *tmp = 0;
 	char *basehost = 0;
-	if (tmp = getManager(me)->getBaseScript()->get(SLAPD_KEY_FULL_MACHINE_NAME)) {
+	if ((tmp = getManager(me)->getBaseScript()->get(SLAPD_KEY_FULL_MACHINE_NAME))) {
 		basehost = strdup(tmp);
 	} else {
 		basehost = strdup(InstUtil::guessHostname());
@@ -547,9 +523,6 @@ askSlapdServerIDSetup(Dialog *me)
 static DialogAction
 askSlapdServerIDNext(Dialog *me)
 {
-	const char *ans =
-		getManager(me)->getDefaultScript()->get(SLAPD_KEY_SERVER_IDENTIFIER);
-
 	const char *buf = me->input();
 	const char *tmp;
 	char testbuf[1024];
@@ -567,22 +540,22 @@ askSlapdServerIDNext(Dialog *me)
 	if (!tmp)
 	{
 		err = -1;
-		sprintf(testbuf, "The name must not be empty");
+		PR_snprintf(testbuf, sizeof(testbuf), "The name must not be empty");
 	}
 	else if (!isValid(tmp))
 	{
 		err = -1;
-		sprintf(testbuf, "Please specify a valid value for the name.");
+		PR_snprintf(testbuf, sizeof(testbuf), "Please specify a valid value for the name.");
 	}
 	else if (contains8BitChars(tmp))
 	{
 		err = -1;
-		sprintf(testbuf, "The server ID must contain 7 bit ascii only.");
+		PR_snprintf(testbuf, sizeof(testbuf), "The server ID must contain 7 bit ascii only.");
 	}
 	else if (!isValidServerID(tmp))
 	{
 		err = -1;
-		sprintf(testbuf, "The server ID must be a valid filename and DN component.");
+		PR_snprintf(testbuf, sizeof(testbuf), "The server ID must be a valid filename and DN component.");
 	}
 
 	if (!err)
@@ -594,7 +567,7 @@ askSlapdServerIDNext(Dialog *me)
 			) + "/slapd-" + tmp;
 		if (InstUtil::fileExists(instanceDir))
 		{
-			sprintf(testbuf, "ERROR: a server instance named [%s] already exists."
+			PR_snprintf(testbuf, sizeof(testbuf), "ERROR: a server instance named [%s] already exists."
 					"  Please choose a unique name.\n", tmp);
 			err = -1;
 		}
@@ -1186,7 +1159,7 @@ askOrgSizeNext(Dialog *me)
    num = atoi(tmp);
    if (num != 1 && num != 2)
    {
-	   sprintf(testbuf, "Please enter a 1 or a 2\n\n");
+	   PR_snprintf(testbuf, sizeof(testbuf), "Please enter a 1 or a 2\n\n");
 	   err = -1;
    }
 
@@ -1425,7 +1398,6 @@ askCIRHostNext(Dialog *me)
 	
    const char *buf = me->input();
    const char *tmp;
-   int err = 0;
 
    if (buf[0] == 0)
    {
@@ -1510,10 +1482,10 @@ askCIRPortNext(Dialog *me)
    getManager(me)->getDefaultScript()->set(SLAPD_KEY_CIR_PORT, tmp);
 
    port = atoi(tmp);
-   sprintf(testbuf, "%d", port);
+   PR_snprintf(testbuf, sizeof(testbuf), "%d", port);
    if (strncmp(testbuf, tmp, 6) || port > MAXPORT || port < 1)
    {
-      sprintf(testbuf, "OVERFLOW ERROR: Unable to bind to port %d\n"
+      PR_snprintf(testbuf, sizeof(testbuf), "OVERFLOW ERROR: Unable to bind to port %d\n"
                  "Please choose another port between 1 and %d.\n\n",
                    port, MAXPORT);
       err = -1;
@@ -1699,13 +1671,13 @@ askCIRSuffixNext(Dialog *me)
 	}
 
 	int status;
-	if (status = getManager(me)->verifyRemoteLdap(
+	if ((status = getManager(me)->verifyRemoteLdap(
 								  SLAPD_KEY_CIR_HOST,
 								  SLAPD_KEY_CIR_PORT,
 								  SLAPD_KEY_CIR_SUFFIX,
 								  SLAPD_KEY_CIR_BINDDN,
 								  SLAPD_KEY_CIR_BINDDNPWD
-		                         )
+								  ))
 	   )
 	{
 		ostrstream msg;
@@ -1850,7 +1822,7 @@ askCIRIntervalNext(Dialog *me)
 	interval = atoi(tmp);
 	if (!isdigit((*tmp)) || interval < 0)
 	{
-		sprintf(testbuf, "Please specify an integer greater than or equal to 0");
+		PR_snprintf(testbuf, sizeof(testbuf), "Please specify an integer greater than or equal to 0");
 		err = -1;
 	} 
 	
@@ -2298,7 +2270,6 @@ askSIRHostNext(Dialog *me)
 	
    const char *buf = me->input();
    const char *tmp;
-   int err = 0;
 
    if (buf[0] == 0)
    {
@@ -2383,10 +2354,10 @@ askSIRPortNext(Dialog *me)
    getManager(me)->getDefaultScript()->set(SLAPD_KEY_SIR_PORT, tmp);
 
    port = atoi(tmp);
-   sprintf(testbuf, "%d", port);
+   PR_snprintf(testbuf, sizeof(testbuf), "%d", port);
    if (strncmp(testbuf, tmp, 6) || port > MAXPORT || port < 1)
    {
-      sprintf(testbuf, "OVERFLOW ERROR: Unable to bind to port %d\n"
+      PR_snprintf(testbuf, sizeof(testbuf), "OVERFLOW ERROR: Unable to bind to port %d\n"
                  "Please choose another port between 1 and %d.\n\n",
                    port, MAXPORT);
       err = -1;
@@ -2573,13 +2544,13 @@ askSIRSuffixNext(Dialog *me)
 	}
 
 	int status;
-	if (status = getManager(me)->verifyRemoteLdap(
+	if ((status = getManager(me)->verifyRemoteLdap(
 								  SLAPD_KEY_SIR_HOST,
 								  SLAPD_KEY_SIR_PORT,
 								  SLAPD_KEY_SIR_SUFFIX,
 								  SLAPD_KEY_SIR_BINDDN,
 								  SLAPD_KEY_SIR_BINDDNPWD
-								 )
+								  ))
 	   )
 	{
 		ostrstream msg;
@@ -3364,10 +3335,10 @@ askMCPortNext(Dialog *me)
    getManager(me)->getBaseScript()->set(SLAPD_KEY_K_LDAP_PORT, tmp);
 
    port = atoi(tmp);
-   sprintf(testbuf, "%d", port);
+   PR_snprintf(testbuf, sizeof(testbuf), "%d", port);
    if (strncmp(testbuf, tmp, 6) || port > MAXPORT || port < 1)
    {
-      sprintf(testbuf, "OVERFLOW ERROR: Unable to bind to port %d\n"
+      PR_snprintf(testbuf, sizeof(testbuf), "OVERFLOW ERROR: Unable to bind to port %d\n"
                  "Please choose another port between 1 and %d.\n\n",
                    port, MAXPORT);
       err = -1;
@@ -3480,13 +3451,13 @@ askMCDNNext(Dialog *me)
 		free(slapdPwd);
 
 		int status;
-		if (status = getManager(me)->verifyRemoteLdap(
+		if ((status = getManager(me)->verifyRemoteLdap(
 									  SLAPD_KEY_K_LDAP_HOST,
 									  SLAPD_KEY_K_LDAP_PORT,
 									  SLAPD_KEY_BASE_SUFFIX,
 									  SLAPD_KEY_SERVER_ADMIN_ID,
 									  SLAPD_KEY_SERVER_ADMIN_PWD
-			                         )
+									  ))
 		   )
 		{
 			ostrstream msg;
@@ -3685,14 +3656,14 @@ askMCAdminDomainNext(Dialog *me)
 		DialogManagerType::showAlert("A DN is not allowed here.  Please enter a valid string.");
 		return DIALOG_SAME;
 	}
-	else if (status = getManager(me)->verifyAdminDomain(
+	else if ((status = getManager(me)->verifyAdminDomain(
 									  SLAPD_KEY_K_LDAP_HOST,
 									  SLAPD_KEY_K_LDAP_PORT,
 									  SLAPD_KEY_BASE_SUFFIX,
 									  SLAPD_KEY_ADMIN_DOMAIN,
 									  SLAPD_KEY_SERVER_ADMIN_ID,
 									  SLAPD_KEY_SERVER_ADMIN_PWD
-			                         )
+									  ))
 		)
 	{
 		ostrstream msg;
@@ -4010,10 +3981,10 @@ askUGPortNext(Dialog *me)
    getManager(me)->getBaseScript()->set(SLAPD_KEY_UG_PORT, tmp);
 
    port = atoi(tmp);
-   sprintf(testbuf, "%d", port);
+   PR_snprintf(testbuf, sizeof(testbuf), "%d", port);
    if (strncmp(testbuf, tmp, 6) || port > MAXPORT || port < 1)
    {
-      sprintf(testbuf, "OVERFLOW ERROR: Unable to bind to port %d\n"
+      PR_snprintf(testbuf, sizeof(testbuf), "OVERFLOW ERROR: Unable to bind to port %d\n"
                  "Please choose another port between 1 and %d.\n\n",
                    port, MAXPORT);
       err = -1;
@@ -4121,13 +4092,13 @@ askUGDNNext(Dialog *me)
 		free(slapdPwd);
 
 		int status;
-		if (status = getManager(me)->verifyRemoteLdap(
+		if ((status = getManager(me)->verifyRemoteLdap(
 									  SLAPD_KEY_UG_HOST,
 									  SLAPD_KEY_UG_PORT,
 									  SLAPD_KEY_UG_SUFFIX,
 									  SLAPD_KEY_USER_GROUP_ADMIN_ID,
 									  SLAPD_KEY_USER_GROUP_ADMIN_PWD
-			                         )
+									  ))
 		   )
 		{
 			ostrstream msg;
@@ -4300,10 +4271,10 @@ askReconfigMCAdminPwdNext(Dialog *me)
 			else
 			{
 				int status;
-				if (status = authLdapUser(
+				if ((status = authLdapUser(
 					getManager(me)->getBaseScript()->get(SLAPD_KEY_K_LDAP_URL),
 					getManager(me)->getBaseScript()->get(SLAPD_KEY_SERVER_ADMIN_ID),
-					inp, 0, 0))
+					inp, 0, 0)))
 				{
 					ostrstream msg;
 					msg << "Could not connect to "
diff --git a/ldap/cm/newinstnt/dsinst.c b/ldap/cm/newinstnt/dsinst.c
index f693e8ab..a2247056 100644
--- a/ldap/cm/newinstnt/dsinst.c
+++ b/ldap/cm/newinstnt/dsinst.c
@@ -86,7 +86,7 @@ storeUserDirectoryInfo()
 			lstrcpy(mi.m_szUserGroupAdminPW, mi.m_szInstancePassword);
 
 		}
-		sprintf(mi.m_szUserGroupURL, "ldap://%s:%d/%s", mi.m_szInstanceHostName,
+		PR_snprintf(mi.m_szUserGroupURL, sizeof(mi.m_szUserGroupURL), "ldap://%s:%d/%s", mi.m_szInstanceHostName,
 				mi.m_nInstanceServerPort, mi.m_szInstanceSuffix);	
 	}
 
@@ -232,7 +232,7 @@ IsValidAdminDomain(
 	int status = FALSE;
 	Ldap *ldap = NULL;
 
-	sprintf(ldapurl, "ldap://%s:%d/%s", host, port, suffix);
+	PR_snprintf(ldapurl, sizeof(ldapurl), "ldap://%s:%d/%s", host, port, suffix);
 	if (createLdap(&ldap, ldapurl, binddn, binddnpwd, 0, 0) == OKAY)
 	{
 		LdapEntry *le = createLdapEntry(ldap);
@@ -590,7 +590,7 @@ void getAdminServInfo()
 
   GetEnvironmentVariable("TEMP", szTempDir, sizeof(szTempDir));
 
-  sprintf(szCacheFile, "%s\\install.inf", szTempDir);
+  PR_snprintf(szCacheFile, sizeof(szCacheFile), "%s\\install.inf", szTempDir);
 
   mi.m_nAdminServerPort = GetPrivateProfileInt(pszAdminSection, SLAPD_KEY_ADMIN_SERVER_PORT, 
 					       -1, szCacheFile);
@@ -616,14 +616,14 @@ BOOL writeINFfile(const char *filename)
       szAdminDN = formAdminDomainDN(mi.m_szAdminDomain);
       if (szAdminDN)
       {
-        sprintf(mi.m_szInstallDN, szAdminDN);
+        PR_snprintf(mi.m_szInstallDN, sizeof(mi.m_szInstallDN), szAdminDN);
         nsSetupFree(szAdminDN);
       }
       else
       {
         //note probably should fail. 
         LogData(NULL, "Warning: Slapd unable to Form Admin Domain, guessing");
-        sprintf(mi.m_szInstallDN, "ou=%s, o=NetscapeRoot", mi.m_szAdminDomain);
+        PR_snprintf(mi.m_szInstallDN, sizeof(mi.m_szInstallDN), "ou=%s, o=NetscapeRoot", mi.m_szAdminDomain);
       }
    }
  
@@ -775,10 +775,9 @@ BOOL isValidServerID(char *pszServerIdentifier)
 		/* for now just check registry to see if this server ID exists,
 			in future add might want to add more sanity checks */
 
-		fullId = (char *)malloc(lstrlen(DS_ID_SERVICE) + lstrlen(pszServerIdentifier) + 6);
-		sprintf(fullId, "%s-%s", DS_ID_SERVICE, pszServerIdentifier);
+		fullId = PR_smprintf("%s-%s", DS_ID_SERVICE, pszServerIdentifier);
 
-		sprintf(line, "%s\\%s", KEY_SERVICES, fullId); 
+		PR_snprintf(line, sizeof(line), "%s\\%s", KEY_SERVICES, fullId); 
    
 		Result = RegOpenKeyEx(HKEY_LOCAL_MACHINE, 
 		                      line,
@@ -797,7 +796,7 @@ BOOL isValidServerID(char *pszServerIdentifier)
 
 		}
 
-		free(fullId);
+		PR_smprintf_free(fullId);
 	}
 
 	return bRC;
@@ -841,21 +840,21 @@ int set_default_ldap_settings()
 
 	/* default admin domain is also derived from the FQDN */
 	++i;
-	sprintf(mi.m_szAdminDomain, "%s", mi.m_szInstanceHostName+i);
+	PR_snprintf(mi.m_szAdminDomain, sizeof(mi.m_szAdminDomain), "%s", mi.m_szInstanceHostName+i);
 	
     mi.m_nInstanceServerPort=DEFAULT_SERVER_PORT;
                                     
-    sprintf(mi.m_szInstanceUnrestrictedUser, DEFAULT_UNRESTRICTED_USER);
+    PR_snprintf(mi.m_szInstanceUnrestrictedUser, sizeof(mi.m_szInstanceUnrestrictedUser), DEFAULT_UNRESTRICTED_USER);
 
     mi.m_nCfgSspt = DEFAULT_CONFIG_SSPT;
 
-	sprintf(mi.m_szSsptUid, DEFAULT_SSPT_USER);
+	PR_snprintf(mi.m_szSsptUid, sizeof(mi.m_szSsptUid), DEFAULT_SSPT_USER);
 
     /* stevross: don't want default for these in silent mode, user must specify them */
     if( SILENTMODE != MODE)
     {
-        sprintf(mi.m_szSupplierDN, DEFAULT_SUPPLIER_DN);
-        sprintf(mi.m_szChangeLogSuffix, DEFAULT_CHANGELOGSUFFIX);
+        PR_snprintf(mi.m_szSupplierDN, sizeof(mi.m_szSupplierDN), DEFAULT_SUPPLIER_DN);
+        PR_snprintf(mi.m_szChangeLogSuffix, sizeof(mi.m_szChangeLogSuffix), DEFAULT_CHANGELOGSUFFIX);
 
     }
 
@@ -886,7 +885,7 @@ int set_default_ldap_settings()
 	mi.m_nMCCPort=DEFAULT_SERVER_PORT;
 
 	mi.m_szMCCBindAs = malloc(MAX_STR_SIZE);
-	sprintf(mi.m_szMCCBindAs, "%s", DEFAULT_SSPT_USER);
+	PR_snprintf(mi.m_szMCCBindAs, sizeof(mi.m_szMCCBindAs), "%s", DEFAULT_SSPT_USER);
 
 	lstrcpy(mi.m_szUGSuffix, mi.m_szInstanceSuffix);
 	mi.m_nUGPort=DEFAULT_SERVER_PORT;
@@ -949,7 +948,7 @@ void set_ldap_settings()
 		lstrcpy(mi.m_szMCCHost, mi.m_szInstanceHostName);
 		mi.m_nMCCPort = mi.m_nInstanceServerPort;
 		lstrcpy(mi.m_szMCCSuffix, NS_DOMAIN_ROOT);
-		sprintf(mi.m_szMCCBindAs, "%s", mi.m_szSsptUid);
+		PR_snprintf(mi.m_szMCCBindAs, sizeof(mi.m_szMCCBindAs), "%s", mi.m_szSsptUid);
 		lstrcpy(mi.m_szMCCPw, mi.m_szSsptUidPw);
 
 	}
@@ -2228,7 +2227,7 @@ BOOL Verify_UG_Settings()
 				{
 					/* all settings good */
 					/* set UG LDAP URL */
-					sprintf(mi.m_szUserGroupURL, "ldap://%s:%d/%s",
+					PR_snprintf(mi.m_szUserGroupURL, sizeof(mi.m_szUserGroupURL), "ldap://%s:%d/%s",
 							mi.m_szUGHost, mi.m_nUGPort, mi.m_szUGSuffix);
 				}
 			}
@@ -3959,7 +3958,7 @@ Supplier_Replication_DialogProc(HWND hwndDlg, UINT uMsg, WPARAM wParam, LPARAM l
 		// and wm_init is called again
 		if( !nInitialized )
 		{
-			sprintf(mi.m_szChangeLogDbDir,"%s\\%s-%s\\%s", TARGETDIR,  
+			PR_snprintf(mi.m_szChangeLogDbDir, sizeof(mi.m_szChangeLogDbDir),"%s\\%s-%s\\%s", TARGETDIR,  
 				      DS_ID_SERVICE, mi.m_szServerIdentifier, DEFAULT_CHANGELOGDIR);
 			nInitialized = 1;
 		}
@@ -4195,7 +4194,7 @@ Consumer_DN_DialogProc(HWND hwndDlg, UINT uMsg, WPARAM wParam, LPARAM lParam)
       // you can perform any one time initialization that you require. 
 	  Setup8bitInputDisplay(hwndDlg, h8bitControls);
 
-	  sprintf(mi.m_szConsumerDN, "%s,%s", DEFAULT_CONSUMER_DN, mi.m_szInstanceSuffix);
+	  PR_snprintf(mi.m_szConsumerDN, sizeof(mi.m_szConsumerDN), "%s,%s", DEFAULT_CONSUMER_DN, mi.m_szInstanceSuffix);
 
       break;
 
@@ -5094,7 +5093,7 @@ Sample_Entries_Org_DialogProc(HWND hwndDlg, UINT uMsg, WPARAM wParam, LPARAM lPa
 				
 				/* assume by browsing user will want this file so check custom radio button for them
 				   and set file to be displayed */
-				sprintf(mi.m_szPopLdifFile, "%s", szCustomFileName);
+				PR_snprintf(mi.m_szPopLdifFile, sizeof(mi.m_szPopLdifFile), "%s", szCustomFileName);
 				CheckRadioButton(hwndDlg, IDC_RADIO_DONT_POPULATE, IDC_RADIO_POPULATE_CUSTOM, IDC_RADIO_POPULATE_CUSTOM);
 
 			default:
@@ -5104,14 +5103,14 @@ Sample_Entries_Org_DialogProc(HWND hwndDlg, UINT uMsg, WPARAM wParam, LPARAM lPa
 			  if( BST_CHECKED == IsDlgButtonChecked(hwndDlg, IDC_RADIO_POPULATE_SAMPLE ) )
 			  {
 					mi.m_nPopulateSampleEntries = 1;
-					sprintf(mi.m_szPopLdifFile, "%s", szSampleFileName);
+					PR_snprintf(mi.m_szPopLdifFile, sizeof(mi.m_szPopLdifFile), "%s", szSampleFileName);
 			  }else if( BST_CHECKED == IsDlgButtonChecked(hwndDlg, IDC_RADIO_POPULATE_CUSTOM ) ){
 					mi.m_nPopulateSampleEntries = 0;
 					mi.m_nPopulateSampleOrg = 1;
-//		     		sprintf(mi.m_szPopLdifFile, "%s", szCustomFileName);
+//		     		PR_snprintf(mi.m_szPopLdifFile, sizeof(mi.m_szPopLdifFile), "%s", szCustomFileName);
 			  }else{
 					mi.m_nPopulateSampleEntries = 0;
-					sprintf(mi.m_szPopLdifFile, "\0");
+					PR_snprintf(mi.m_szPopLdifFile, sizeof(mi.m_szPopLdifFile), "\0");
 			  }
 
 			  
@@ -5156,9 +5155,9 @@ Sample_Entries_Org_DialogProc(HWND hwndDlg, UINT uMsg, WPARAM wParam, LPARAM lPa
           }
 		  
 		  /* warn user about suffix and database import */
-		  sprintf(szMustHaveBase, "(note: must have base %s)", mi.m_szInstanceSuffix );
+		  PR_snprintf(szMustHaveBase, sizeof(szMustHaveBase), "(note: must have base %s)", mi.m_szInstanceSuffix );
 		  SetDlgItemText(hwndDlg, IDC_STATIC_MUST_HAVE_BASE, szMustHaveBase);
-    	  sprintf(szSampleFileName, "%s\\%s", TARGETDIR, SAMPLE_LDIF);	
+    	  PR_snprintf(szSampleFileName, sizeof(szSampleFileName), "%s\\%s", TARGETDIR, SAMPLE_LDIF);	
  
 		  if(mi.m_nExistingUG == 0)
 		  {
@@ -5707,7 +5706,7 @@ DSINST_PreInstall(LPCSTR lpszInstallPath)
 
 	if (mi.m_nReInstall) {
 		char infFile[MAX_PATH] = {0};
-		sprintf(infFile, "%s\\setup\\slapd\\slapd.inf", TARGETDIR);
+		PR_snprintf(infFile, sizeof(infFile), "%s\\setup\\slapd\\slapd.inf", TARGETDIR);
 		GetProductInfoStringWithTok(SETUP_INF_VERSION, "=", oldVersion,
 								OLD_VERSION_SIZE, infFile);
 		myLogData("file %s old version is %s", infFile, oldVersion);
@@ -6057,7 +6056,7 @@ DSINST_WriteGlobalCache(LPCSTR lpszCacheFileName, LPCSTR lpszSectionName)
 
 	/* construct the LDAPURL */
     /* suffix must always be o=netscape root */
-	sprintf(mi.m_szLdapURL, "ldap://%s:%d/%s", mi.m_szMCCHost, mi.m_nMCCPort, NS_DOMAIN_ROOT);
+	PR_snprintf(mi.m_szLdapURL, sizeof(mi.m_szLdapURL), "ldap://%s:%d/%s", mi.m_szMCCHost, mi.m_nMCCPort, NS_DOMAIN_ROOT);
 
 	if(mi.m_nExistingUG == 0)
 	{
@@ -6080,7 +6079,7 @@ DSINST_WriteGlobalCache(LPCSTR lpszCacheFileName, LPCSTR lpszSectionName)
 			lstrcpy(mi.m_szUserGroupAdminPW, mi.m_szInstancePassword);
 
 		}
-		sprintf(mi.m_szUserGroupURL, "ldap://%s:%d/%s", mi.m_szInstanceHostName,
+		PR_snprintf(mi.m_szUserGroupURL, sizeof(mi.m_szUserGroupURL), "ldap://%s:%d/%s", mi.m_szInstanceHostName,
 								 mi.m_nInstanceServerPort, mi.m_szInstanceSuffix);	
 	}
  
@@ -6148,7 +6147,7 @@ DSINST_WriteLocalCache(LPCSTR lpszCacheFileName, LPCSTR lpszSectionName)
    WritePrivateProfileString(lpszSectionName, SLAPD_KEY_USE_EXISTING_UG, onezero2yesno(mi.m_nExistingUG), 
 	                        lpszCacheFileName);
 
-   sprintf(szInt, "%d",  mi.m_nInstanceServerPort);
+   PR_snprintf(szInt, sizeof(szInt), "%d",  mi.m_nInstanceServerPort);
    WritePrivateProfileString(lpszSectionName, SLAPD_KEY_SERVER_PORT, szInt, 
 	                        lpszCacheFileName);
      
@@ -6179,7 +6178,7 @@ DSINST_WriteLocalCache(LPCSTR lpszCacheFileName, LPCSTR lpszSectionName)
    WritePrivateProfileString(lpszSectionName, SLAPD_KEY_ADD_ORG_ENTRIES, onezero2yesno(mi.m_nPopulateSampleOrg), 
 	                        lpszCacheFileName);
 
-   sprintf(szInt, "%s",  onezero2yesno( ( (NO_REPLICATION != mi.m_nSetupConsumerReplication) || (NO_REPLICATION != mi.m_nSetupSupplierReplication) ) ) );
+   PR_snprintf(szInt, sizeof(szInt), "%s",  onezero2yesno( ( (NO_REPLICATION != mi.m_nSetupConsumerReplication) || (NO_REPLICATION != mi.m_nSetupSupplierReplication) ) ) );
    WritePrivateProfileString(lpszSectionName, SLAPD_KEY_USE_REPLICATION, szInt, 
 	                        lpszCacheFileName);
    
@@ -6188,9 +6187,9 @@ DSINST_WriteLocalCache(LPCSTR lpszCacheFileName, LPCSTR lpszSectionName)
    /* write no instead of number for no replication to be like unix installer */
    if(NO_REPLICATION != mi.m_nSetupConsumerReplication)
    {
-		sprintf(szInt, "%d", mi.m_nSetupConsumerReplication);
+		PR_snprintf(szInt, sizeof(szInt), "%d", mi.m_nSetupConsumerReplication);
    }else{
-	    sprintf(szInt, "no");
+	    PR_snprintf(szInt, sizeof(szInt), "no");
    }
 
    WritePrivateProfileString(lpszSectionName, SLAPD_KEY_SETUP_CONSUMER, szInt, 
@@ -6199,7 +6198,7 @@ DSINST_WriteLocalCache(LPCSTR lpszCacheFileName, LPCSTR lpszSectionName)
    WritePrivateProfileString(lpszSectionName, SLAPD_KEY_CIR_HOST, mi.m_szConsumerHost, 
 	                        lpszCacheFileName);
 
-   sprintf(szInt, "%d", mi.m_nConsumerPort );
+   PR_snprintf(szInt, sizeof(szInt), "%d", mi.m_nConsumerPort );
    WritePrivateProfileString(lpszSectionName, SLAPD_KEY_CIR_PORT, szInt, 
 	                        lpszCacheFileName);
 
@@ -6215,7 +6214,7 @@ DSINST_WriteLocalCache(LPCSTR lpszCacheFileName, LPCSTR lpszSectionName)
    WritePrivateProfileString(lpszSectionName, SLAPD_KEY_CIR_SECURITY_ON, onezero2yesno(mi.m_nConsumerSSL),
 	                        lpszCacheFileName);
    
-   sprintf(szInt, "%d", mi.m_nCIRInterval );
+   PR_snprintf(szInt, sizeof(szInt), "%d", mi.m_nCIRInterval );
    WritePrivateProfileString(lpszSectionName, SLAPD_KEY_CIR_INTERVAL, szInt, 
 	                        lpszCacheFileName);
 
@@ -6250,9 +6249,9 @@ DSINST_WriteLocalCache(LPCSTR lpszCacheFileName, LPCSTR lpszSectionName)
    /* write no instead of number for no replication to be like unix installer */
    if(NO_REPLICATION != mi.m_nSetupSupplierReplication)
    {
-		sprintf(szInt, "%d", mi.m_nSetupSupplierReplication);
+		PR_snprintf(szInt, sizeof(szInt), "%d", mi.m_nSetupSupplierReplication);
    }else{
-	    sprintf(szInt, "no");
+	    PR_snprintf(szInt, sizeof(szInt), "no");
    }
    WritePrivateProfileString(lpszSectionName, SLAPD_KEY_SETUP_SUPPLIER, szInt, 
 	                        lpszCacheFileName);
@@ -6266,7 +6265,7 @@ DSINST_WriteLocalCache(LPCSTR lpszCacheFileName, LPCSTR lpszSectionName)
    WritePrivateProfileString(lpszSectionName, SLAPD_KEY_SIR_HOST, mi.m_szSupplierHost, 
 	                        lpszCacheFileName);
 
-   sprintf(szInt, "%d", mi.m_nSupplierPort );
+   PR_snprintf(szInt, sizeof(szInt), "%d", mi.m_nSupplierPort );
    WritePrivateProfileString(lpszSectionName, SLAPD_KEY_SIR_PORT, szInt, 
 	                        lpszCacheFileName);
 
@@ -6894,12 +6893,12 @@ run_cgi(const char *serverroot, const char *cgipath, const char *args)
 	char netsiteRootEnvVar[MAX_STR_SIZE] = {0};
     LPVOID lpMsgBuf;
 
-    sprintf(netsiteRootEnvVar, "NETSITE_ROOT=%s", serverroot);
+    PR_snprintf(netsiteRootEnvVar, sizeof(netsiteRootEnvVar), "NETSITE_ROOT=%s", serverroot);
     _putenv(netsiteRootEnvVar);
     if ( getenv("DEBUG_DSINST") )
 		DebugBreak();
     /* everything is set, start the program */
-	sprintf(prog, "%s\\%s", serverroot, cgipath);
+	PR_snprintf(prog, sizeof(prog), "%s\\%s", serverroot, cgipath);
 	if (!FileExists(prog))
 	{
 		lpMsgBuf = getLastErrorMessage();
@@ -6914,7 +6913,7 @@ run_cgi(const char *serverroot, const char *cgipath, const char *args)
 	}
 	else
 	{
-		sprintf(cmdLine, "\"%s\" %s", prog, args);
+		PR_snprintf(cmdLine, sizeof(cmdLine), "\"%s\" %s", prog, args);
         
 		myLogData("run_cgi: before execution of %s", cmdLine);
 		if ( (procResult = _LaunchAndWait(cmdLine, INFINITE)) != 0)
@@ -6969,7 +6968,7 @@ create_slapd_instance(const char *hostname, const char *serverroot)
 
 	/* create an .inf file to pass to index */
 	/* write the data to a temp file */
-	sprintf(INFfile, "%s\\temp%d.inf", TEMPDIR, _getpid());
+	PR_snprintf(INFfile, sizeof(INFfile), "%s\\temp%d.inf", TEMPDIR, _getpid());
 	myLogData("create_slapd_instance: inf file is %s", INFfile);
 
 	if (TRUE == (status = writeINFfile(INFfile)) )
@@ -6985,9 +6984,9 @@ create_slapd_instance(const char *hostname, const char *serverroot)
 		else
 		{
             /* set temp file for admin output */
-            sprintf(debugFile, "DEBUG_FILE=%s\\debug.%d", TEMPDIR, _getpid());
+            PR_snprintf(debugFile, sizeof(debugFile), "DEBUG_FILE=%s\\debug.%d", TEMPDIR, _getpid());
             _putenv(debugFile);
-			sprintf(szCGIArgs, "\"%s\\bin\\slapd\\admin\\bin\\Install.pl\"",
+			PR_snprintf(szCGIArgs, sizeof(szCGIArgs), "\"%s\\bin\\slapd\\admin\\bin\\Install.pl\"",
 					serverroot);
 		    if (mi.m_nReInstall) 
 			{ 
@@ -7034,7 +7033,7 @@ int generate_mcc_bat()
 	return rc;
     }
 
-    sprintf(szFilename, "%s\\%s-%s\\mcc.bat", TARGETDIR, DS_ID_SERVICE,
+    PR_snprintf(szFilename, sizeof(szFilename), "%s\\%s-%s\\mcc.bat", TARGETDIR, DS_ID_SERVICE,
 			mi.m_szServerIdentifier);
     fp = fopen(szFilename, "wb");
     if (!fp)
@@ -7043,7 +7042,7 @@ int generate_mcc_bat()
 					   ERR_NO_CREATE_FILE, 0, szFilename);
     	rc = -1;
     }else{
-        sprintf(szJavaDir, "%s\\java", TARGETDIR);
+        PR_snprintf(szJavaDir, sizeof(szJavaDir), "%s\\java", TARGETDIR);
                               
         fprintf(fp, "pushd \"%s\"\n", szJavaDir);
 
@@ -7091,7 +7090,7 @@ int generate_install_ldapctrs_bat()
     CHAR szFilename[MAX_STR_SIZE];
     INT rc = 0;
 
-    sprintf(szFilename, "%s\\%s", TARGETDIR, INSTALL_CTRS_BAT);
+    PR_snprintf(szFilename, sizeof(szFilename), "%s\\%s", TARGETDIR, INSTALL_CTRS_BAT);
     fp = fopen(szFilename, "wb");
     if (!fp)
     {
@@ -7287,7 +7286,7 @@ updateRegistryKeys(const char *oldVersion, const char *newVersion)
 	// the first place is under
 	// HKEY_LOCAL_MACHINE\SOFTWARE\Netscape\Directory\oldVersion
 	// we need to change oldVersion to newVersion
-	sprintf(newKey, "%s\\%s", KEY_SOFTWARE_NETSCAPE, SVR_KEY_ROOT);
+	PR_snprintf(newKey, sizeof(newKey), "%s\\%s", KEY_SOFTWARE_NETSCAPE, SVR_KEY_ROOT);
 	strcpy(oldKey, newKey);
 	if (ptr = strstr(oldKey, SVR_VERSION)) {
 		strncpy(ptr, oldVersion, strlen(oldVersion));
@@ -7301,9 +7300,9 @@ updateRegistryKeys(const char *oldVersion, const char *newVersion)
 	// the second place is under
 	// HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\slapdoldVersoin
 	// we need to change oldVersion to newVersion
-	sprintf(oldKey, "%s\\%s%s", KEY_SERVICES, PRODUCT_NAME,
+	PR_snprintf(oldKey, sizeof(oldKey), "%s\\%s%s", KEY_SERVICES, PRODUCT_NAME,
 			oldVersion);
-	sprintf(newKey, "%s\\%s%s", KEY_SERVICES, PRODUCT_NAME,
+	PR_snprintf(newKey, sizeof(newKey), "%s\\%s%s", KEY_SERVICES, PRODUCT_NAME,
 			SVR_VERSION);
 
 	CopyAndDeleteKey(HKEY_LOCAL_MACHINE, oldKey, HKEY_LOCAL_MACHINE,
@@ -7403,7 +7402,7 @@ NSPERLINST_PostInstall(VOID)
 
   // hack to work around potential bug in setupsdk . . .
   SetCurrentDirectory("../slapd");
-  sprintf(infFile, "slapd.inf");
+  PR_snprintf(infFile, sizeof(infFile), "slapd.inf");
   GetProductInfoStringWithTok(NSPERL_POST_INSTALL_PROG, "=", nsPerlPostInstall,
 			      BUFSIZ, infFile);
 
@@ -7420,7 +7419,7 @@ NSPERLINST_PostInstall(VOID)
   // get the RunPostInstall attribute from the inf; this is the name
   // of the post install program
   *p = 0; // p points at last dir sep in the path, so null it
-  sprintf(instDir, "%s\\%s", TARGETDIR, nsPerlPostInstall);
+  PR_snprintf(instDir, sizeof(instDir), "%s\\%s", TARGETDIR, nsPerlPostInstall);
   p++;
 
   // change directory to the directory of the post install program and
@@ -7441,8 +7440,8 @@ NSPERLINST_PostInstall(VOID)
 
   SetCurrentDirectory(szCurrentDir);
 
-  sprintf(srcPath, "%s\\nsperl.exe", instDir);
-  sprintf(destPath, "%s\\%s", TARGETDIR, PERL_EXE);
+  PR_snprintf(srcPath, sizeof(srcPath), "%s\\nsperl.exe", instDir);
+  PR_snprintf(destPath, sizeof(destPath), "%s\\%s", TARGETDIR, PERL_EXE);
 
   if (FALSE == CopyFile(srcPath, destPath, FALSE)) { // FALSE to overwrite file if exists
     myLogError("NSPERLINST_PostInstall: could not copy file %s to %s",
@@ -7544,7 +7543,7 @@ static BOOL RemoveSNMPValue(void)
     DWORD sizeof_value_data_buffer;
 
     /* open registry key for Microsoft SNMP service  */
-    sprintf(line, "%s\\%s", KEY_SERVICES, KEY_SNMP_SERVICE); 
+    PR_snprintf(line, sizeof(line), "%s\\%s", KEY_SERVICES, KEY_SNMP_SERVICE); 
     Result = RegOpenKeyEx(HKEY_LOCAL_MACHINE, 
                           line,
                           0,
@@ -7555,7 +7554,7 @@ static BOOL RemoveSNMPValue(void)
        for slapd snmp value to remove  */
     if (Result == ERROR_SUCCESS) 
     {
-        sprintf(line,
+        PR_snprintf(line, sizeof(line),
                 "%s\\%s\\%s",
                 KEY_SOFTWARE_NETSCAPE, 
                 SVR_KEY_ROOT, 
@@ -7574,7 +7573,7 @@ static BOOL RemoveSNMPValue(void)
             for(iterator = 0; iterator <= NumValues; iterator++)
             {
                 sizeof_value_data_buffer=MAX_PATH;
-                sprintf(NumValuesBuf, "%d", iterator);
+                PR_snprintf(NumValuesBuf, sizeof(NumValuesBuf), "%d", iterator);
                 Result = RegQueryValueEx(hServerKey,
                                          NumValuesBuf,
                                          NULL,
@@ -7604,13 +7603,13 @@ BOOL RemoveSNMPKeys(void)
 
     /* open registry key for Directory SNMP s */
      memset(line, '\0', MAX_PATH);
-     sprintf(line, "%s\\%s\\%s", KEY_SOFTWARE_NETSCAPE, SVR_KEY_ROOT, 
+     PR_snprintf(line, sizeof(line), "%s\\%s\\%s", KEY_SOFTWARE_NETSCAPE, SVR_KEY_ROOT, 
                              	 KEY_SNMP_CURRENTVERSION);
     
      RegDeleteKey(HKEY_LOCAL_MACHINE, line);
 
      memset(line, '\0', MAX_PATH);
-     sprintf(line, "%s\\%s\\%s", KEY_SOFTWARE_NETSCAPE, SVR_KEY_ROOT, 
+     PR_snprintf(line, sizeof(line), "%s\\%s\\%s", KEY_SOFTWARE_NETSCAPE, SVR_KEY_ROOT, 
                              	 SNMP_SERVICE_NAME);
 
      RegDeleteKey(HKEY_LOCAL_MACHINE, line);
@@ -7646,7 +7645,7 @@ BOOL RemoveDirectoryRootKey()
     BOOL  bRC = TRUE;
 
     memset(line, '\0', MAX_PATH);
-    sprintf(line, "%s\\%s", KEY_SOFTWARE_NETSCAPE, DS_NAME_SHORT);
+    PR_snprintf(line, sizeof(line), "%s\\%s", KEY_SOFTWARE_NETSCAPE, DS_NAME_SHORT);
 
     RegDeleteKey(HKEY_LOCAL_MACHINE, line);
   
@@ -7807,7 +7806,7 @@ void ControlSlapdInstance(char *pszServiceName, BOOL bOn)
    		LoadString( mi.m_hModule, IDS_STOPPING_SERVICE, szFormat, MAX_STR_SIZE);
    }
 
-   sprintf(szMessage, szFormat, shortName);
+   PR_snprintf(szMessage, sizeof(szMessage), szFormat, shortName);
 
    myLogData(szMessage);
 	ZeroMemory(&shutdownargs, sizeof(shutdownargs));
@@ -7821,7 +7820,7 @@ void ControlSlapdInstance(char *pszServiceName, BOOL bOn)
 			&& (bOn != (bServerRunning = isServiceRunning( pszServiceName ) ) ) )
 	{
 		/* try to turn of the server */
-		sprintf(szLog, szMessage);
+		PR_snprintf(szLog, sizeof(szLog), szMessage);
 		LogData(NULL, szLog);
 		myLogData(szLog);
 
@@ -7842,7 +7841,7 @@ void ControlSlapdInstance(char *pszServiceName, BOOL bOn)
    				LoadString( mi.m_hModule, IDS_WAIT_SERVICE_STOP, szFormat, MAX_STR_SIZE);
 		   }
 
-	  	   sprintf(szLog, szFormat, shortName);
+	  	   PR_snprintf(szLog, sizeof(szLog), szFormat, shortName);
 		   LogData(NULL, szLog);
 		   myLogData(szLog);
 
@@ -7899,7 +7898,7 @@ static void ConvertPasswordToPin(char *pszServerRoot, char *pszServiceName)
 		return;
 	}
 	/* have to be in the alias directory to run this */
-	sprintf(szNewDir, "%s\\alias", pszServerRoot);
+	PR_snprintf(szNewDir, sizeof(szNewDir), "%s\\alias", pszServerRoot);
 	/* change current dir to the alias directory */
 	if (SetCurrentDirectory(szNewDir) == 0)
 	{
@@ -7909,7 +7908,7 @@ static void ConvertPasswordToPin(char *pszServerRoot, char *pszServiceName)
 	}
 
 	/* spawn the perl script which does the conversion */
-	sprintf(szFormat, "\"%s\\bin\\slapd\\admin\\bin\\migratePwdFile\" \"%s\" %s",
+	PR_snprintf(szFormat, sizeof(szFormat), "\"%s\\bin\\slapd\\admin\\bin\\migratePwdFile\" \"%s\" %s",
 		pszServerRoot, pszServerRoot, pszServiceName);
 	run_cgi(pszServerRoot, PERL_EXE, szFormat);
 
@@ -7946,7 +7945,7 @@ static void ReinstallUpgradeServer(char *pszServerRoot, char *pszServiceName)
 	}
 
 	/* spawn the perl script which does the conversion */
-	sprintf(szFormat, "\"%s\\bin\\slapd\\admin\\bin\\upgradeServer\" \"%s\" %s",
+	PR_snprintf(szFormat, sizeof(szFormat), "\"%s\\bin\\slapd\\admin\\bin\\upgradeServer\" \"%s\" %s",
 		pszServerRoot, pszServerRoot, pszServiceName);
 	run_cgi(pszServerRoot, PERL_EXE, szFormat);
 
@@ -7973,9 +7972,9 @@ BOOL RemoveSlapdInstance(LPCSTR pszServerRoot, char *pszServiceName)
     /* now try to remove the instance */
 
 	/* call remove cgi with inf */
-	sprintf(szINFfile, "%s/unin%d.inf", TEMPDIR, _getpid());	
+	PR_snprintf(szINFfile, sizeof(szINFfile), "%s/unin%d.inf", TEMPDIR, _getpid());	
 	writeUninstINFfile(	szINFfile, pszServerRoot, pszServiceName);
-	sprintf(szCGIArgs, " -f \"%s\"", szINFfile);
+	PR_snprintf(szCGIArgs, sizeof(szCGIArgs), " -f \"%s\"", szINFfile);
 
 	/* remove this instance */
 	status = run_cgi(pszServerRoot, "bin\\slapd\\admin\\bin\\ds_remove.exe", szCGIArgs);
@@ -8026,7 +8025,7 @@ BOOL RemoveMiscSlapdFiles(pszServerRoot)
     for(i=0; miscFilesList[i] != NULL; i++)
     {
         memset(szFileName, '\0', MAX_STR_SIZE);
-        sprintf(szFileName, "%s\\%s", pszServerRoot, miscFilesList[i] );
+        PR_snprintf(szFileName, sizeof(szFileName), "%s\\%s", pszServerRoot, miscFilesList[i] );
         DeleteRecursively(szFileName);
     }
 
@@ -8247,7 +8246,7 @@ DSMessageBox(UINT type, UINT titleKey, UINT msgKey, const char *titlearg, ...)
 		LoadString(mi.m_hModule, titleKey, titleFormat, MAX_STR_SIZE);
 
 	va_start(ap, titlearg);
-	vsprintf(msg, msgFormat, ap);
+	PR_vsnprintf(msg, sizeof(msg), msgFormat, ap);
 	va_end(ap);
 
 	LogData(NULL, msg);
@@ -8256,7 +8255,7 @@ DSMessageBox(UINT type, UINT titleKey, UINT msgKey, const char *titlearg, ...)
 	{
 		if (titleFormat[0])
 		{
-			sprintf(title, titleFormat, titlearg);
+			PR_snprintf(title, sizeof(title), titleFormat, titlearg);
 			retval = NsSetupMessageBox(NULL, msg, title, type);
 		}
 		else
@@ -8292,7 +8291,7 @@ DSMessageBoxOK(UINT titleKey, UINT msgKey, const char *titlearg, ...)
 		LoadString(mi.m_hModule, titleKey, titleFormat, MAX_STR_SIZE);
 
 	va_start(ap, titlearg);
-	vsprintf(msg, msgFormat, ap);
+	PR_vsnprintf(msg, sizeof(msg), msgFormat, ap);
 	va_end(ap);
 
 	LogData(NULL, msg);
@@ -8300,7 +8299,7 @@ DSMessageBoxOK(UINT titleKey, UINT msgKey, const char *titlearg, ...)
 	{
 		if (titleFormat[0])
 		{
-			sprintf(title, titleFormat, titlearg);
+			PR_snprintf(title, sizeof(title), titleFormat, titlearg);
 			retval = NsSetupMessageBox(NULL, msg, title, MB_OK);
 		}
 		else
diff --git a/ldap/include/Makefile b/ldap/include/Makefile
index d4ab5bf9..c56ed6e3 100644
--- a/ldap/include/Makefile
+++ b/ldap/include/Makefile
@@ -26,9 +26,6 @@ endif
 
 all:	FORCE
 
-$(LDAP_INCLUDEDIR):
-		$(MKDIR) $(LDAP_INCLUDEDIR)
-
 clientSDK: $(LDAP_INCLUDEDIR) all FORCE
 		$(INSTALL) $(INSTALLFLAGS) $(PROT) ldap.h $(LDAP_INCLUDEDIR)
 		$(INSTALL) $(INSTALLFLAGS) $(PROT) lber.h $(LDAP_INCLUDEDIR)
diff --git a/ldap/include/ldaplog.h b/ldap/include/ldaplog.h
index d2744987..4390276e 100644
--- a/ldap/include/ldaplog.h
+++ b/ldap/include/ldaplog.h
@@ -70,7 +70,7 @@ extern "C" {
 #    define LDAPDebug( level, fmt, arg1, arg2, arg3 ) \
 		if ( slapd_ldap_debug & level ) { \
 			char msg[256]; \
-			sprintf( msg, fmt, arg1, arg2, arg3 ); \
+			PR_snprintf( msg, sizeof(msg), fmt, arg1, arg2, arg3 ); \
 			ber_err_print( msg ); \
 		}
 #    define LDAPDebugLevelIsSet( level )	(0 != (slapd_ldap_debug & level))
diff --git a/ldap/libraries/Makefile b/ldap/libraries/Makefile
index ff1099d8..d003d24c 100644
--- a/ldap/libraries/Makefile
+++ b/ldap/libraries/Makefile
@@ -283,10 +283,6 @@ FORCE:
 $(LDAP_OUT_DIR):
 	$(MKDIR) $(LDAP_OUT_DIR)
 
-$(LDAP_LIBDIR):
-	$(MKDIR) $(LDAP_LIBDIR)
-
-
 GENEXPORTS=$(PERL) $(LDAP_SRC)/build/genexports.pl
 # WINDEFDIR is now defined below via a recursive make.  This is a
 # bit of a hack to avoid collisions with SDK_EXPORT_DEFS (defined above).
diff --git a/ldap/libraries/libavl/Makefile b/ldap/libraries/libavl/Makefile
index 8ead01dc..3bc05225 100644
--- a/ldap/libraries/libavl/Makefile
+++ b/ldap/libraries/libavl/Makefile
@@ -35,9 +35,6 @@ clientSDK: all
 
 all:	$(OBJDEST) $(LIBDIR) $(LIBAVL)
 
-$(LIBDIR):
-	$(MKDIR) $(LIBDIR)
-
 $(LIBAVL): $(OBJS)
 	$(LINK_LIB)
 
diff --git a/ldap/libraries/libldif/Makefile b/ldap/libraries/libldif/Makefile
index 0ec8cddb..7037cade 100644
--- a/ldap/libraries/libldif/Makefile
+++ b/ldap/libraries/libldif/Makefile
@@ -35,9 +35,6 @@ clientSDK: all
 
 all:	$(OBJDEST) $(LIBDIR) $(OBJS) $(LIBLDIF)
 
-$(LIBDIR):
-	$(MKDIR) $(LIBDIR)
-
 $(LIBLDIF): $(OBJS)
 	$(LINK_LIB)
 
diff --git a/ldap/libraries/libldif/line64.c b/ldap/libraries/libldif/line64.c
index ade33a91..e09d8250 100644
--- a/ldap/libraries/libldif/line64.c
+++ b/ldap/libraries/libldif/line64.c
@@ -36,6 +36,8 @@
 #include <sys/stat.h>
 #include "fileurl.h"
 
+#include "nspr.h"
+
 #ifndef isascii
 #define isascii( c )	(!((c) & ~0177))
 #endif
@@ -194,32 +196,28 @@ ldif_parse_line(
 
         bv.bv_val = NULL;
         
-        if (( *errmsg = (char *)malloc( strlen(s) +  1024 )) == NULL ) {
-            return (-1);
-        }
-                
 	    /*
 	     * We only support file:// URLs for now.
 	     */
         
 	    switch( ldif_fileurl2path( s, &path )) {
 	    case LDIF_FILEURL_NOTAFILEURL:
-            sprintf(*errmsg, 
-                    "ldif_parse_line: unsupported URL \"%S\";"
+            *errmsg = PR_smprintf(
+                    "ldif_parse_line: unsupported URL \"%s\";"
                     " use a file:// URL instead.\n", s);
             rc = -1;
             break;
 
 	    case LDIF_FILEURL_MISSINGPATH:
-            sprintf(*errmsg,
-                    "ldif_parse_line: unable to process URL \"%S\" --"
+            *errmsg = PR_smprintf(
+                    "ldif_parse_line: unable to process URL \"%s\" --"
                     " missing path..\n", s);  
             rc = -1;
             break;
             
 	    case LDIF_FILEURL_NONLOCAL:
-            sprintf(*errmsg,
-                    "ldif_parse_line: unable to process URL \"%S\" --"
+            *errmsg = PR_smprintf(
+                    "ldif_parse_line: unable to process URL \"%s\" --"
                     " only local file:// URLs are supported.\n", s);  
             rc = -1;
             break;
@@ -234,11 +232,11 @@ ldif_parse_line(
                 perror( path );
                 rc = -1;
             } else if ( fstats.st_mode & S_IFDIR ) {	
-                sprintf(*errmsg,
+                *errmsg = PR_smprintf(
                         "ldif_parse_line: %s is a directory, not a file.\n", path);  
                 rc = -1;
             } else if ( ldif_fromfile( path, &bv ) < 0 ) {
-                sprintf(*errmsg,
+                *errmsg = PR_smprintf(
                         "ldif_parse_line: unable to retrieve information"
                         " from file %s.\n", path);                  
                 rc = -1;
@@ -247,8 +245,8 @@ ldif_parse_line(
             break;
             
 	    default:
-            sprintf(*errmsg,
-                    "ldif_parse_line: unable to process URL \"%S\" --"
+            *errmsg = PR_smprintf(
+                    "ldif_parse_line: unable to process URL \"%s\" --"
                     " unknown error.\n", s);  
             rc = -1;
 	    }
diff --git a/ldap/libraries/liblitekey/Makefile b/ldap/libraries/liblitekey/Makefile
index ac926410..2fbc5916 100644
--- a/ldap/libraries/liblitekey/Makefile
+++ b/ldap/libraries/liblitekey/Makefile
@@ -33,9 +33,6 @@ LIBLITEKEY = $(addprefix $(LIBDIR)/, liblitekey.$(LIB_SUFFIX))
 
 all:	$(OBJDEST) $(LIBDIR) $(OBJS) $(LIBLITEKEY)
 
-$(LIBDIR):
-	$(MKDIR) $(LIBDIR)
-
 $(LIBLITEKEY): $(OBJS)
 	$(LINK_LIB)
 
diff --git a/ldap/libraries/liblitekey/keycheck.c b/ldap/libraries/liblitekey/keycheck.c
index 16fed899..0231c5f5 100644
--- a/ldap/libraries/liblitekey/keycheck.c
+++ b/ldap/libraries/liblitekey/keycheck.c
@@ -14,7 +14,6 @@
 #include <litekey.h>
 
 #define DS_NORMAL_MAGIC_KEY	119
-#define	DS_LITE_MAGIC_KEY	326
 #define FILE_PATHSEP '/'
 #define BUFSIZE 800
 
@@ -33,63 +32,7 @@
  */
 int is_directory_lite( char *root)
 {
-
-	char	buf[40];
-	char	*bufp = buf;
-	FILE	*fp = NULL;
-	int	key =0;
-	char	*nsroot;
-	char	pathname[BUFSIZE];
-
 	return DS_NORMAL_TYPE; /* richm: no more lite mode in DS 5.0 */
-#if 0 /* no more lite mode */
-	/* There are 3 ways to determine if the server is FULL or LITE.
-	 * 1) Use NETSITE_ROOT variable
-	 * 2) Use the root path provided 
-	 * 3) Look at the current directory
-	 * 
-	 * If all of them fails, then it's LITE.
-	*/
-	nsroot = getenv("NETSITE_ROOT");
-
-	if ( (NULL == root) && (NULL == nsroot)) {
-		/* case 3 */
-		sprintf ( pathname, "slapd.key" );
-	} else if (NULL == nsroot) {
-		/* case 2 */
-		sprintf ( pathname, "%s%cbin%cslapd%cserver%cslapd.key",
-				root, FILE_PATHSEP,FILE_PATHSEP,
-				FILE_PATHSEP, FILE_PATHSEP);
-	} else {
-		/* case 1 */
-		sprintf ( pathname, "%s%cbin%cslapd%cserver%cslapd.key",
-				nsroot, FILE_PATHSEP,FILE_PATHSEP,
-				FILE_PATHSEP, FILE_PATHSEP);
-	}
-
-
-	/* First read from the key file */
-	if ((fp = fopen ( pathname, "r")) == NULL )
-		return DS_LITE_TYPE;
-
-	if ( fgets(buf, 40, fp) == NULL)
-		return DS_LITE_TYPE;
-
-	fclose (fp );
-
-	/* The key is in the format: "key:123456" */
-	bufp +=4;
-	key = atoi (  (const char *) bufp );
-
-	/* Now we have the key. Determine which one it is */
-	if (  0 == (key % DS_NORMAL_MAGIC_KEY))
-		return DS_NORMAL_TYPE;
-	else if ( 0 == (key % DS_LITE_MAGIC_KEY) )
-		return DS_LITE_TYPE;
-
-	/* By defualt, it's lite */
-	return DS_LITE_TYPE;
-#endif /* no more lite mode */
 }
 
 /*
@@ -111,10 +54,7 @@ int generate_directory_key( int type)
 
 	val = rand();
 
-	if (type == DS_NORMAL_TYPE )
-		key = val * DS_NORMAL_MAGIC_KEY;
-	else if (type == DS_LITE_TYPE )
-		key = val * DS_LITE_MAGIC_KEY;
+	key = val * DS_NORMAL_MAGIC_KEY;
 
 	return key;
 }
@@ -127,11 +67,5 @@ int generate_directory_key( int type)
 int 
 is_key_validNormalKey ( int key )
 {
-
-	if (key <= 0 ) return 0;
-
-	if (0 == ( key % DS_NORMAL_MAGIC_KEY ))
-		return 1;
-
-	return 0;
+	return 1;
 }
diff --git a/ldap/libraries/libutil/ntdebug.c b/ldap/libraries/libutil/ntdebug.c
index 50b7ea1a..c51f7848 100644
--- a/ldap/libraries/libutil/ntdebug.c
+++ b/ldap/libraries/libutil/ntdebug.c
@@ -31,7 +31,7 @@ void LDAPDebug( int level, char *fmt, ... )
 	if ( slapd_ldap_debug & level ) 
 	{ 
 		char szFormattedString[512]; 
-		_vsnprintf( szFormattedString, sizeof( szFormattedString ), fmt, arg_ptr ); 
+		PR_vsnprintf( szFormattedString, sizeof( szFormattedString ), fmt, arg_ptr ); 
 
 #if defined( LDAP_DEBUG )
 		/* Send to debug window ...*/
diff --git a/ldap/libraries/libutil/ntevent.c b/ldap/libraries/libutil/ntevent.c
index 2ace2979..2240936a 100644
--- a/ldap/libraries/libutil/ntevent.c
+++ b/ldap/libraries/libutil/ntevent.c
@@ -10,6 +10,8 @@
 #include <stdio.h>
 #include "ldap.h"
 #include "regparms.h"
+#include "nspr.h"
+#include "plstr.h"
 
 HANDLE hSlapdEventSource;
 LPTSTR	pszServerName;
@@ -89,7 +91,7 @@ MultipleInstances()
 	if( !pszServerName )
 		return FALSE;
 
-	sprintf(szDoneEvent, "NS_%s", pszServerName);
+	PR_snprintf(szDoneEvent, sizeof(szDoneEvent), "NS_%s", pszServerName);
 
     hServDoneSemaphore = CreateSemaphore(
         NULL,   // security attributes    
@@ -102,7 +104,7 @@ MultipleInstances()
         result = GetLastError();
         if (result == ERROR_INVALID_HANDLE) {
 
-            sprintf(ErrMsg, "Netscape Server %s is already"
+            PR_snprintf(ErrMsg, sizeof(ErrMsg), "Netscape Server %s is already"
             " running. Terminating this instance.", pszServerName);
 
             MessageBox(GetDesktopWindow(), ErrMsg,
@@ -136,7 +138,7 @@ BOOL SlapdGetServerNameFromCmdline(char *szServerName, char *szCmdLine, int dirn
 	if( szCmdLine )
 	{
 		memset(szCmdCopy, 0, _MAX_PATH );
-		strcpy( szCmdCopy, szCmdLine );
+		PL_strncpyz( szCmdCopy, szCmdLine , sizeof(szCmdCopy) );
 	}
 	else
 		return(bReturn);
diff --git a/ldap/servers/plugins/Makefile b/ldap/servers/plugins/Makefile
index 5abb48f0..2f4b84de 100644
--- a/ldap/servers/plugins/Makefile
+++ b/ldap/servers/plugins/Makefile
@@ -20,7 +20,9 @@ include $(BUILD_ROOT)/nsconfig.mk
 include $(LDAP_SRC)/nsldap.mk
 
 ifneq ($(ARCH), WINNT)
-all: _referint _collation _syntaxes _passthru _utils _uiduniq _roles _acl _replication _cos _pwdstorage _rever _chainingdb _distrib _retrocl _statechange _http _views _pam_passthru
+all: _referint _collation _syntaxes _passthru _utils _uiduniq _roles _acl _replication _cos _pwdstorage _rever _chainingdb _distrib _retrocl _statechange _http _views
+# richm 20050303 - do not build pam pass thru for DS 7.1
+#all: _referint _collation _syntaxes _passthru _utils _uiduniq _roles _acl _replication _cos _pwdstorage _rever _chainingdb _distrib _retrocl _statechange _http _views _pam_passthru
 else
 all: _referint _collation _syntaxes _passthru _utils _uiduniq _roles _acl _replication _cos _pwdstorage _rever _chainingdb _distrib _retrocl _statechange _http _views
 endif
diff --git a/ldap/servers/plugins/acl/acl.c b/ldap/servers/plugins/acl/acl.c
index 24848efa..4e21c31d 100644
--- a/ldap/servers/plugins/acl/acl.c
+++ b/ldap/servers/plugins/acl/acl.c
@@ -35,7 +35,7 @@ static char *ds_map_generic[2] = { NULL, NULL };
 /****************************************************************************/
 static	int	acl__resource_match_aci(struct acl_pblock *aclpb, aci_t	*aci ,
 								int skip_attrEval, int *a_matched);
-static	acl__TestRights(Acl_PBlock *aclpb,int access, char **right,
+static	int acl__TestRights(Acl_PBlock *aclpb,int access, char **right,
 						char ** map_generic, aclResultReason_t *result_reason);
 static int 	acl__scan_for_acis(struct acl_pblock *aclpb, int *err);
 static void	acl__reset_cached_result (struct acl_pblock *aclpb );
@@ -43,7 +43,6 @@ static int 	acl__scan_match_handles ( struct acl_pblock *aclpb, int type);
 static int 	acl__attr_cached_result (struct acl_pblock *aclpb, char *attr, int access );
 static int 	acl__match_handlesFromCache (struct acl_pblock *aclpb, char *attr, int access);
 static int	acl__get_attrEval ( struct acl_pblock *aclpb, char *attr );
-static int	acl__config_get_readonly ();
 static int	acl__recompute_acl (Acl_PBlock *aclpb, AclAttrEval *a_eval,
 									int	access,	int	aciIndex);
 static void	__acl_set_aclIndex_inResult ( Acl_PBlock *aclpb,
@@ -991,8 +990,7 @@ acl_read_access_allowed_on_entry (
 				slapi_ch_free ( (void **) &aclpb->aclpb_Evalattr);
 				aclpb->aclpb_Evalattr = slapi_ch_malloc(len);
 			}
-			strncpy (aclpb->aclpb_Evalattr, attr_type, len);
-			aclpb->aclpb_Evalattr[len] = '\0';
+			PL_strncpyz (aclpb->aclpb_Evalattr, attr_type, len);
 			if ( attr_index >= 0 ) {
 				/*
 				 * access was granted to one of the user specified attributes
@@ -3872,34 +3870,6 @@ acl_regen_aclsignature ()
 }
 	
 
-
-static int
-acl__handle_config_entry (Slapi_Entry *e,  void *callback_data )
-{
-
-    int             *value = (int *) callback_data;
-
-	*value = slapi_entry_attr_get_int( e, "nsslapd-readonly");
-       
-    return 0;
-}
-
-static int
-acl__config_get_readonly ()
-{
-
-	int readonly = 0;
-
-	slapi_search_internal_callback( "cn=config", LDAP_SCOPE_BASE, "(objectclass=*)",
-   	                        NULL, 0 /* attrsonly */,
-                            &readonly/* callback_data */,
-                            NULL /* controls */,
-                            NULL /* result_callback */,
-                            acl__handle_config_entry,
-                            NULL /* referral_callback */);
-
-	return readonly;
-}
 /*
 *
 * Assumptions:
diff --git a/ldap/servers/plugins/acl/acl_ext.c b/ldap/servers/plugins/acl/acl_ext.c
index 129c7f54..511862b9 100644
--- a/ldap/servers/plugins/acl/acl_ext.c
+++ b/ldap/servers/plugins/acl/acl_ext.c
@@ -730,7 +730,6 @@ acl__done_aclpb ( struct acl_pblock *aclpb )
 
 	int		i;
 	int		dump_aclpb_info = 0;
-	char    *ds_attr_userdn=NULL;	/* for finding userdn for freeing */
 	int 	rc=-1;
 	char 	*tmp_ptr=NULL;
 
diff --git a/ldap/servers/plugins/acl/aclanom.c b/ldap/servers/plugins/acl/aclanom.c
index 1161a4bd..ba03552a 100644
--- a/ldap/servers/plugins/acl/aclanom.c
+++ b/ldap/servers/plugins/acl/aclanom.c
@@ -352,7 +352,6 @@ aclanom_get_suffix_info(Slapi_Entry *e,
 	char     *ndn = NULL;
 	Slapi_DN    *e_sdn;
 	const char    *aci_ndn;
-	int populate = 0;
 	struct scoped_entry_anominfo *s_e_anominfo =
 			&aclpb->aclpb_scoped_entry_anominfo;
 
diff --git a/ldap/servers/plugins/acl/acleffectiverights.c b/ldap/servers/plugins/acl/acleffectiverights.c
index 98d08ee9..2a1c61ae 100644
--- a/ldap/servers/plugins/acl/acleffectiverights.c
+++ b/ldap/servers/plugins/acl/acleffectiverights.c
@@ -5,6 +5,53 @@
 
 #include "acl.h"
 
+/* safer than doing strcat unprotected */
+/* news2 is optional, provided as a convenience */
+/* capacity is the capacity of the gerstr, size is the current length */
+static void
+_append_gerstr(char **gerstr, size_t *capacity, size_t *size, const char *news, const char *news2)
+{
+	size_t len;
+	size_t increment = 128;
+	size_t fornull;
+
+	if (!news) {
+		return;
+	}
+
+	/* find out how much space we need */
+	len = strlen(news);
+	fornull = 1;
+	if (news2) {
+		len += strlen(news2);
+		fornull++;
+	}
+
+	/* increase space if needed */
+	while ((*size + len + fornull) > *capacity) {
+		if ((len + fornull) > increment) {
+			*capacity += len + fornull; /* just go ahead and grow the string enough */
+		} else {
+			*capacity += increment; /* rather than having lots of small increments */
+		}
+	}
+
+	if (!*gerstr) {
+		*gerstr = slapi_ch_malloc(*capacity);
+		**gerstr = 0;
+	} else {
+		*gerstr = slapi_ch_realloc(*gerstr, *capacity);
+	}
+	strcat(*gerstr, news);
+	if (news2) {
+		strcat(*gerstr, news2);
+	}
+
+	*size += len;
+
+	return;
+}
+
 static int
 _ger_g_permission_granted ( Slapi_PBlock *pb, Slapi_Entry *e, char **errbuf )
 {
@@ -203,8 +250,8 @@ _ger_new_gerpb (
 {
 	Connection *conn;
 	struct acl_cblock *geraclcb;
-	Acl_PBlock *aclpb, *geraclpb;
-	Operation *op, *gerop;
+	Acl_PBlock *geraclpb;
+	Operation *gerop;
 	int rc = LDAP_SUCCESS;
 
 	*aclcb = NULL;
@@ -282,17 +329,18 @@ _ger_get_entry_rights (
 	Slapi_PBlock *gerpb,
 	Slapi_Entry *e,
 	const char *subjectndn,
-	char *gerstr,
+	char **gerstr,
+	size_t *gerstrsize,
+	size_t *gerstrcap,
 	char **errbuf
 	)
 {
 	unsigned long entryrights = 0;
 	Slapi_RDN *rdn = NULL;
-	const char *rdnstr = NULL;
-	char *equalsign = NULL;
 	char *rdntype = NULL;
+	char *rdnvalue = NULL;
 
-	strcpy ( gerstr, "entryLevelRights: " );
+	_append_gerstr(gerstr, gerstrsize, gerstrcap, "entryLevelRights: ", NULL);
 
 	slapi_log_error (SLAPI_LOG_ACL, plugin_name,
 		"_ger_get_entry_rights: SLAPI_ACL_READ\n" );
@@ -300,7 +348,7 @@ _ger_get_entry_rights (
 	{
 		/* v - view e */
 		entryrights |= SLAPI_ACL_READ;
-		strcat (gerstr, "v");
+		_append_gerstr(gerstr, gerstrsize, gerstrcap, "v", NULL);
 	}
 	slapi_log_error (SLAPI_LOG_ACL, plugin_name,
 		"_ger_get_entry_rights: SLAPI_ACL_ADD\n" );
@@ -308,7 +356,7 @@ _ger_get_entry_rights (
 	{
 		/* a - add child entry below e */
 		entryrights |= SLAPI_ACL_ADD;
-		strcat (gerstr, "a");
+		_append_gerstr(gerstr, gerstrsize, gerstrcap, "a", NULL);
 	}
 	slapi_log_error (SLAPI_LOG_ACL, plugin_name,
 		"_ger_get_entry_rights: SLAPI_ACL_DELETE\n" );
@@ -316,7 +364,7 @@ _ger_get_entry_rights (
 	{
 		/* d - delete e */
 		entryrights |= SLAPI_ACL_DELETE;
-		strcat (gerstr, "d");
+		_append_gerstr(gerstr, gerstrsize, gerstrcap, "d", NULL);
 	}
 	/*
 	 * Some limitation/simplification applied here:
@@ -327,12 +375,8 @@ _ger_get_entry_rights (
 	 *   the first rdn type only for now.
 	 */
 	rdn = slapi_rdn_new_dn ( slapi_entry_get_ndn (e) );
-	rdnstr = slapi_rdn_get_rdn ( rdn );
-	if ( NULL != (equalsign = strchr ( rdnstr, '=' )) )
-	{
-		rdntype = slapi_ch_malloc ( equalsign-rdnstr+1 );
-		strncpy ( rdntype, rdnstr, equalsign-rdnstr );
-		rdntype [ equalsign-rdnstr ] = '\0';
+	slapi_rdn_get_first(rdn, &rdntype, &rdnvalue);
+	if ( NULL != rdntype ) {
 		slapi_log_error (SLAPI_LOG_ACL, plugin_name,
 			"_ger_get_entry_rights: SLAPI_ACL_WRITE_DEL & _ADD %s\n", rdntype );
 		if (acl_access_allowed(gerpb, e, rdntype, NULL,
@@ -342,19 +386,17 @@ _ger_get_entry_rights (
 		{
 			/* n - rename e */
 			entryrights |= SLAPI_ACL_WRITE;
-			strcat (gerstr, "n");
+			_append_gerstr(gerstr, gerstrsize, gerstrcap, "n", NULL);
 		}
-		slapi_ch_free ( (void**) &rdntype );
 	}
 	slapi_rdn_free ( &rdn );
 
-done:
 	if ( entryrights == 0 )
 	{
-		strcat (gerstr, "none");
+		_append_gerstr(gerstr, gerstrsize, gerstrcap, "none", NULL);
 	}
 
-	strcat (gerstr, "\n");
+	_append_gerstr(gerstr, gerstrsize, gerstrcap, "\n", NULL);
 
 	return entryrights;
 }
@@ -370,25 +412,19 @@ _ger_get_attr_rights (
 	const char *subjectndn,
 	char *type,
 	char **gerstr,
-	int *gerstrsize,
+	size_t *gerstrsize,
+	size_t *gerstrcap,
 	int isfirstattr,
 	char **errbuf
 	)
 {
 	unsigned long attrrights = 0;
 
-	/* Enough space for " $type:rwoscxx" ? */
-	if ( (*gerstrsize - strlen(*gerstr)) < (strlen(type) + 16) )
-	{
-		/* slapi_ch_realloc() exits if realloc() failed */
-		*gerstrsize += 256;
-		*gerstr = slapi_ch_realloc ( *gerstr, *gerstrsize );
-	}
 	if (!isfirstattr)
 	{
-		strcat ( *gerstr, ", " );
+		_append_gerstr(gerstr, gerstrsize, gerstrcap, ", ", NULL);
 	}
-	sprintf ( *gerstr + strlen(*gerstr), "%s:", type );
+	_append_gerstr(gerstr, gerstrsize, gerstrcap, type, ":");
 
 	slapi_log_error (SLAPI_LOG_ACL, plugin_name,
 		"_ger_get_attr_rights: SLAPI_ACL_READ %s\n", type );
@@ -396,7 +432,7 @@ _ger_get_attr_rights (
 	{
 		/* r - read the values of type */
 		attrrights |= SLAPI_ACL_READ;
-		strcat (*gerstr, "r");
+		_append_gerstr(gerstr, gerstrsize, gerstrcap, "r", NULL);
 	}
 	slapi_log_error (SLAPI_LOG_ACL, plugin_name,
 		"_ger_get_attr_rights: SLAPI_ACL_SEARCH %s\n", type );
@@ -404,7 +440,7 @@ _ger_get_attr_rights (
 	{
 		/* s - search the values of type */
 		attrrights |= SLAPI_ACL_SEARCH;
-		strcat (*gerstr, "s");
+		_append_gerstr(gerstr, gerstrsize, gerstrcap, "s", NULL);
 	}
 	slapi_log_error (SLAPI_LOG_ACL, plugin_name,
 		"_ger_get_attr_rights: SLAPI_ACL_COMPARE %s\n", type );
@@ -412,7 +448,7 @@ _ger_get_attr_rights (
 	{
 		/* c - compare the values of type */
 		attrrights |= SLAPI_ACL_COMPARE;
-		strcat (*gerstr, "c");
+		_append_gerstr(gerstr, gerstrsize, gerstrcap, "c", NULL);
 	}
 	slapi_log_error (SLAPI_LOG_ACL, plugin_name,
 		"_ger_get_attr_rights: SLAPI_ACL_WRITE_ADD %s\n", type );
@@ -420,7 +456,7 @@ _ger_get_attr_rights (
 	{
 		/* w - add the values of type */
 		attrrights |= ACLPB_SLAPI_ACL_WRITE_ADD;
-		strcat (*gerstr, "w");
+		_append_gerstr(gerstr, gerstrsize, gerstrcap, "w", NULL);
 	}
 	slapi_log_error (SLAPI_LOG_ACL, plugin_name,
 		"_ger_get_attr_rights: SLAPI_ACL_WRITE_DEL %s\n", type );
@@ -428,7 +464,7 @@ _ger_get_attr_rights (
 	{
 		/* o - delete the values of type */
 		attrrights |= ACLPB_SLAPI_ACL_WRITE_DEL;
-		strcat (*gerstr, "o");
+		_append_gerstr(gerstr, gerstrsize, gerstrcap, "o", NULL);
 	}
 	/* If subjectdn has no general write right, check for self write */
 	if ( 0 == (attrrights & (ACLPB_SLAPI_ACL_WRITE_DEL | ACLPB_SLAPI_ACL_WRITE_ADD)) )
@@ -442,19 +478,19 @@ _ger_get_attr_rights (
 		{
 			/* W - add self to the attribute */
 			attrrights |= ACLPB_SLAPI_ACL_WRITE_ADD;
-			strcat (*gerstr, "W");
+			_append_gerstr(gerstr, gerstrsize, gerstrcap, "W", NULL);
 		}
 		if (acl_access_allowed(gerpb, e, type, &val, ACLPB_SLAPI_ACL_WRITE_DEL) == LDAP_SUCCESS)
 		{
 			/* O - delete self from the attribute */
 			attrrights |= ACLPB_SLAPI_ACL_WRITE_DEL;
-			strcat (*gerstr, "O");
+			_append_gerstr(gerstr, gerstrsize, gerstrcap, "O", NULL);
 		}
 	}
 
 	if ( attrrights == 0 )
 	{
-		strcat (*gerstr, "none");
+		_append_gerstr(gerstr, gerstrsize, gerstrcap, "none", NULL);
 	}
 
 	return attrrights;
@@ -467,21 +503,22 @@ _ger_get_attrs_rights (
 	const char *subjectndn,
 	char **attrs,
 	char **gerstr,
-	int *gerstrsize,
+	size_t *gerstrsize,
+	size_t *gerstrcap,
 	char **errbuf
 	)
 {
 	int isfirstattr = 1;
 
 	/* gerstr was initially allocated with enough space for one more line */
-	strcat ( *gerstr, "attributeLevelRights: " );
+	_append_gerstr(gerstr, gerstrsize, gerstrcap, "attributeLevelRights: ", NULL);
 
 	if (attrs && *attrs)
 	{
 		int i;
 		for ( i = 0; attrs[i]; i++ )
 		{
-			_ger_get_attr_rights ( gerpb, e, subjectndn, attrs[i], gerstr, gerstrsize, isfirstattr, errbuf );
+			_ger_get_attr_rights ( gerpb, e, subjectndn, attrs[i], gerstr, gerstrsize, gerstrcap, isfirstattr, errbuf );
 			isfirstattr = 0;
 		}
 	}
@@ -495,7 +532,7 @@ _ger_get_attrs_rights (
 			if ( ! slapi_attr_flag_is_set (attr, SLAPI_ATTR_FLAG_OPATTR) )
 			{
 				slapi_attr_get_type ( attr, &type );
-				_ger_get_attr_rights ( gerpb, e, subjectndn, type, gerstr, gerstrsize, isfirstattr, errbuf );
+				_ger_get_attr_rights ( gerpb, e, subjectndn, type, gerstr, gerstrsize, gerstrcap, isfirstattr, errbuf );
 				isfirstattr = 0;
 			}
 			prevattr = attr;
@@ -505,7 +542,7 @@ _ger_get_attrs_rights (
 	if ( isfirstattr )
 	{
 		/* not a single attribute was retrived or specified */
-		strcat ( *gerstr, "*:none" );
+		_append_gerstr(gerstr, gerstrsize, gerstrcap, "*:none", NULL);
 	}
 	return;
 }
@@ -587,13 +624,13 @@ acl_get_effective_rights (
 	void *aclcb = NULL;
 	char *subjectndn = NULL;
 	char *gerstr = NULL;
-	int gerstrsize = 1024;
+	size_t gerstrsize = 0;
+	size_t gerstrcap = 0;
 	unsigned long entryrights;
 	int iscritical = 1;
 	int rc;
 
 	*errbuf = '\0';
-	gerstr = slapi_ch_malloc ( gerstrsize );
 
 	/*
 	 * Get the subject
@@ -624,13 +661,13 @@ acl_get_effective_rights (
 	}
 
 	/* Get entry level effective rights */
-	entryrights = _ger_get_entry_rights ( gerpb, e, subjectndn, gerstr, errbuf );
+	entryrights = _ger_get_entry_rights ( gerpb, e, subjectndn, &gerstr, &gerstrsize, &gerstrcap, errbuf );
 
 	/*
 	 * Attribute level effective rights may not be NULL
 	 * even if entry level's is.
 	 */
-	_ger_get_attrs_rights ( gerpb, e, subjectndn, attrs, &gerstr, &gerstrsize, errbuf );
+	_ger_get_attrs_rights ( gerpb, e, subjectndn, attrs, &gerstr, &gerstrsize, &gerstrcap, errbuf );
 
 bailout:
 	/*
@@ -640,7 +677,7 @@ bailout:
 
 	if ( rc != LDAP_SUCCESS )
 	{
-		sprintf ( gerstr, "entryLevelRights: %d\nattributeLevelRights: *:%d", rc, rc );
+		gerstr = slapi_ch_smprintf("entryLevelRights: %d\nattributeLevelRights: *:%d", rc, rc );
 	}
 
 	slapi_log_error (SLAPI_LOG_ACLSUMMARY, plugin_name,
diff --git a/ldap/servers/plugins/acl/aclinit.c b/ldap/servers/plugins/acl/aclinit.c
index a2e8c6ae..53cd975b 100644
--- a/ldap/servers/plugins/acl/aclinit.c
+++ b/ldap/servers/plugins/acl/aclinit.c
@@ -36,7 +36,6 @@ static int acl_initialized = 0;
 int
 aclinit_main()
 {
-	char				*cookie = NULL;
 	Slapi_PBlock		*pb;
 	int					rv;
 	Slapi_DN			*sdn;
@@ -194,7 +193,6 @@ aclinit_search_and_update_aci ( int thisbeonly, const Slapi_DN *base,
 {
 	char				*attrs[2] = { "aci", NULL };
 	 /* Tell __aclinit_handler whether it's an add or a delete */
-	int				any_error = op;
 	Slapi_PBlock 	*aPb;
 	LDAPControl		**ctrls=NULL;
 	int				retval;
diff --git a/ldap/servers/plugins/acl/acllas.c b/ldap/servers/plugins/acl/acllas.c
index 88913ae6..e6437866 100644
--- a/ldap/servers/plugins/acl/acllas.c
+++ b/ldap/servers/plugins/acl/acllas.c
@@ -1487,7 +1487,6 @@ acllas__user_ismember_of_group( struct acl_pblock *aclpb,
 	int			max_nestlevel;
 	int			max_memberlimit;
 	aclUserGroup		*u_group;
-	char			ebuf [ BUFSIZ ];
 	struct member_info	*groupMember = NULL;
 	struct member_info 	*parentGroup = NULL;
 
@@ -3180,13 +3179,10 @@ DS_LASRoleDnAttrEval(NSErr_t *errp, char *attr_name, CmpOp_t comparator,
 		PList_t global_auth)
 {
 
-	char			*s_attrName = NULL;
 	char			*attrName;
 	int				matched;
 	int				rc;
 	Slapi_Attr 		*attr;
-	int				numOflevels = 0;
-	char			*n_currEntryDn = NULL;
 	lasInfo			lasinfo;
 	Slapi_Value     *sval=NULL;
 	const struct berval	*attrVal;
@@ -3477,16 +3473,10 @@ static char **
 acllas_replace_dn_macro( char *rule, char *matched_val, lasInfo *lasinfo) {
 	
 	char **a = NULL;
-	char *str = NULL;
 	char *patched_rule = NULL;
 	char *rule_to_use = NULL;
 	char *new_patched_rule = NULL;	
-	char *rule_prefix = NULL;
-	char *rule_suffix = NULL;
-	int  rule_suffix_len = 0;
-	char *comp = NULL;
 	int	matched_val_len = 0;
-	int macro_len = 0;
 	int j = 0;
 	int has_macro_dn = 0;
 	int has_macro_levels = 0;
diff --git a/ldap/servers/plugins/acl/aclparse.c b/ldap/servers/plugins/acl/aclparse.c
index f3c333fa..d6df5111 100644
--- a/ldap/servers/plugins/acl/aclparse.c
+++ b/ldap/servers/plugins/acl/aclparse.c
@@ -1576,7 +1576,6 @@ __acl_trim_filterstr( char * str ) {
 
 static int __acl__init_targetattrfilters( aci_t *aci, char *input_str) {
 
-	int		numattr=0;
 	char	*s, *str;
 	int		len;	
 	char 	*addlistptr = NULL;
diff --git a/ldap/servers/plugins/acl/aclutil.c b/ldap/servers/plugins/acl/aclutil.c
index d1eb9a67..8971c4f2 100644
--- a/ldap/servers/plugins/acl/aclutil.c
+++ b/ldap/servers/plugins/acl/aclutil.c
@@ -16,9 +16,6 @@ static  void	aclutil__typestr (int type , char str[]);
 static  void	aclutil__Ruletypestr (int type , char str[]);
 static char* 	__aclutil_extract_dn_component ( char **e_dns,  int position, 
 											char *attrName );
-static char*	acl_get_final_component(char *macro_prefix) ;
-static char*	acl_match_component( char *start, char *component);
-static int		aclutil_compare_components( char * comp1, char *comp2);
 static int		acl_find_comp_start(char * s, int pos );
 static PRIntn	acl_ht_free_entry_and_value(PLHashEntry *he, PRIntn i,
 																void *arg);
@@ -130,7 +127,7 @@ aclutil_print_err (int rv , const Slapi_DN *sdn, const struct berval* val,
 		return;
 
 	if (val->bv_len > 0 && val->bv_val != NULL) {
-	    sprintf (str, "%.1023s", val->bv_val);
+	    PR_snprintf (str, sizeof(str), "%.1023s", val->bv_val);
 	} else {
 	    str[0] = '\0';
 	}
@@ -629,7 +626,6 @@ acl_match_macro_in_target( const char *ndn, char * match_this,
 	char *tmp_ptr = NULL;
 	char *matched_val = NULL;
 	char *ndn_suffix_start = NULL;
-	char *macro_prefix_final_component = NULL;
 	char *ret_val = NULL;
 	int ndn_len = 0;
 	int macro_suffix_len = 0;
@@ -890,12 +886,7 @@ acl_match_macro_in_target( const char *ndn, char * match_this,
 int
 acl_match_prefix( char *macro_prefix, const char *ndn, int *exact_match) {
 
-	int macro_index = 0;
-	int ndn_index = 0;
 	int ret_code = -1;
-	char *curr_macro_component = NULL;
-	char *curr_ndn_component = NULL;
-	int matched = 0;
 	int macro_prefix_len = 0;
 	int ndn_len = 0;
 	int i = 0;
@@ -1289,97 +1280,6 @@ get_this_component(char *dn, int *index) {
 	
 } 
 
-/*
- * return 1 if comp1==comp2,
- * return 0 otherwise.
- *
- * the components might have *'s.
- *
- * eg: comp1: cn=*
- * 		comp2: cn=fred
- *
- *
-*/
-
-static int
-aclutil_compare_components( char * comp1, char *comp2) {
-		
-	char *tmp_str = NULL;
-	
-	tmp_str = strstr( comp1, "=*");
-	if (  tmp_str == NULL) {
-	
-		/* Just a straight cmp */
-
-		if (slapi_utf8casecmp((ACLUCHP)comp1, (ACLUCHP)comp2) == 0) {
-			return(1);
-		} else {
-			return(0);
-		}
-	} else {
-
-		char *tmp_comp1= NULL;
-		char *tmp_comp2 = NULL;
-		int ret_code = 0;
-
-		/* Here, just compare the bit before the = */
-	
-		tmp_comp1 = slapi_ch_strdup(comp1);
-		tmp_comp2 = slapi_ch_strdup(comp2);
-
-		/*
-		 * Probably need to verify it's not escaped--see code for looking for
-		 * unescaped commas.
-		*/
-
-		tmp_str = strstr(tmp_comp1, "=");
-		*tmp_str = '\0';
-	
-		tmp_str = strstr(tmp_comp2, "=");
-		if ( tmp_str == NULL) {
-			ret_code = 0;
-		} else{
-
-			*tmp_str = '\0';
-
-			if (slapi_utf8casecmp((ACLUCHP)comp1, (ACLUCHP)comp2) == 0) {
-				ret_code = 1;
-			} else {
-				ret_code = 0;
-			}
-						
-		slapi_ch_free((void **)&tmp_comp1);
-		slapi_ch_free((void **)&tmp_comp2);
-		
-		return(ret_code);
-
-		}
-								
-	}
-}
-
-/*
- * return a pointer to the final component of macro_prefix.
-*/
-
-static char *
-acl_get_final_component(char *macro_prefix) {
-
-	return(NULL);
-}
-
-/*
- * 
- * 
-*/
-
-static char *
-acl_match_component( char *start, char *component) {
-
-
-	return(NULL);
-}
-
 /* acl hash table funcs */
 
 /*
diff --git a/ldap/servers/plugins/chainingdb/cb_add.c b/ldap/servers/plugins/chainingdb/cb_add.c
index 4a0fcad0..b68ec720 100644
--- a/ldap/servers/plugins/chainingdb/cb_add.c
+++ b/ldap/servers/plugins/chainingdb/cb_add.c
@@ -76,7 +76,9 @@ chaining_back_add ( Slapi_PBlock *pb )
 	if ((rc = cb_get_connection(cb->pool,&ld,&cnx,NULL,&cnxerrbuf)) != LDAP_SUCCESS) {
                 cb_send_ldap_result( pb, LDAP_OPERATIONS_ERROR,NULL,cnxerrbuf, 0, NULL);
 		ldap_mods_free(mods,1);
-		slapi_ch_free((void **)&cnxerrbuf);
+		if (cnxerrbuf) {
+		  PR_smprintf_free(cnxerrbuf);
+		}
                 /* ping the farm. If the farm is unreachable, we increment the counter */
                 cb_ping_farm(cb,NULL,0);
 
diff --git a/ldap/servers/plugins/chainingdb/cb_bind.c b/ldap/servers/plugins/chainingdb/cb_bind.c
index 7f80507a..404fdcb4 100644
--- a/ldap/servers/plugins/chainingdb/cb_bind.c
+++ b/ldap/servers/plugins/chainingdb/cb_bind.c
@@ -245,7 +245,7 @@ chainingdb_bind( Slapi_PBlock *pb ) {
 	if ( LDAP_USER_CANCELLED != rc ) {
    		errmsg = ldap_err2string( rc );
 		if (rc == LDAP_TIMEOUT) {
-		  cb_ping_farm(cb,NULL,NULL);
+		  cb_ping_farm(cb,NULL,0);
 		}
             	rc = LDAP_OPERATIONS_ERROR;
 	}
diff --git a/ldap/servers/plugins/chainingdb/cb_compare.c b/ldap/servers/plugins/chainingdb/cb_compare.c
index 0163c946..9fb2b0ab 100644
--- a/ldap/servers/plugins/chainingdb/cb_compare.c
+++ b/ldap/servers/plugins/chainingdb/cb_compare.c
@@ -77,7 +77,9 @@ chaining_back_compare ( Slapi_PBlock *pb )
 
 	if ((rc = cb_get_connection(cb->pool,&ld,&cnx,NULL,&cnxerrbuf)) != LDAP_SUCCESS) {
                 cb_send_ldap_result( pb, LDAP_OPERATIONS_ERROR, NULL, cnxerrbuf, 0, NULL);
-	       	slapi_ch_free((void **)&cnxerrbuf);
+				if (cnxerrbuf) {
+					PR_smprintf_free(cnxerrbuf);
+				}
                 /* ping the farm. If the farm is unreachable, we increment the counter */
                 cb_ping_farm(cb,NULL,0);
                 return 1;
diff --git a/ldap/servers/plugins/chainingdb/cb_config.c b/ldap/servers/plugins/chainingdb/cb_config.c
index 3f12cccd..e7e13348 100644
--- a/ldap/servers/plugins/chainingdb/cb_config.c
+++ b/ldap/servers/plugins/chainingdb/cb_config.c
@@ -29,7 +29,7 @@ int cb_config_add_dse_entries(cb_backend *cb, char **entries, char *string1, cha
 
         for(x = 0; strlen(entries[x]) > 0; x++) {
                 util_pb = slapi_pblock_new();
-                sprintf(entry_string, entries[x], string1, string2, string3);
+                PR_snprintf(entry_string, sizeof(entry_string), entries[x], string1, string2, string3);
                 e = slapi_str2entry(entry_string, 0);
                 slapi_add_entry_internal_set_pb(util_pb, e, NULL, cb->identity, 0);
 		slapi_add_internal_pb(util_pb);
@@ -125,7 +125,7 @@ int cb_config_load_dse_info(Slapi_PBlock * pb) {
 	/* Get the default instance value entry if it exists */
 	/* else create it 				     */
 
-	sprintf(defaultDn,"cn=default instance config,%s",cb->pluginDN);
+	PR_snprintf(defaultDn,sizeof(defaultDn),"cn=default instance config,%s",cb->pluginDN);
 
         default_pb = slapi_pblock_new();
         slapi_search_internal_set_pb(default_pb, defaultDn, LDAP_SCOPE_BASE,
diff --git a/ldap/servers/plugins/chainingdb/cb_conn_stateless.c b/ldap/servers/plugins/chainingdb/cb_conn_stateless.c
index dd017d02..b988da87 100644
--- a/ldap/servers/plugins/chainingdb/cb_conn_stateless.c
+++ b/ldap/servers/plugins/chainingdb/cb_conn_stateless.c
@@ -174,8 +174,7 @@ int cb_get_connection(cb_conn_pool * pool, LDAP ** lld, cb_outgoing_conn ** cc,s
                 slapi_log_error( SLAPI_LOG_PLUGIN, CB_PLUGIN_SUBSYSTEM,
                 	"<== cb_get_connection error (no connection available)\n");
 		if ( errmsg ) {
-			*errmsg = slapi_ch_malloc(CB_BUFSIZE);
-			sprintf(*errmsg,error1,"no connection available");
+			*errmsg = PR_smprintf(error1, "no connection available");
 		}
 		return LDAP_CONNECT_ERROR;
         }
@@ -227,8 +226,7 @@ int cb_get_connection(cb_conn_pool * pool, LDAP ** lld, cb_outgoing_conn ** cc,s
   				slapi_log_error( SLAPI_LOG_PLUGIN, CB_PLUGIN_SUBSYSTEM,
         				"cb_get_connection server %s expired.\n", hostname );
 				if ( errmsg ) {
-					*errmsg = slapi_ch_malloc(CB_BUFSIZE);
-					sprintf(*errmsg,error1,"timelimit exceeded");
+					*errmsg = PR_smprintf(error1,"timelimit exceeded");
 				}
 				rc=LDAP_TIMELIMIT_EXCEEDED;
 				conn=NULL;
@@ -299,8 +297,7 @@ int cb_get_connection(cb_conn_pool * pool, LDAP ** lld, cb_outgoing_conn ** cc,s
                                		"Can't contact server <%s> port <%d>.\n", hostname, port);
 				}
 				if ( errmsg ) {
-					*errmsg = slapi_ch_malloc(CB_BUFSIZE);
-					sprintf(*errmsg,error1,"unknown reason");
+					*errmsg = PR_smprintf(error1,"unknown reason");
 				}
 				rc = LDAP_CONNECT_ERROR;
 				goto unlock_and_return;
@@ -365,8 +362,7 @@ int cb_get_connection(cb_conn_pool * pool, LDAP ** lld, cb_outgoing_conn ** cc,s
 								prerr, slapd_pr_strerror(prerr));
 					}
 					if ( errmsg ) {
-						*errmsg = slapi_ch_malloc(CB_BUFSIZE);
-						sprintf(*errmsg,error2, ldap_err2string(rc));
+						*errmsg = PR_smprintf(error2, ldap_err2string(rc));
 					}
 					rc = LDAP_CONNECT_ERROR;
 					goto unlock_and_return;
@@ -386,8 +382,7 @@ int cb_get_connection(cb_conn_pool * pool, LDAP ** lld, cb_outgoing_conn ** cc,s
 							prerr, slapd_pr_strerror(prerr));
 					}
 					if ( errmsg ) {
-						*errmsg = slapi_ch_malloc(CB_BUFSIZE);
-						sprintf(*errmsg,error2,ldap_err2string(rc));
+						*errmsg = PR_smprintf(error2,ldap_err2string(rc));
 					}
 					rc = LDAP_CONNECT_ERROR;
 					goto unlock_and_return;
@@ -411,8 +406,7 @@ int cb_get_connection(cb_conn_pool * pool, LDAP ** lld, cb_outgoing_conn ** cc,s
                                         		hostname, port, ldap_err2string(parse_rc));
 						}
 						if ( errmsg ) {
-	                                                *errmsg = slapi_ch_malloc(CB_BUFSIZE);
-							sprintf(*errmsg,error2,ldap_err2string(parse_rc));
+							*errmsg = PR_smprintf(error2,ldap_err2string(parse_rc));
 						}
 						rc = parse_rc;
 						goto unlock_and_return;
@@ -425,8 +419,7 @@ int cb_get_connection(cb_conn_pool * pool, LDAP ** lld, cb_outgoing_conn ** cc,s
                                         		hostname, port, ldap_err2string(rc));
 						}
 						if ( errmsg ) {
-	                                                *errmsg = slapi_ch_malloc(CB_BUFSIZE);
-							sprintf(*errmsg,error2, ldap_err2string(rc));
+							*errmsg = PR_smprintf(error2, ldap_err2string(rc));
 						}
 						goto unlock_and_return;
 					}
diff --git a/ldap/servers/plugins/chainingdb/cb_delete.c b/ldap/servers/plugins/chainingdb/cb_delete.c
index fe0e72a4..1ddf1ac4 100644
--- a/ldap/servers/plugins/chainingdb/cb_delete.c
+++ b/ldap/servers/plugins/chainingdb/cb_delete.c
@@ -71,7 +71,9 @@ chaining_back_delete ( Slapi_PBlock *pb )
 
 	if ((rc = cb_get_connection(cb->pool,&ld,&cnx,NULL,&cnxerrbuf)) != LDAP_SUCCESS) {
                 cb_send_ldap_result( pb, LDAP_OPERATIONS_ERROR, NULL, cnxerrbuf, 0, NULL);
-		slapi_ch_free((void **)&cnxerrbuf);
+				if (cnxerrbuf) {
+					PR_smprintf_free(cnxerrbuf);
+				}
                 /* ping the farm. If the farm is unreachable, we increment the counter */
                 cb_ping_farm(cb,NULL,0);
                 return -1;
diff --git a/ldap/servers/plugins/chainingdb/cb_init.c b/ldap/servers/plugins/chainingdb/cb_init.c
index 3b0c20ea..8ceb61ac 100644
--- a/ldap/servers/plugins/chainingdb/cb_init.c
+++ b/ldap/servers/plugins/chainingdb/cb_init.c
@@ -46,11 +46,9 @@ chaining_back_init( Slapi_PBlock *pb )
 	/* Initialize misc. fields */
 	cb->config.rwl_config_lock = PR_NewRWLock(PR_RWLOCK_RANK_NONE, "chaining_db");
         rc = slapi_pblock_set( pb, SLAPI_PLUGIN_PRIVATE, (void *) cb );
-	cb->pluginDN=slapi_ch_calloc( 1,strlen(PLUGIN_BASE_DN)+strlen(CB_PLUGIN_NAME)+5);
-	sprintf(cb->pluginDN,"cn=%s,%s",CB_PLUGIN_NAME,PLUGIN_BASE_DN);
+	cb->pluginDN=slapi_ch_smprintf("cn=%s,%s",CB_PLUGIN_NAME,PLUGIN_BASE_DN);
 
-	cb->configDN=slapi_ch_calloc( 1,strlen(cb->pluginDN)+11);
-        sprintf(cb->configDN,"cn=config,%s",cb->pluginDN);
+	cb->configDN=slapi_ch_smprintf("cn=config,%s",cb->pluginDN);
 
 	/* Set backend callback functions */
 	rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_VERSION, SLAPI_PLUGIN_VERSION_03 );
diff --git a/ldap/servers/plugins/chainingdb/cb_instance.c b/ldap/servers/plugins/chainingdb/cb_instance.c
index 2b6f6368..f835d877 100644
--- a/ldap/servers/plugins/chainingdb/cb_instance.c
+++ b/ldap/servers/plugins/chainingdb/cb_instance.c
@@ -4,6 +4,7 @@
  * All rights reserved.
  * END COPYRIGHT BLOCK **/
 #include "cb.h"
+#include "plstr.h"
 
 /*
 ** 1 set/get function for each parameter of a backend instance
@@ -124,7 +125,7 @@ static char *cb_skeleton_entries[] =
 static void cb_instance_config_set_default(cb_backend_instance *inst)
 {
         cb_instance_config_info *config;
-        char err_buf[CB_BUFSIZE];
+        char err_buf[SLAPI_DSE_RETURNTEXT_SIZE];
 
         for (config = cb_the_instance_config; config->config_name != NULL; config++) {
                 cb_instance_config_set((void *)inst, 
@@ -188,8 +189,7 @@ static cb_backend_instance * cb_instance_alloc(cb_backend * cb, char * name, cha
 	/* Config is now merged with the backend entry */
 	inst->configDn=slapi_ch_strdup(basedn);
 
-	inst->monitorDn=(char *) slapi_ch_calloc(1,strlen(basedn)+15);
-	sprintf(inst->monitorDn,"cn=monitor,%s",basedn); 
+	inst->monitorDn=slapi_ch_smprintf("cn=monitor,%s",basedn); 
 
 	inst->eq_ctx = NULL;
 
@@ -260,7 +260,7 @@ int cb_instance_modify_config_check_callback(Slapi_PBlock *pb, Slapi_Entry* entr
 
 		/* specific processing for multi-valued attributes */
 		if ( !strcasecmp ( attr_name, CB_CONFIG_SUFFIX )) {
-                        sprintf(returntext, "suffix modification not allowed\n");
+                        PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE, "suffix modification not allowed\n");
                         rc = LDAP_UNWILLING_TO_PERFORM;
 			continue;
 		} else
@@ -293,7 +293,7 @@ int cb_instance_modify_config_check_callback(Slapi_PBlock *pb, Slapi_Entry* entr
                 if ((mods[i]->mod_op & LDAP_MOD_DELETE) ||
                         ((mods[i]->mod_op & ~LDAP_MOD_BVALUES) == LDAP_MOD_ADD)) {
                         rc= LDAP_UNWILLING_TO_PERFORM;
-                        sprintf(returntext, "%s attributes is not allowed",
+                        PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE, "%s attributes is not allowed",
                                 (mods[i]->mod_op & LDAP_MOD_DELETE) ? "Deleting" : "Adding");
                 } else if (mods[i]->mod_op & LDAP_MOD_REPLACE) {
                         /* This assumes there is only one bval for this mod. */
@@ -428,7 +428,7 @@ int cb_instance_modify_config_callback(Slapi_PBlock *pb, Slapi_Entry* entryBefor
 			}
 			
                         rc= LDAP_UNWILLING_TO_PERFORM;
-                        sprintf(returntext, "%s attributes is not allowed",
+                        PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE, "%s attributes is not allowed",
                               (mods[i]->mod_op & LDAP_MOD_DELETE) ? "Deleting" : "Adding");
                 } else if (mods[i]->mod_op & LDAP_MOD_REPLACE) {
                         /* This assumes there is only one bval for this mod. */
@@ -467,7 +467,6 @@ cb_parse_instance_config_entry(cb_backend * cb, Slapi_Entry * e) {
     	const struct berval 	*attrValue;
 	cb_backend_instance 	*inst=NULL;
 	char			*instname;
-	Slapi_PBlock 		*search_pb=NULL;
 	char 			retmsg[CB_BUFSIZE];
 
 	CB_ASSERT(e!=NULL);
@@ -512,7 +511,7 @@ cb_instance_config_initialize(cb_backend_instance * inst, Slapi_Entry * e , int
         Slapi_Value             *sval;
 	struct berval * 	 bval;
 	int 			using_def_connlifetime,i;
-        char 			err_buf[CB_BUFSIZE];
+        char 			err_buf[SLAPI_DSE_RETURNTEXT_SIZE];
 	int 			urlfound=0;
 	char 			*rootdn;
 
@@ -672,7 +671,7 @@ static int cb_instance_hosturl_set(void *arg, void *value, char *errorbuf, int p
 	int 			rc=LDAP_SUCCESS;
 
  	if (( rc = ldap_url_parse( url, &ludp )) != 0 ) {
-		strcpy(errorbuf,cb_urlparse_err2string( rc ));
+		PL_strncpyz(errorbuf,cb_urlparse_err2string( rc ), SLAPI_DSE_RETURNTEXT_SIZE);
 		if (CB_CONFIG_PHASE_INITIALIZATION == phase)
 			inst->pool->url=slapi_ch_strdup("");
 		return(LDAP_INVALID_SYNTAX);
@@ -727,22 +726,23 @@ static int cb_instance_hosturl_set(void *arg, void *value, char *errorbuf, int p
 
 		{ char * aBufCopy, * aHostName;
 			char * iter = NULL;
-			aBufCopy= aBufCopy=slapi_ch_strdup(inst->pool->hostname);
+			aBufCopy=slapi_ch_strdup(inst->pool->hostname);
 
 			aHostName=ldap_utf8strtok_r(aBufCopy," ", &iter);
 			charray_free(inst->url_array);
 			inst->url_array=NULL;
 			while (aHostName) {
 			
-				char * aHostPort = slapi_ch_calloc(1,strlen(aHostName)+30);
-       	        		if ( NULL == ( ptr=strstr(aHostName,":")))
-       	                		sprintf(aHostPort,"%s://%s:%d/",
-						inst->pool->secure ? "ldaps" : "ldap", 
-						aHostName,inst->pool->port);
-				else
-       	                		sprintf(aHostPort,"%s://%s/", 
-						inst->pool->secure ? "ldaps" : "ldap",
-						aHostName);
+				char * aHostPort;
+				if ( NULL == ( ptr=strstr(aHostName,":"))) {
+					aHostPort = slapi_ch_smprintf("%s://%s:%d/",
+												  inst->pool->secure ? "ldaps" : "ldap", 
+												  aHostName,inst->pool->port);
+				} else {
+					aHostPort = slapi_ch_smprintf("%s://%s/", 
+												  inst->pool->secure ? "ldaps" : "ldap",
+												  aHostName);
+				}
 
 				charray_add(&inst->url_array,aHostPort);
 				aHostName=ldap_utf8strtok_r(NULL," ", &iter);
@@ -818,7 +818,7 @@ static int cb_instance_binduser_set(void *arg, void *value, char *errorbuf, int
                         !strcmp(theValueCopy,rootdn)) {	/* UTF8-aware. See cb_get_dn() */
                         rc=LDAP_UNWILLING_TO_PERFORM; 
 			if (errorbuf) {
-				sprintf(errorbuf,"value %s not allowed",rootdn);
+				PR_snprintf(errorbuf,SLAPI_DSE_RETURNTEXT_SIZE, "value %s not allowed",rootdn);
 			}
                 }
                 PR_RWLock_Unlock(inst->rwl_config_lock);
@@ -1129,7 +1129,7 @@ static int cb_instance_imperson_set(void *arg, void *value, char *errorbuf, int
 	                !strcmp(inst->pool->binddn,rootdn)) {	/* UTF-8 aware */
 		  	rc=LDAP_UNWILLING_TO_PERFORM;
 			if (errorbuf)
-				sprintf(errorbuf,"Proxy mode incompatible with %s value (%s not allowed)",
+				PR_snprintf(errorbuf,SLAPI_DSE_RETURNTEXT_SIZE, "Proxy mode incompatible with %s value (%s not allowed)",
 					CB_CONFIG_BINDUSER,rootdn);
 		}
                 PR_RWLock_Unlock(inst->rwl_config_lock); 
@@ -1309,8 +1309,8 @@ static cb_instance_config_info *cb_get_config_info(cb_instance_config_info *conf
 ** For now, unknown attributes are ignored
 ** Return a LDAP error code OR CB_REOPEN_CONN when the
 ** update requires to close open connections.
+** err_buf is size SLAPI_DSE_RETURNTEXT_SIZE
 */
-
 static int 
 cb_instance_config_set(void *arg, char *attr_name, cb_instance_config_info *config_array, 
 struct berval *bval, char *err_buf, int phase, int apply_mod)
@@ -1386,6 +1386,7 @@ struct berval *bval, char *err_buf, int phase, int apply_mod)
 /* Utility function used in creating config entries.  Using the
  * config_info, this function gets info and formats in the correct
  * way.
+ * buf is CB_BUFSIZE size
  */
 void cb_instance_config_get(void *arg, cb_instance_config_info *config, char *buf)
 {
@@ -1409,7 +1410,7 @@ void cb_instance_config_get(void *arg, cb_instance_config_info *config, char *bu
                 /* Remember the get function for strings returns memory
                  * that must be freed. */
                 tmp_string = (char *) config->config_get_fn(arg);
-                sprintf(buf, "%s", (char *) tmp_string);
+                PR_snprintf(buf, CB_BUFSIZE, "%s", (char *) tmp_string);
                 slapi_ch_free((void **)&tmp_string);
                 break;
         case CB_CONFIG_TYPE_ONOFF:
@@ -1759,7 +1760,7 @@ int cb_create_default_backend_instance_config(cb_backend * cb) {
 	int 			rc;
 	cb_backend_instance 	*dummy;
 	Slapi_Entry 		*e=slapi_entry_alloc();
-        char            	defaultDn[CB_BUFSIZE];
+	char            	*defaultDn;
 	char 			*olddn;
         struct berval           val;
         struct berval           *vals[2];
@@ -1772,7 +1773,7 @@ int cb_create_default_backend_instance_config(cb_backend * cb) {
 
 	/* set right dn	 and objectclass */
 
-        sprintf(defaultDn,"cn=default instance config,%s",cb->pluginDN);
+	defaultDn = PR_smprintf("cn=default instance config,%s",cb->pluginDN);
 	olddn = slapi_entry_get_dn(e);
 	slapi_ch_free((void **) &olddn);
 	
@@ -1805,6 +1806,7 @@ int cb_create_default_backend_instance_config(cb_backend * cb) {
 	/* cleanup */
         cb_instance_free(dummy);
 	/* BEWARE: entry is consummed */
+		PR_smprintf_free(defaultDn);
 	return rc;
 }
 
@@ -1817,7 +1819,7 @@ int cb_build_backend_instance_config(cb_backend_instance *inst, Slapi_Entry * co
 	Slapi_Entry     **default_entries = NULL;
 	Slapi_Entry 	*default_conf=NULL;
 	int 		default_res, rc;
-	char 		defaultDn[CB_BUFSIZE];
+	char 		*defaultDn;
 	cb_backend_instance * current_inst;
 
 	rc=LDAP_SUCCESS;
@@ -1832,12 +1834,13 @@ int cb_build_backend_instance_config(cb_backend_instance *inst, Slapi_Entry * co
 
         /* 2: Overwrite values present in the default instance config */
  
-        sprintf(defaultDn,"cn=default instance config,%s",cb->pluginDN);
+        defaultDn = PR_smprintf("cn=default instance config,%s",cb->pluginDN);
  
         default_pb = slapi_pblock_new();
         slapi_search_internal_set_pb(default_pb, defaultDn, LDAP_SCOPE_BASE,
                 "objectclass=*", NULL, 0, NULL, NULL, cb->identity, 0);
         slapi_search_internal_pb (default_pb);
+		PR_smprintf_free(defaultDn);
         slapi_pblock_get(default_pb, SLAPI_PLUGIN_INTOP_RESULT, &default_res);
         if ( LDAP_SUCCESS == default_res ) {
                 slapi_pblock_get(default_pb, SLAPI_PLUGIN_INTOP_SEARCH_ENTRIES, &default_entries);
diff --git a/ldap/servers/plugins/chainingdb/cb_modify.c b/ldap/servers/plugins/chainingdb/cb_modify.c
index 91b3b9ae..6b586592 100644
--- a/ldap/servers/plugins/chainingdb/cb_modify.c
+++ b/ldap/servers/plugins/chainingdb/cb_modify.c
@@ -79,7 +79,9 @@ chaining_back_modify ( Slapi_PBlock *pb )
 	/* Grab a connection handle */
 	if ((rc = cb_get_connection(cb->pool,&ld,&cnx,NULL,&cnxerrbuf)) != LDAP_SUCCESS) {
                 cb_send_ldap_result( pb, LDAP_OPERATIONS_ERROR, NULL, cnxerrbuf, 0, NULL);
-		slapi_ch_free((void **)&cnxerrbuf);
+				if (cnxerrbuf) {
+					PR_smprintf_free(cnxerrbuf);
+				}
                 /* ping the farm. If the farm is unreachable, we increment the counter */
                 cb_ping_farm(cb,NULL,0);
                 return -1;
diff --git a/ldap/servers/plugins/chainingdb/cb_modrdn.c b/ldap/servers/plugins/chainingdb/cb_modrdn.c
index 8e1b0747..67b66179 100644
--- a/ldap/servers/plugins/chainingdb/cb_modrdn.c
+++ b/ldap/servers/plugins/chainingdb/cb_modrdn.c
@@ -105,7 +105,9 @@ chaining_back_modrdn ( Slapi_PBlock *pb )
 
 	if ((rc = cb_get_connection(cb->pool,&ld,&cnx,NULL,&cnxerrbuf)) != LDAP_SUCCESS) {
                 cb_send_ldap_result( pb, LDAP_OPERATIONS_ERROR, NULL, cnxerrbuf, 0, NULL);
-		slapi_ch_free((void **)&cnxerrbuf);
+				if (cnxerrbuf) {
+					PR_smprintf_free(cnxerrbuf);
+				}
                 /* ping the farm. If the farm is unreachable, we increment the counter */
                 cb_ping_farm(cb,NULL,0);
                 return -1;
diff --git a/ldap/servers/plugins/chainingdb/cb_search.c b/ldap/servers/plugins/chainingdb/cb_search.c
index dcb80798..48f64a31 100644
--- a/ldap/servers/plugins/chainingdb/cb_search.c
+++ b/ldap/servers/plugins/chainingdb/cb_search.c
@@ -113,8 +113,7 @@ chainingdb_build_candidate_list ( Slapi_PBlock *pb )
 
         	PR_RWLock_Rlock(cb->rwl_config_lock);
 		for (i=0; cb->url_array && cb->url_array[i]; i++) {
-			char * anUrl= slapi_ch_calloc(1,strlen(cb->url_array[i])+strlen(target)+1);
-			sprintf(anUrl,"%s%s",cb->url_array[i],target);
+			char * anUrl = slapi_ch_smprintf("%s%s",cb->url_array[i],target);
                 	bv.bv_val=anUrl;
 			bv.bv_len=strlen(bv.bv_val);
                 	slapi_entry_attr_merge( anEntry, "ref", bvals);
@@ -185,7 +184,9 @@ chainingdb_build_candidate_list ( Slapi_PBlock *pb )
 		else
 			cb_send_ldap_result( pb, LDAP_OPERATIONS_ERROR, NULL,cnxerrbuf, 0, NULL);
 
-		slapi_ch_free((void **)&cnxerrbuf);
+		if (cnxerrbuf) {
+			PR_smprintf_free(cnxerrbuf);
+		}
                 /* ping the farm. If the farm is unreachable, we increment the counter */
                 cb_ping_farm(cb,NULL,0);
 		return 1;
diff --git a/ldap/servers/plugins/chainingdb/cb_test.c b/ldap/servers/plugins/chainingdb/cb_test.c
index 7f561a80..8ad3510d 100644
--- a/ldap/servers/plugins/chainingdb/cb_test.c
+++ b/ldap/servers/plugins/chainingdb/cb_test.c
@@ -37,8 +37,7 @@ int cb_back_test( Slapi_PBlock *pb )
         aSuffixString=slapi_sdn_get_dn(aSuffix);
         /* Remove leading white spaces */
         for (aSuffixString; *aSuffixString==' ';aSuffixString++) {}
-	theTarget=slapi_ch_calloc(1,strlen(aSuffixString)+20);
-	sprintf(theTarget,"cn=test,%s",aSuffixString);
+	theTarget=slapi_ch_smprintf("cn=test,%s",aSuffixString);
 
 	/* XXXSD make sure chaining allowed for this plugin... */
         slapi_search_internal_set_pb (apb, theTarget, LDAP_SCOPE_BASE, "objectclass=*", NULL, 0, NULL, NULL,
diff --git a/ldap/servers/plugins/collation/collate.c b/ldap/servers/plugins/collation/collate.c
index 90dad328..c5dfdf89 100644
--- a/ldap/servers/plugins/collation/collate.c
+++ b/ldap/servers/plugins/collation/collate.c
@@ -102,31 +102,34 @@ collation_config (size_t cargc, char** cargv,
                 }
  
                 if(cargc > 7) {
-                    strcat(nameOrder,"-");
-                    strcat(nameOrder,cargv[7]);
-                    strcat(nameSubstring,"-");
-                    strcat(nameSubstring,cargv[7]);
+                    strcpy(nameOrder,"-");
+                    PL_strcatn(nameOrder,256,cargv[7]);
+                    strcpy(nameSubstring,"-");
+                    PL_strcatn(nameSubstring,256,cargv[7]);
                     slapi_matchingrule_set(mrentry,SLAPI_MATCHINGRULE_NAME,
                                            (void *)slapi_ch_strdup(nameOrder));
                 }
                 else {
                     if(0 != cargv[1][0]) {
-                        strcat(nameOrder,"-");
-                        strcat(nameSubstring,"-");
-                    }
-                    strcat(nameOrder,cargv[1]);
-                    strcat(nameSubstring,cargv[1]);
+                        strcpy(nameOrder,"-");
+                        strcpy(nameSubstring,"-");
+                    } else {
+						nameOrder[0] = 0;
+						nameSubstring[0] = 0;
+					}
+                    PL_strcatn(nameOrder,256,cargv[1]);
+                    PL_strcatn(nameSubstring,256,cargv[1]);
                     slapi_matchingrule_set(mrentry,SLAPI_MATCHINGRULE_NAME,
                                            (void *)slapi_ch_strdup(nameOrder));
                 }
-                strcpy(oidString,cargv[6]);
+                PL_strncpyz(oidString,cargv[6], 256);
                 slapi_matchingrule_set(mrentry,SLAPI_MATCHINGRULE_OID,
                                        (void *)slapi_ch_strdup(oidString));
                 if(0 != cargv[2][0]) {
-                    sprintf(descStr,"%s-%s",cargv[1],cargv[2]);
+                    PR_snprintf(descStr, 256, "%s-%s",cargv[1],cargv[2]);
                 }
                 else {
-                    strcpy(descStr,cargv[1]);
+                    PL_strncpyz(descStr,cargv[1], 256);
                 }
                 slapi_matchingrule_set(mrentry,SLAPI_MATCHINGRULE_DESC,
 						   (void *)slapi_ch_strdup(descStr));
@@ -191,7 +194,6 @@ SetUnicodeStringFromUTF_8 (UChar** U, int32_t* Ulen, int *isAlloced, const struc
 {
     size_t n;
     int32_t len = 0; /* length of non-space string */
-    int32_t needLen = 0; /* number of bytes needed for string */
     UErrorCode err = U_ZERO_ERROR;
     const char* s = bv->bv_val;
     const char* begin = NULL; /* will point to beginning of non-space in val */
diff --git a/ldap/servers/plugins/cos/Makefile b/ldap/servers/plugins/cos/Makefile
index 8d437b66..d53ef420 100644
--- a/ldap/servers/plugins/cos/Makefile
+++ b/ldap/servers/plugins/cos/Makefile
@@ -74,6 +74,3 @@ endif
 
 $(OBJDEST):
 	$(MKDIR) $(OBJDEST)
-
-$(LIBDIR):
-	$(MKDIR) $(LIBDIR)
diff --git a/ldap/servers/plugins/cos/cos_cache.c b/ldap/servers/plugins/cos/cos_cache.c
index e88156d3..303458e5 100644
--- a/ldap/servers/plugins/cos/cos_cache.c
+++ b/ldap/servers/plugins/cos/cos_cache.c
@@ -143,7 +143,7 @@ extern "C" {
 /* the global plugin handle */
 static volatile vattr_sp_handle *vattr_handle = NULL;
 
-static cos_cache_notify_flag = 0;
+static int cos_cache_notify_flag = 0;
 
 /* service definition cache structs */
 
@@ -1985,13 +1985,10 @@ static int cos_cache_add_tmpl(cosTemplates **pTemplates, cosAttrValue *dn, cosAt
 					 * only 2 lines of code -> no need to set an indirect char *
 					 * duplicate the lines of code for clearness instead
 					 */
-					char * newTmpGrade = (char*) slapi_ch_malloc(
-						strlen((pCosSpecifier->val) + 9));
-					strcpy(newTmpGrade, pCosSpecifier->val);
-					strcat(newTmpGrade, "-default");
+					char * newTmpGrade = PR_smprintf("%s-default", pCosSpecifier->val);
 					if(!slapi_utf8casecmp((unsigned char*)grade, (unsigned char*)newTmpGrade))
 						template_default = 1;
-					slapi_ch_free((void**)&newTmpGrade);
+					PR_smprintf_free(newTmpGrade);
 				}
 			}
 
@@ -2204,7 +2201,6 @@ static int cos_cache_query_attr(cos_cache *ptheCache, vattr_context *context, Sl
 	int attr_matched_index = 0; /* for identifying the matched attribute */
 	int hit = 0;
 	cosAttributes *pDefAttr = 0;
-	Slapi_ValueSet* results = 0;
 	Slapi_Value *val;
 /*	int type_name_disposition;
 	char *actual_type_name; 
@@ -2354,7 +2350,6 @@ static int cos_cache_query_attr(cos_cache *ptheCache, vattr_context *context, Sl
 				/* Does this entry have a correct cosSpecifier? */
 				do
 				{
-					Slapi_ValueSet *results = 0;
 					int type_name_disposition = 0;
 					char *actual_type_name = 0;
 					int free_flags = 0;
@@ -3158,7 +3153,7 @@ static int cos_cache_cos_2_slapi_valueset(cosAttributes *pAttr, Slapi_ValueSet *
 	cosAttrValue *pAttrVal = pAttr->pAttrValue;
 	int add_mode = 0;
 	static Slapi_Attr *attr = 0; /* allocated once, never freed */
-	static done_once = 0;
+	static int done_once = 0;
 
 	LDAPDebug( LDAP_DEBUG_TRACE, "--> cos_cache_cos_2_slapi_attr\n",0,0,0);
 	
@@ -3240,8 +3235,6 @@ bail:
 void cos_cache_change_notify(Slapi_PBlock *pb)
 {
 	char *dn;
-	Slapi_Attr *pObjclasses = 0;
-	int index = 0;
 	int do_update = 0;
 	struct slapi_entry *e;
         Slapi_Backend *be=NULL;
@@ -3417,7 +3410,6 @@ static int cos_cache_follow_pointer( vattr_context *c, const char *dn, char *typ
 	Slapi_PBlock *pDnSearch = 0;
 	Slapi_Entry **pEntryList = 0;
 	char *attrs[2];
-	int entryIndex = 0;
 	int op = 0;
 	int type_test = 0;
 	int type_name_disposition = 0;
diff --git a/ldap/servers/plugins/http/Makefile b/ldap/servers/plugins/http/Makefile
index 7ddbb543..ba10ab35 100644
--- a/ldap/servers/plugins/http/Makefile
+++ b/ldap/servers/plugins/http/Makefile
@@ -75,6 +75,3 @@ endif
 
 $(OBJDEST):
 	$(MKDIR) $(OBJDEST)
-
-$(LIBDIR):
-	$(MKDIR) $(LIBDIR)
diff --git a/ldap/servers/plugins/http/http_client.c b/ldap/servers/plugins/http/http_client.c
index 2fbbdd52..3ed24f9b 100644
--- a/ldap/servers/plugins/http/http_client.c
+++ b/ldap/servers/plugins/http/http_client.c
@@ -133,7 +133,6 @@ int http_client_version()
 int http_client_init(Slapi_PBlock *pb)
 {
 	int status = HTTP_SUCCESS;
-	PRUint32 nssFlags = 0;
 	LDAPDebug( LDAP_DEBUG_PLUGIN, "--> http_client_init -- BEGIN\n",0,0,0);
 
 	if ( slapi_pblock_set( pb, SLAPI_PLUGIN_VERSION,
diff --git a/ldap/servers/plugins/http/http_impl.c b/ldap/servers/plugins/http/http_impl.c
index bad8315c..e6d4a664 100644
--- a/ldap/servers/plugins/http/http_impl.c
+++ b/ldap/servers/plugins/http/http_impl.c
@@ -300,10 +300,10 @@ static int doRequest(const char *url, httpheader **httpheaderArray, char *body,
 					if (!defaultprefix) /* still could not find it . . . */
     						goto bail; /* . . . can't do anything */
 					defaultprefix++;
-					sprintf(certPref, "%s-",defaultprefix);
+					PR_snprintf(certPref, 1024, "%s-",defaultprefix);
 					strcpy(keyPref, certPref);
 					*defaultprefix= '\0';
-					sprintf(certDir, "%salias", certDir);
+					PR_snprintf(certDir, 1024, "%salias", certDir);
        				nssStatus = NSS_Initialize(certDir, certPref, keyPref, "secmod.db", nssFlags);
 					slapi_ch_free((void **)&val);
 		
@@ -610,12 +610,10 @@ static int nssReinitializationRequired()
 {
 	int nssReinitializationRequired = 0;
 	int err = 0;
-	int str_len = 0;
 	float version = 0;
 	const float DSVERSION = 6.1;
 	char *str = NULL;
 	char *value   = NULL;
-	char *ver_value   = NULL;
 	Slapi_Entry  **entry = NULL;
 	Slapi_PBlock *resultpb= NULL;
 
@@ -679,7 +677,6 @@ static PRStatus sendGetReq(PRFileDesc *fd, const char *path)
 	http_connection_time_out = httpConfig->connectionTimeOut;
 	status = sendFullData( fd, reqBUF, http_connection_time_out);
 
-bail:
 	if (reqBUF) {
 		PR_Free(reqBUF);
 		reqBUF = 0;
@@ -773,7 +770,6 @@ static PRStatus sendPostReq(PRFileDesc *fd, const char *path, httpheader **httph
 
 	status = sendFullData( fd, reqBUF, http_connection_time_out);
 
-bail:
     if (reqBUF) {
             PR_Free(reqBUF);
             reqBUF = 0;
@@ -1360,7 +1356,6 @@ int http_impl_post(char *url, httpheader **httpheaderArray, char *body, char **d
 
 void http_impl_shutdown()
 {
-	int status = HTTP_IMPL_SUCCESS;
 	/**
 	 * Put cleanup code here
 	 */
diff --git a/ldap/servers/plugins/pam_passthru/pam_ptconfig.c b/ldap/servers/plugins/pam_passthru/pam_ptconfig.c
index 50aafef8..21879c36 100644
--- a/ldap/servers/plugins/pam_passthru/pam_ptconfig.c
+++ b/ldap/servers/plugins/pam_passthru/pam_ptconfig.c
@@ -12,9 +12,6 @@
 #include "pam_passthru.h"
 
 #define PAM_PT_CONFIG_FILTER "(objectclass=*)"
-#ifndef SLAPI_DSE_RETURNTEXT_SIZE
-#define SLAPI_DSE_RETURNTEXT_SIZE 512	/* for use by callback functions */
-#endif /* SLAPI_DSE_RETURNTEXT_SIZE */
 
 /*
  * The configuration attributes are contained in the plugin entry e.g.
diff --git a/ldap/servers/plugins/pam_passthru/pam_ptimpl.c b/ldap/servers/plugins/pam_passthru/pam_ptimpl.c
index c6b35a48..8711513f 100644
--- a/ldap/servers/plugins/pam_passthru/pam_ptimpl.c
+++ b/ldap/servers/plugins/pam_passthru/pam_ptimpl.c
@@ -24,6 +24,7 @@ init_my_str_buf(MyStrBuf *buf, const char *s)
 		buf->str = buf->fixbuf;
 	} else {
 		buf->str = slapi_ch_strdup(s);
+		buf->fixbuf[0] = 0;
 	}
 
 	return buf->str;
diff --git a/ldap/servers/plugins/passthru/ptconfig.c b/ldap/servers/plugins/passthru/ptconfig.c
index 74a5ed4b..843f1da5 100644
--- a/ldap/servers/plugins/passthru/ptconfig.c
+++ b/ldap/servers/plugins/passthru/ptconfig.c
@@ -45,8 +45,6 @@
 /*
  * function prototypes
  */ 
-static char **get_backend_suffixes( void );
-static int is_underneath_backend_suffix( char *normdn, char **besuffixes );
 
 /*
  * static variables
diff --git a/ldap/servers/plugins/pwdstorage/crypt_pwd.c b/ldap/servers/plugins/pwdstorage/crypt_pwd.c
index 4c0f1221..28aab7a4 100644
--- a/ldap/servers/plugins/pwdstorage/crypt_pwd.c
+++ b/ldap/servers/plugins/pwdstorage/crypt_pwd.c
@@ -79,11 +79,7 @@ crypt_pw_enc( char *pwd )
     cry = crypt( pwd, salt );
     if ( cry != NULL )
     {
-        enc = slapi_ch_malloc( 3 + CRYPT_NAME_LEN + strlen( cry ));
-        if ( enc != NULL )
-        {
-            sprintf( enc, "%c%s%c%s", PWD_HASH_PREFIX_START, CRYPT_SCHEME_NAME, PWD_HASH_PREFIX_END, cry );
-        }
+        enc = slapi_ch_smprintf("%c%s%c%s", PWD_HASH_PREFIX_START, CRYPT_SCHEME_NAME, PWD_HASH_PREFIX_END, cry );
     }    
     PR_Unlock(cryptlock);
     return( enc );
diff --git a/ldap/servers/plugins/pwdstorage/ssha_pwd.c b/ldap/servers/plugins/pwdstorage/ssha_pwd.c
index 194ee817..a65bd797 100644
--- a/ldap/servers/plugins/pwdstorage/ssha_pwd.c
+++ b/ldap/servers/plugins/pwdstorage/ssha_pwd.c
@@ -97,7 +97,7 @@ salted_sha1_pw_enc( char *pwd )
         return( NULL );
     }
 
-    if (( enc = PR_Malloc( 3 + SALTED_SHA1_NAME_LEN +
+    if (( enc = slapi_ch_malloc( 3 + SALTED_SHA1_NAME_LEN +
         LDIF_BASE64_LEN(sizeof(hash)))) == NULL ) {
         return( NULL );
     }
diff --git a/ldap/servers/plugins/referint/referint.c b/ldap/servers/plugins/referint/referint.c
index 5bd11214..6fac705e 100644
--- a/ldap/servers/plugins/referint/referint.c
+++ b/ldap/servers/plugins/referint/referint.c
@@ -295,7 +295,6 @@ int update_integrity(char **argv, char *origDN, char *newrDN, int logChanges){
   int dnsize;
   int x;
   int rc;
-  int valcount = 0;
  
   if ( argv == NULL ) { 
       slapi_log_error( SLAPI_LOG_FATAL, REFERINT_PLUGIN_SUBSYSTEM,
@@ -783,9 +782,9 @@ void writeintegritylog(char *logfilename, char *dn, char *newrdn){
                          " to update references to this entry.\n");
     }else{
        PRInt32 rv;
-       sprintf(buffer, "%s\t%s\t\n", 
-                dn,
-                (newrdn != NULL) ? newrdn : "NULL");
+       PR_snprintf(buffer, MAX_LINE, "%s\t%s\t\n", 
+				   dn,
+				   (newrdn != NULL) ? newrdn : "NULL");
         if ((rv = PR_Write(prfd,buffer,strlen(buffer))) < 0){
            slapi_log_error(SLAPI_LOG_FATAL,REFERINT_PLUGIN_SUBSYSTEM,
 	       " writeintegritylog: PR_Write failed : The disk"
diff --git a/ldap/servers/plugins/replication/cl4_api.c b/ldap/servers/plugins/replication/cl4_api.c
index f60eb91e..83f479f5 100644
--- a/ldap/servers/plugins/replication/cl4_api.c
+++ b/ldap/servers/plugins/replication/cl4_api.c
@@ -401,10 +401,7 @@ static char* _cl4MakeCSNDN (const CSN* csn)
 		return NULL;
 
 	/* Construct the dn of this change record */
-    pat = "%s=%s,%s";
-    edn = slapi_ch_malloc(strlen(pat) + strlen(attr_csn) + strlen(suffix) + CSN_STRSIZE + 1);
-	if (edn)
-		sprintf(edn, pat, attr_csn, csn_as_string(csn,PR_FALSE,s), suffix);
+    edn = slapi_ch_smprintf("%s=%s,%s", attr_csn, csn_as_string(csn,PR_FALSE,s), suffix);
 	slapi_ch_free ((void **)&suffix);
 
 	return edn;
@@ -561,7 +558,7 @@ static int _cl4GetTargetEntry (Slapi_DN *sdn, const char *uniqueid, Slapi_Entry
 	Slapi_Entry **entries = NULL;
 
 	/* read corresponding database entry based on its uniqueid */
-	sprintf (filter, "uniqueid=%s", uniqueid);	
+	PR_snprintf (filter, sizeof(filter), "uniqueid=%s", uniqueid);	
 	pb = slapi_pblock_new ();
 	slapi_search_internal_set_pb (pb, (char*)slapi_sdn_get_ndn(sdn), LDAP_SCOPE_SUBTREE, filter, NULL, 0, NULL, NULL,
 								  repl_get_plugin_identity (PLUGIN_LEGACY_REPLICATION), 0);
@@ -633,7 +630,7 @@ static int _cl4FindTargetDN (const CSN *csn, const char *uniqueid,
 	/* Look for all modifications to the target entry with csn larger than 
 	   this csn. We are only interested in rename operations, but change type
        is currently not indexed */
-	sprintf (filter, "&(uniqueid=%s)(csn>%s)", uniqueid, csn_as_string(csn,PR_FALSE,s));
+	PR_snprintf (filter, 128, "&(uniqueid=%s)(csn>%s)", uniqueid, csn_as_string(csn,PR_FALSE,s));
 	pb = slapi_pblock_new ();
 	slapi_search_internal_set_pb (pb, suffix, LDAP_SCOPE_SUBTREE, filter, NULL, 0, NULL, NULL,
 								  repl_get_plugin_identity (PLUGIN_LEGACY_REPLICATION), 0);
diff --git a/ldap/servers/plugins/replication/cl5_api.c b/ldap/servers/plugins/replication/cl5_api.c
index e8c01157..024335f5 100644
--- a/ldap/servers/plugins/replication/cl5_api.c
+++ b/ldap/servers/plugins/replication/cl5_api.c
@@ -303,7 +303,6 @@ static int _cl5ReadBervals (struct berval ***bv, char** buff, unsigned int size)
 static int _cl5WriteBervals (struct berval **bv, char** buff, unsigned int *size);
 
 /* replay iteration */
-static PRBool _cl5ValidReplayIterator (const CL5ReplayIterator *iterator);
 static int _cl5PositionCursorForReplay (ReplicaId consumerRID, const RUV *consumerRuv,
 			Object *replica, Object *fileObject, CL5ReplayIterator **iterator);
 static int _cl5CheckMissingCSN (const CSN *minCsn, const RUV *supplierRUV, CL5DBFile *file);
@@ -4734,8 +4733,8 @@ _cl5LDIF2Operation (char *ldifEntry, slapi_operation_parameters *op, char **repl
 		if (rc != 0)
 		{
 			if ( errmsg != NULL ) {
-			        slapi_log_error(SLAPI_LOG_PARSE, repl_plugin_name_cl, "%s", errmsg); 
-				slapi_ch_free( (void**)&errmsg );
+				slapi_log_error(SLAPI_LOG_PARSE, repl_plugin_name_cl, "%s", errmsg); 
+				PR_smprintf_free(errmsg );
 			}
 			slapi_log_error(SLAPI_LOG_REPL, repl_plugin_name_cl, 
 							"_cl5LDIF2Operation: warning - failed to parse ldif line\n");
@@ -5291,17 +5290,6 @@ PRBool cl5HelperEntry (const char *csnstr, CSN *csnp)
 	return retval;
 }
 
-/* Replay iteration helper functions */
-static PRBool _cl5ValidReplayIterator (const CL5ReplayIterator *iterator)
-{
-	if (iterator == NULL || 
-		iterator->consumerRuv == NULL || iterator->supplierRuvObj == NULL || 
-        iterator->fileObj == NULL)
-		return PR_FALSE;
-
-	return PR_TRUE;
-}
-
 /* Algorithm: ONREPL!!!
  */
 struct replica_hash_entry
@@ -5811,10 +5799,7 @@ static char* _cl5Replica2FileName (Object *replica)
 
 static char* _cl5MakeFileName (const char *replName, const char *replGen)
 {
-    char *fileName;
-    fileName = slapi_ch_malloc (strlen (replName) + strlen (replGen) + 
-                                 strlen (DB_EXTENSION) + 3/* '_' + '.' + '\0' */);
-    sprintf (fileName, "%s%s%s.%s", replName, FILE_SEP, replGen, DB_EXTENSION);
+    char *fileName = slapi_ch_smprintf("%s%s%s.%s", replName, FILE_SEP, replGen, DB_EXTENSION);
 
     return fileName;
 }
@@ -6069,8 +6054,7 @@ out:
 
 	if ( semadir != NULL )
 	{
-		(*dbFile)->semaName = slapi_ch_malloc (strlen(semadir) + strlen(replName) + strlen(".sema") + 10);
-		sprintf ((*dbFile)->semaName, "%s/%s.sema", semadir, replName);
+		(*dbFile)->semaName = slapi_ch_smprintf("%s/%s.sema", semadir, replName);
 		slapi_log_error(SLAPI_LOG_REPL, repl_plugin_name_cl,
 			"_cl5NewDBFile: semaphore %s\n", (*dbFile)->semaName);
 		(*dbFile)->sema = PR_OpenSemaphore((*dbFile)->semaName, PR_SEM_CREATE, 0666, s_cl5Desc.dbConfig.maxConcurrentWrites );
diff --git a/ldap/servers/plugins/replication/cl5_clcache.c b/ldap/servers/plugins/replication/cl5_clcache.c
index 17eb8e59..c60b0421 100644
--- a/ldap/servers/plugins/replication/cl5_clcache.c
+++ b/ldap/servers/plugins/replication/cl5_clcache.c
@@ -23,7 +23,7 @@
 #define DEFAULT_CLC_BUFFER_PAGE_COUNT		32
 #define DEFAULT_CLC_BUFFER_PAGE_SIZE		1024
 
-static enum {
+enum {
 	CLC_STATE_READY = 0,		/* ready to iterate */
 	CLC_STATE_UP_TO_DATE,		/* remote RUV already covers the CSN */
 	CLC_STATE_CSN_GT_RUV,		/* local RUV doesn't conver the CSN */
@@ -527,7 +527,6 @@ clcache_adjust_anchorcsn ( CLC_Buffer *buf )
 {
 	PRBool hasChange = PR_FALSE;
 	struct csn_seq_ctrl_block *cscb;
-	int rc = 0;
 	int i;
 
 	if ( buf->buf_state == CLC_STATE_READY ) {
@@ -706,9 +705,7 @@ static CLC_Buffer *
 clcache_new_buffer ( ReplicaId consumer_rid )
 {
 	CLC_Buffer *buf = NULL;
-	int page_count = 0;
 	int welldone = 0;
-	int rc = 0;
 
 	do {
 
diff --git a/ldap/servers/plugins/replication/cl5_config.c b/ldap/servers/plugins/replication/cl5_config.c
index 846f39fe..3d78c35c 100644
--- a/ldap/servers/plugins/replication/cl5_config.c
+++ b/ldap/servers/plugins/replication/cl5_config.c
@@ -15,6 +15,8 @@
 #ifdef TEST_CL5
 #include "cl5_test.h"    
 #endif
+#include "nspr.h"
+#include "plstr.h"
 
 #define CONFIG_BASE		"cn=changelog5,cn=config" /*"cn=changelog,cn=supplier,cn=replication5.0,cn=replication,cn=config"*/
 #define CONFIG_FILTER	"(objectclass=*)"
@@ -158,7 +160,7 @@ changelog5_config_add (Slapi_PBlock *pb, Slapi_Entry* e, Slapi_Entry* entryAfter
 		*returncode = 1;
 		if (returntext)
 		{
-			sprintf (returntext, "NULL changelog directory");
+			PR_snprintf (returntext, SLAPI_DSE_RETURNTEXT_SIZE, "NULL changelog directory");
 		}
 
 		slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl, 
@@ -173,7 +175,7 @@ changelog5_config_add (Slapi_PBlock *pb, Slapi_Entry* e, Slapi_Entry* entryAfter
 		*returncode = 1;
 		if (returntext)
 		{
-			sprintf (returntext, "failed to start changelog; error - %d", rc);
+			PR_snprintf (returntext, SLAPI_DSE_RETURNTEXT_SIZE, "failed to start changelog; error - %d", rc);
 		}
 
 		slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl, 
@@ -188,7 +190,7 @@ changelog5_config_add (Slapi_PBlock *pb, Slapi_Entry* e, Slapi_Entry* entryAfter
 		*returncode = 1;
 		if (returntext)
 		{
-			sprintf  (returntext, "failed to configure changelog trimming; error - %d", rc);
+			PR_snprintf (returntext, SLAPI_DSE_RETURNTEXT_SIZE, "failed to configure changelog trimming; error - %d", rc);
 		}
 		slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl, 
 						"changelog5_config_add: failed to configure changelog trimming\n");
@@ -366,7 +368,8 @@ changelog5_config_modify (Slapi_PBlock *pb, Slapi_Entry* entryBefore, Slapi_Entr
 					*returncode = LDAP_UNWILLING_TO_PERFORM;
 					if (returntext)
 					{
-						sprintf (returntext, "Unwilling to apply %s mods while the server is running", config_attr);
+						PR_snprintf (returntext, SLAPI_DSE_RETURNTEXT_SIZE,
+									 "Unwilling to apply %s mods while the server is running", config_attr);
 					}
 					goto done;
 				}
@@ -415,7 +418,7 @@ changelog5_config_modify (Slapi_PBlock *pb, Slapi_Entry* entryBefore, Slapi_Entr
 				*returncode = 1;
 				if (returntext)
 				{
-					strcpy (returntext, "invalid changelog directory or insufficient access");
+					PL_strncpyz (returntext, "invalid changelog directory or insufficient access", SLAPI_DSE_RETURNTEXT_SIZE);
 				}
 				
 				goto done;
@@ -437,7 +440,7 @@ changelog5_config_modify (Slapi_PBlock *pb, Slapi_Entry* entryBefore, Slapi_Entr
 				*returncode = 1;
 				if (returntext)
 				{
-					sprintf (returntext, "failed to close changelog; error - %d", rc);
+					PR_snprintf (returntext, SLAPI_DSE_RETURNTEXT_SIZE, "failed to close changelog; error - %d", rc);
 				}
 
 				slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl, 
@@ -451,7 +454,7 @@ changelog5_config_modify (Slapi_PBlock *pb, Slapi_Entry* entryBefore, Slapi_Entr
 				*returncode = 1;
 				if (returntext)
 				{
-					sprintf (returntext, "failed to remove changelog; error - %d", rc);
+					PR_snprintf (returntext, SLAPI_DSE_RETURNTEXT_SIZE, "failed to remove changelog; error - %d", rc);
 				}
 
 				slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl, 
@@ -465,7 +468,7 @@ changelog5_config_modify (Slapi_PBlock *pb, Slapi_Entry* entryBefore, Slapi_Entr
 				*returncode = 1;
 				if (returntext)
 				{
-					sprintf (returntext, "failed to restart changelog; error - %d", rc);
+					PR_snprintf (returntext, SLAPI_DSE_RETURNTEXT_SIZE, "failed to restart changelog; error - %d", rc);
 				}
 
 				slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl, 
@@ -490,7 +493,7 @@ changelog5_config_modify (Slapi_PBlock *pb, Slapi_Entry* entryBefore, Slapi_Entr
 			*returncode = 1;
 			if (returntext)
 			{
-				sprintf (returntext, "failed to configure changelog trimming; error - %d", rc);
+				PR_snprintf (returntext, SLAPI_DSE_RETURNTEXT_SIZE, "failed to configure changelog trimming; error - %d", rc);
 			}
 
 			slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl, 
@@ -539,7 +542,7 @@ changelog5_config_delete (Slapi_PBlock *pb, Slapi_Entry* e, Slapi_Entry* entryAf
 		*returncode = 1;
 		if (returntext)
 		{
-			strcpy (returntext, "changelog is not configured");
+			PL_strncpyz(returntext, "changelog is not configured", SLAPI_DSE_RETURNTEXT_SIZE);
 		}
 		
 		slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl, 
@@ -555,7 +558,7 @@ changelog5_config_delete (Slapi_PBlock *pb, Slapi_Entry* e, Slapi_Entry* entryAf
 		*returncode = 1;
 		if (returntext)
 		{
-			strcpy (returntext, "changelog is not configured");
+			PL_strncpyz(returntext, "changelog is not configured", SLAPI_DSE_RETURNTEXT_SIZE);
 		}
 		
 		slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl, 
@@ -571,7 +574,7 @@ changelog5_config_delete (Slapi_PBlock *pb, Slapi_Entry* e, Slapi_Entry* entryAf
 		*returncode = 1;
 		if (returntext)
 		{
-			strcpy (returntext, "internal failure");
+			PL_strncpyz (returntext, "internal failure", SLAPI_DSE_RETURNTEXT_SIZE);
 		}
 		
 		slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl, 
@@ -587,7 +590,7 @@ changelog5_config_delete (Slapi_PBlock *pb, Slapi_Entry* e, Slapi_Entry* entryAf
 		*returncode = 1;
 		if (returntext)
 		{
-			sprintf (returntext, "failed to close changelog; error - %d", rc);
+			PR_snprintf (returntext, SLAPI_DSE_RETURNTEXT_SIZE, "failed to close changelog; error - %d", rc);
 		}
 
 		slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl, 
@@ -601,7 +604,7 @@ changelog5_config_delete (Slapi_PBlock *pb, Slapi_Entry* e, Slapi_Entry* entryAf
 		*returncode = 1;
 		if (returntext)
 		{
-			sprintf (returntext, "failed to remove changelog; error - %d", rc);
+			PR_snprintf (returntext, SLAPI_DSE_RETURNTEXT_SIZE, "failed to remove changelog; error - %d", rc);
 		}
 
 		slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl, 
diff --git a/ldap/servers/plugins/replication/cl5_test.c b/ldap/servers/plugins/replication/cl5_test.c
index e8605fab..cfe3d53f 100644
--- a/ldap/servers/plugins/replication/cl5_test.c
+++ b/ldap/servers/plugins/replication/cl5_test.c
@@ -94,7 +94,7 @@ static void testBackupRestore ()
 	char *dir;
 	int rc = -1;
 	char *baseDir;
-	char bkDir [MAXPATHLEN + 1];
+	char bkDir [MAXPATHLEN];
 
 	slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl, "Starting backup and recovery test ...\n");	
 	
@@ -103,7 +103,7 @@ static void testBackupRestore ()
 	if (dir)
 	{
 		baseDir = getBaseDir (dir);
-		sprintf (bkDir, "%s/clbackup", baseDir);
+		PR_snprintf (bkDir, sizeof(bkDir), "%s/clbackup", baseDir);
 		slapi_ch_free ((void**)&baseDir);
 		rc = cl5Backup (bkDir, NULL);
 
@@ -394,12 +394,12 @@ static void testLDIF ()
 	char *clDir = cl5GetDir ();
 	int rc;
 	char *baseDir;
-	char ldifFile [MAXPATHLEN + 1];
+	char ldifFile [MAXPATHLEN];
 
 	slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl, "Starting LDIF test ...\n");	
 
 	baseDir = getBaseDir (clDir);
-	sprintf (ldifFile, "%s/cl5.ldif", baseDir);
+	PR_snprintf (ldifFile, sizeof(ldifFile), "%s/cl5.ldif", baseDir);
 	slapi_ch_free ((void**)&baseDir);
 	rc = populateChangelog (ENTRY_COUNT, NULL);
 
@@ -660,7 +660,7 @@ static int  configureChangelog ()
 
     slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_SEARCH_ENTRIES, &entries);
 	str = slapi_entry_attr_get_charptr(entries[0], INSTANCE_ATTR);
-    sprintf (cl_dir, "%s/%s", str, "cl5db");
+    PR_snprintf (cl_dir, sizeof(cl_dir), "%s/%s", str, "cl5db");
 	slapi_ch_free((void **)&str);
 	slapi_entry_add_string (e, CONFIG_CHANGELOG_DIR_ATTRIBUTE, cl_dir);
 
@@ -689,6 +689,8 @@ done:
     return rc;
 }
 
+#define DN_SIZE 1024
+
 /* Format:
     dn: cn=replica,cn="o=NetscapeRoot",cn= mapping tree,cn=config
     objectclass: top
@@ -704,10 +706,10 @@ static int  configureReplica ()
     Slapi_PBlock *pb = slapi_pblock_new ();
     Slapi_Entry  *e = slapi_entry_alloc ();
     int rc;
-    char dn [128];
+    char dn [DN_SIZE];
 
     /* set changelog dn */
-    sprintf (dn, "%s,cn=\"%s\",%s", REPLICA_RDN, REPLICA_ROOT, 
+    PR_snprintf (dn, sizeof(dn), "%s,cn=\"%s\",%s", REPLICA_RDN, REPLICA_ROOT, 
              slapi_get_mapping_tree_config_root ());
     slapi_entry_set_dn (e, slapi_ch_strdup (dn));
     
@@ -746,7 +748,7 @@ static int  populateChangelogOp ()
     Slapi_PBlock *pb = slapi_pblock_new ();
     Slapi_Entry  *e = slapi_entry_alloc ();
     int rc;
-    char dn [128], newrdn [64];
+    char dn [DN_SIZE], newrdn [64];
     LDAPMod *mods[2];
     Slapi_Mod smod;
     struct berval bv;
@@ -754,7 +756,7 @@ static int  populateChangelogOp ()
 
     /* add entry */
     cur_time = time(NULL);
-    sprintf (dn, "cn=%s,%s", ctime(&cur_time), REPLICA_ROOT);
+    PR_snprintf (dn, sizeof(dn), "cn=%s,%s", ctime(&cur_time), REPLICA_ROOT);
     slapi_entry_set_dn (e, slapi_ch_strdup (dn));
     slapi_entry_add_string(e, "objectclass", "top");
     slapi_entry_add_string(e, "objectclass", "extensibleObject");
@@ -798,7 +800,7 @@ static int  populateChangelogOp ()
     /* rename entry */
     pb = slapi_pblock_new ();
     cur_time = time (NULL);
-    sprintf (newrdn, "cn=renamed%s", ctime(&cur_time));
+    PR_snprintf (newrdn, sizeof(newrdn), "cn=renamed%s", ctime(&cur_time));
     slapi_rename_internal_set_pb (pb, dn, newrdn, NULL, 1, NULL, NULL,
 	 					          repl_get_plugin_identity (PLUGIN_MULTIMASTER_REPLICATION), 0);
     slapi_modrdn_internal_pb (pb);
@@ -813,7 +815,7 @@ static int  populateChangelogOp ()
 
     /* delete the entry */
     pb = slapi_pblock_new ();
-    sprintf (dn, "%s,%s", newrdn, REPLICA_ROOT);
+    PR_snprintf (dn, sizeof(dn), "%s,%s", newrdn, REPLICA_ROOT);
     slapi_delete_internal_set_pb (pb, dn, NULL,  NULL, 
 								  repl_get_plugin_identity (PLUGIN_MULTIMASTER_REPLICATION), 0);
     slapi_delete_internal_pb (pb);
diff --git a/ldap/servers/plugins/replication/legacy_consumer.c b/ldap/servers/plugins/replication/legacy_consumer.c
index f04d8ed2..2369f423 100644
--- a/ldap/servers/plugins/replication/legacy_consumer.c
+++ b/ldap/servers/plugins/replication/legacy_consumer.c
@@ -498,19 +498,6 @@ legacy_consumer_is_replicationpw(struct berval *pwval)
     return return_value;
 }
 
-static void 
-legacy_consumer_free_config ()
-{
-	if (NULL != legacy_consumer_replicationdn) {
-		slapi_sdn_free(&legacy_consumer_replicationdn);
-	}
-	if (NULL != legacy_consumer_replicationpw) {
-		slapi_ch_free((void **) &legacy_consumer_replicationpw);
-	}
-}
-
-
-
 static void
 legacy_consumer_encode_pw (Slapi_Entry *e)
 {
@@ -599,9 +586,7 @@ get_legacy_referral (Slapi_Entry *e, char **referral, char **state)
         }
         else
         {
-            *referral = slapi_ch_malloc (strlen (pat) + strlen (hostport));
-        
-            sprintf (*referral, pat, hostport);
+            *referral = slapi_ch_smprintf (pat, hostport);
 
             slapi_ch_free ((void**)&hostport);
         }
diff --git a/ldap/servers/plugins/replication/profile.c b/ldap/servers/plugins/replication/profile.c
index af233355..f95a3f3e 100644
--- a/ldap/servers/plugins/replication/profile.c
+++ b/ldap/servers/plugins/replication/profile.c
@@ -28,15 +28,14 @@ void profile_log(char *file,int line)
 void profile_open()
 {
 	char filename[MAX_FILENAME];
-	strncpy(filename,CFG_rootpath,MAX_FILENAME);
-	strcat(filename,CFG_profilefile);
+	PR_snprintf(filename, MAX_FILENAME, "%s%s", CFG_rootpath, CFG_profilefile);
 	profile_fd= textfile_open(filename,"a");
 }
 
 void profile_close()
 {
 	if (profile_fd==NULL)
-		slapi_log_error(,"profile_close: profile file not open.");
+		slapi_log_error(SLAPI_LOG_ERROR, "repl_profile" ,"profile_close: profile file not open.");
 	else
 		textfile_close(profile_fd);
 }
diff --git a/ldap/servers/plugins/replication/repl5_agmt.c b/ldap/servers/plugins/replication/repl5_agmt.c
index b8bd09a3..dae8da60 100644
--- a/ldap/servers/plugins/replication/repl5_agmt.c
+++ b/ldap/servers/plugins/replication/repl5_agmt.c
@@ -310,9 +310,7 @@ agmt_new_from_entry(Slapi_Entry *e)
 		if (dot) {
 			*dot = '\0';
 		}
-		ra->long_name = slapi_ch_malloc(strlen(agmtname) + 
-			strlen(hostname) + 25);
-		sprintf(ra->long_name, "agmt=\"%s\" (%s:%d)", agmtname, hostname, ra->port);
+		ra->long_name = slapi_ch_smprintf("agmt=\"%s\" (%s:%d)", agmtname, hostname, ra->port);
 	}
 
 	/* Initialize status information */
@@ -868,7 +866,6 @@ agmt_set_bind_method_no_lock(Repl_Agmt *ra, const Slapi_Entry *e)
 int
 agmt_set_bind_method_from_entry(Repl_Agmt *ra, const Slapi_Entry *e)
 {
-	char *tmpstr = NULL;
 	int return_value = 0;
 
 	PR_ASSERT(NULL != ra);
diff --git a/ldap/servers/plugins/replication/repl5_agmtlist.c b/ldap/servers/plugins/replication/repl5_agmtlist.c
index e821ae2b..1c93e14f 100644
--- a/ldap/servers/plugins/replication/repl5_agmtlist.c
+++ b/ldap/servers/plugins/replication/repl5_agmtlist.c
@@ -164,7 +164,7 @@ agmtlist_modify_callback(Slapi_PBlock *pb, Slapi_Entry *entryBefore, Slapi_Entry
     int update_the_schedule = 0;	/* do we need to update the repl sched? */
 	Repl_Agmt *agmt = NULL;
 	LDAPMod **mods;
-    char buff [BUFSIZ];
+    char buff [SLAPI_DSE_RETURNTEXT_SIZE];
     char *errortext = returntext ? returntext : buff;
     int rc = SLAPI_DSE_CALLBACK_OK;
     Slapi_Operation *op;
@@ -225,7 +225,7 @@ agmtlist_modify_callback(Slapi_PBlock *pb, Slapi_Entry *entryBefore, Slapi_Entry
 			    /* Start replica initialization */
                 if (val == NULL)
                 {
-                    sprintf (errortext, "No value supplied for attr (%s)", mods[i]->mod_type);
+                    PR_snprintf (errortext, SLAPI_DSE_RETURNTEXT_SIZE, "No value supplied for attr (%s)", mods[i]->mod_type);
                     slapi_log_error(SLAPI_LOG_REPL, repl_plugin_name, "agmtlist_modify_callback: %s\n",
                                     errortext);	  
                     *returncode = LDAP_UNWILLING_TO_PERFORM;
@@ -247,7 +247,7 @@ agmtlist_modify_callback(Slapi_PBlock *pb, Slapi_Entry *entryBefore, Slapi_Entry
                 }
                 else
                 {
-                    sprintf (errortext, "Invalid value (%s) value supplied for attr (%s)", 
+                    PR_snprintf (errortext, SLAPI_DSE_RETURNTEXT_SIZE, "Invalid value (%s) value supplied for attr (%s)", 
                              val, mods[i]->mod_type);
                     slapi_log_error(SLAPI_LOG_REPL, repl_plugin_name, "agmtlist_modify_callback: %s\n",
                                     errortext);	
diff --git a/ldap/servers/plugins/replication/repl5_connection.c b/ldap/servers/plugins/replication/repl5_connection.c
index cd6c45ae..eed22750 100644
--- a/ldap/servers/plugins/replication/repl5_connection.c
+++ b/ldap/servers/plugins/replication/repl5_connection.c
@@ -61,9 +61,6 @@ static int s_debug_level = 0;
 static Slapi_Eq_Context repl5_start_debug_timeout(int *setlevel);
 static void repl5_stop_debug_timeout(Slapi_Eq_Context eqctx, int *setlevel);
 static void repl5_debug_timeout_callback(time_t when, void *arg);
-#ifndef DSE_RETURNTEXT_SIZE
-#define SLAPI_DSE_RETURNTEXT_SIZE 512
-#endif
 
 #define STATE_CONNECTED 600
 #define STATE_DISCONNECTED 601
@@ -1050,9 +1047,6 @@ conn_push_schema(Repl_Connection *conn, CSN **remotecsn)
 	char *nsschemacsn = "nsschemacsn";
 	Slapi_Entry **entries = NULL;
 	Slapi_Entry *schema_entry = NULL;
-	int push_schema = 1; /* Assume we need to push for now */
-	int local_error = 0; /* No local error encountered yet */
-	int remote_error = 0; /* No remote error encountered yet */
 	CSN *localcsn = NULL;
 	Slapi_PBlock *spb = NULL;
 	char localcsnstr[CSN_STRSIZE + 1] = {0};
@@ -1193,6 +1187,8 @@ conn_push_schema(Repl_Connection *conn, CSN **remotecsn)
 					case CONN_OPERATION_SUCCESS:
 						return_value = CONN_SCHEMA_UPDATED;
 						break;
+					default:
+						break;
 					}
 				}
 			}
@@ -1434,18 +1430,6 @@ repl5_set_debug_timeout(const char *val)
 	}
 }
 
-static time_t 
-PRTime2time_t (PRTime tm)
-{
-    PRInt64 rt;
-
-    PR_ASSERT (tm);
-    
-    LL_DIV(rt, tm, PR_USEC_PER_SEC);
-
-    return (time_t)rt;
-}
-
 static Slapi_Eq_Context
 repl5_start_debug_timeout(int *setlevel)
 {
@@ -1465,7 +1449,7 @@ repl5_stop_debug_timeout(Slapi_Eq_Context eqctx, int *setlevel)
 	char msg[SLAPI_DSE_RETURNTEXT_SIZE];
 
 	if (eqctx && !*setlevel) {
-		int found = slapi_eq_cancel(eqctx);
+		(void)slapi_eq_cancel(eqctx);
 	}
 
 	if (s_debug_timeout && s_debug_level && *setlevel) {
diff --git a/ldap/servers/plugins/replication/repl5_init.c b/ldap/servers/plugins/replication/repl5_init.c
index 8aead52d..d2207501 100644
--- a/ldap/servers/plugins/replication/repl5_init.c
+++ b/ldap/servers/plugins/replication/repl5_init.c
@@ -36,6 +36,8 @@ nsslapd-plugindescription: Multi-Master Replication Plugin
 #include "dirver.h"
 #include <dirlite_strings.h> /* PLUGIN_MAGIC_VENDOR_STR */
 
+#include "plstr.h"
+
 /* #ifdef _WIN32
 int *module_ldap_debug = 0;
 
@@ -152,15 +154,15 @@ get_repl_session_id (Slapi_PBlock *pb, char *idstr, CSN **csn)
 		/* Avoid "Connection is NULL and hence cannot access SLAPI_CONN_ID" */
 		if (opid) {
 			slapi_pblock_get (pb, SLAPI_CONN_ID, &connid);
-			sprintf (idstr, "conn=%d op=%d", connid, opid);
+			PR_snprintf (idstr, REPL_SESSION_ID_SIZE, "conn=%d op=%d", connid, opid);
 		}
 
 		slapi_pblock_get ( pb, SLAPI_OPERATION, &op );
 		opcsn = operation_get_csn (op);
 		if (opcsn) {
 			csn_as_string (opcsn, PR_FALSE, opcsnstr);
-			strcat (idstr, " csn=");
-			strcat (idstr, opcsnstr);
+			PL_strcatn (idstr, REPL_SESSION_ID_SIZE, " csn=");
+			PL_strcatn (idstr, REPL_SESSION_ID_SIZE, opcsnstr);
 		}
 	}
 	if (csn) {
diff --git a/ldap/servers/plugins/replication/repl5_plugins.c b/ldap/servers/plugins/replication/repl5_plugins.c
index c929fafd..c81dbc3f 100644
--- a/ldap/servers/plugins/replication/repl5_plugins.c
+++ b/ldap/servers/plugins/replication/repl5_plugins.c
@@ -50,8 +50,6 @@ static PRBool process_operation (Slapi_PBlock *pb, const CSN *csn);
 static PRBool is_mmr_replica (Slapi_PBlock *pb);
 static const char *replica_get_purl_for_op (const Replica *r, Slapi_PBlock *pb, const CSN *opcsn);
 static void strip_legacy_info (slapi_operation_parameters *op_params);
-static void close_changelog_for_replica (Object *r_obj);
-static void process_new_ruv_for_replica (Replica *r);
 
 /*
  * XXXggood - what to do if both ssl and non-ssl ports available? How
@@ -98,14 +96,7 @@ multimaster_set_local_purl()
 			}
 			else
 			{
-				int len = 0;
-				char *patt = "ldap://%s:%s";
-				len += strlen(host);
-				len += strlen(port);
-				len += strlen(patt);
-				len++; /* for \0 */
-				local_purl = slapi_ch_malloc(len);
-				sprintf(local_purl, patt, host, port);
+				local_purl = slapi_ch_smprintf("ldap://%s:%s", host, port);
 			}
 
 			/* slapi_ch_free acceptS NULL pointer */
@@ -1407,10 +1398,3 @@ multimaster_be_state_change (void *handle, char *be_name, int old_be_state, int
 
     object_release (r_obj);
 }
-
-static void 
-close_changelog_for_replica (Object *r_obj)
-{
-    if (cl5GetState () == CL5_STATE_OPEN)
-        cl5CloseDB (r_obj);
-}
diff --git a/ldap/servers/plugins/replication/repl5_replica.c b/ldap/servers/plugins/replication/repl5_replica.c
index 525fe10d..36bae420 100644
--- a/ldap/servers/plugins/replication/repl5_replica.c
+++ b/ldap/servers/plugins/replication/repl5_replica.c
@@ -95,7 +95,7 @@ replica_new(const Slapi_DN *root)
 {
 	Replica *r = NULL;
 	Slapi_Entry *e = NULL;
-	char errorbuf[BUFSIZ];
+	char errorbuf[SLAPI_DSE_RETURNTEXT_SIZE];
 	char ebuf[BUFSIZ];
 	
 	PR_ASSERT (root);
@@ -135,7 +135,7 @@ replica_new_from_entry (Slapi_Entry *e, char *errortext, PRBool is_add_operation
     {
         if (NULL != errortext)
 		{
-            sprintf (errortext, "NULL entry");
+            PR_snprintf(errortext, SLAPI_DSE_RETURNTEXT_SIZE, "NULL entry");
 		}
         return NULL;        
     }
@@ -146,7 +146,7 @@ replica_new_from_entry (Slapi_Entry *e, char *errortext, PRBool is_add_operation
 	{
 		if (NULL != errortext)
 		{
-            sprintf (errortext, "failed to create replica lock");
+            PR_snprintf(errortext, SLAPI_DSE_RETURNTEXT_SIZE, "failed to create replica lock");
 		}
 		rc = -1;
 		goto done;
@@ -156,7 +156,7 @@ replica_new_from_entry (Slapi_Entry *e, char *errortext, PRBool is_add_operation
 	{
 		if (NULL != errortext)
 		{
-            sprintf (errortext, "failed to create replica lock");
+            PR_snprintf(errortext, SLAPI_DSE_RETURNTEXT_SIZE, "failed to create replica lock");
 		}
 		rc = -1;
 		goto done;
@@ -969,7 +969,6 @@ replica_set_referrals(Replica *r,const Slapi_ValueSet *vs)
 	{
 		Slapi_ValueSet *newvs = slapi_valueset_new();
 		const char *repl_root = slapi_sdn_get_dn(r->repl_root);
-		int rootlen = strlen(repl_root);
 		ii = slapi_valueset_first_value(r->repl_referral, &vv);
 		while (vv)
 		{
@@ -984,12 +983,9 @@ replica_set_referrals(Replica *r,const Slapi_ValueSet *vs)
 				char *tmpref = NULL;
 				int need_slash = 0;
 				if (ref[len-1] != '/') {
-					len++; /* add another one for the slash */
 					need_slash = 1;
 				}
-				len += rootlen + 2;
-				tmpref = slapi_ch_malloc(len);
-				sprintf(tmpref, "%s%s%s", ref, (need_slash ? "/" : ""),
+				tmpref = slapi_ch_smprintf("%s%s%s", ref, (need_slash ? "/" : ""),
 						repl_root);
 				newval = slapi_value_new_string(tmpref);
 				slapi_ch_free_string(&tmpref); /* sv_new_string makes a copy */
@@ -1545,7 +1541,7 @@ _replica_init_from_config (Replica *r, Slapi_Entry *e, char *errortext)
 	Slapi_Attr *attr;
 	char *val;
 	CSNGen *gen; 
-    char buf [BUFSIZ];
+    char buf [SLAPI_DSE_RETURNTEXT_SIZE];
     char *errormsg = errortext? errortext : buf;
 	Slapi_Attr *a = NULL;
 	char dnescape[BUFSIZ]; /* for escape_string */
@@ -1556,7 +1552,7 @@ _replica_init_from_config (Replica *r, Slapi_Entry *e, char *errortext)
 	val = slapi_entry_attr_get_charptr (e, attr_replicaRoot);
     if (val == NULL)
     {
-        sprintf (errormsg, "failed to retrieve %s attribute from (%s)\n", 
+        PR_snprintf (errormsg, SLAPI_DSE_RETURNTEXT_SIZE, "failed to retrieve %s attribute from (%s)\n", 
                  attr_replicaRoot,
 				 escape_string((char*)slapi_entry_get_dn ((Slapi_Entry*)e), dnescape));
         slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, "_replica_init_from_config: %s\n",
@@ -1621,7 +1617,7 @@ _replica_init_from_config (Replica *r, Slapi_Entry *e, char *errortext)
 			slapi_ch_free ((void**)&val);
 			if (temprid <= 0 || temprid >= READ_ONLY_REPLICA_ID)
 			{
-				sprintf (errormsg,
+				PR_snprintf (errormsg, SLAPI_DSE_RETURNTEXT_SIZE,
 						 "attribute %s must have a value greater than 0 "
 						 "and less than %d: entry %s",
 						 attr_replicaId, READ_ONLY_REPLICA_ID,
@@ -1639,7 +1635,8 @@ _replica_init_from_config (Replica *r, Slapi_Entry *e, char *errortext)
 		}
 		else
 		{
-			sprintf (errormsg, "failed to retrieve required %s attribute from %s",
+			PR_snprintf (errormsg, SLAPI_DSE_RETURNTEXT_SIZE,
+						 "failed to retrieve required %s attribute from %s",
 					 attr_replicaId,
 					 escape_string((char*)slapi_entry_get_dn ((Slapi_Entry*)e),
 								   dnescape));
@@ -1655,7 +1652,8 @@ _replica_init_from_config (Replica *r, Slapi_Entry *e, char *errortext)
 	gen = csngen_new (r->repl_rid, attr);
 	if (gen == NULL)
 	{
-        sprintf (errormsg, "failed to create csn generator for replica (%s)",
+        PR_snprintf (errormsg, SLAPI_DSE_RETURNTEXT_SIZE,
+					 "failed to create csn generator for replica (%s)",
 				 escape_string((char*)slapi_entry_get_dn ((Slapi_Entry*)e),
 							   dnescape));
         slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name,
@@ -1681,7 +1679,8 @@ _replica_init_from_config (Replica *r, Slapi_Entry *e, char *errortext)
         rc = slapi_uniqueIDGenerateString (&r->repl_name);
         if (rc != UID_SUCCESS)
 	    {
-            sprintf (errormsg, "failed to assign replica name for replica (%s); "
+            PR_snprintf (errormsg, SLAPI_DSE_RETURNTEXT_SIZE,
+						 "failed to assign replica name for replica (%s); "
                      "uuid generator error - %d ",
 					 escape_string((char*)slapi_entry_get_dn ((Slapi_Entry*)e), dnescape),
 					 rc);
@@ -1748,7 +1747,7 @@ _replica_update_entry (Replica *r, Slapi_Entry *e, char *errortext)
     rc = csngen_get_state ((CSNGen*)object_get_data (r->repl_csngen), &smod);
 	if (rc != CSN_SUCCESS)
     {
-        sprintf (errortext, "failed to get csn generator's state; csn error - %d", rc);
+        PR_snprintf(errortext, SLAPI_DSE_RETURNTEXT_SIZE, "failed to get csn generator's state; csn error - %d", rc);
         slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, 
 						"_replica_update_entry: %s\n", errortext);
 		return -1;    
@@ -1763,7 +1762,7 @@ _replica_update_entry (Replica *r, Slapi_Entry *e, char *errortext)
 
     if (rc != 0)
     {
-        sprintf (errortext, "failed to update replica entry");
+        PR_snprintf(errortext, SLAPI_DSE_RETURNTEXT_SIZE, "failed to update replica entry");
         slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, 
 						"_replica_update_entry: %s\n", errortext);
 		return -1;    
@@ -1773,7 +1772,7 @@ _replica_update_entry (Replica *r, Slapi_Entry *e, char *errortext)
     rc = slapi_entry_add_string (e, attr_replicaName, r->repl_name);
     if (rc != 0)
     {
-        sprintf (errortext, "failed to update replica entry");
+        PR_snprintf(errortext, SLAPI_DSE_RETURNTEXT_SIZE, "failed to update replica entry");
         slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, 
 						"_replica_update_entry: %s\n", errortext);
 		return -1;    
@@ -1790,15 +1789,10 @@ _replica_get_config_dn (const Slapi_DN *root)
 {
     char *dn;
     const char *mp_base = slapi_get_mapping_tree_config_root ();
-    int len; 
 
     PR_ASSERT (root);
 
-    len = strlen (REPLICA_RDN) + strlen (slapi_sdn_get_dn (root)) +
-          strlen (mp_base) + 8; /* 8 = , + cn= + \" + \" + , + \0 */
-
-    dn = (char*)slapi_ch_malloc (len);
-    sprintf (dn, "%s,cn=\"%s\",%s", REPLICA_RDN, slapi_sdn_get_dn (root), mp_base);
+    dn = slapi_ch_smprintf("%s,cn=\"%s\",%s", REPLICA_RDN, slapi_sdn_get_dn (root), mp_base);
 
     return dn;
 }
@@ -2622,10 +2616,7 @@ replica_create_ruv_tombstone(Replica *r)
 	char ebuf[BUFSIZ];
 	
 	PR_ASSERT(NULL != r && NULL != r->repl_root);
-	root_entry_str = slapi_ch_malloc(strlen(root_glue) +
-		slapi_sdn_get_ndn_len(r->repl_root) +
-		strlen(RUV_STORAGE_ENTRY_UNIQUEID) + 1);
-	sprintf(root_entry_str, root_glue, slapi_sdn_get_ndn(r->repl_root),
+	root_entry_str = slapi_ch_smprintf(root_glue, slapi_sdn_get_ndn(r->repl_root),
 		RUV_STORAGE_ENTRY_UNIQUEID);
 
 	e = slapi_str2entry(root_entry_str, SLAPI_STR2ENTRY_TOMBSTONE_CHECK);
diff --git a/ldap/servers/plugins/replication/repl5_replica_config.c b/ldap/servers/plugins/replication/repl5_replica_config.c
index e93ec640..b113b3c9 100644
--- a/ldap/servers/plugins/replication/repl5_replica_config.c
+++ b/ldap/servers/plugins/replication/repl5_replica_config.c
@@ -98,7 +98,7 @@ replica_config_add (Slapi_PBlock *pb, Slapi_Entry* e, Slapi_Entry* entryAfter,
 	Replica *r = NULL;
     multimaster_mtnode_extension *mtnode_ext;	
     char *replica_root = (char*)slapi_entry_attr_get_charptr (e, attr_replicaRoot);
-	char buf [BUFSIZ];
+	char buf [SLAPI_DSE_RETURNTEXT_SIZE];
 	char *errortext = errorbuf ? errorbuf : buf;
     
 	if (errorbuf)
@@ -118,7 +118,7 @@ replica_config_add (Slapi_PBlock *pb, Slapi_Entry* e, Slapi_Entry* entryAfter,
 
     if (mtnode_ext->replica)
     {
-        sprintf (errortext, "replica already configured for %s", replica_root);
+        PR_snprintf (errortext, SLAPI_DSE_RETURNTEXT_SIZE, "replica already configured for %s", replica_root);
         slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, "replica_config_add: %s\n", errortext);
         *returncode = LDAP_UNWILLING_TO_PERFORM;    
         goto done;   
@@ -173,7 +173,7 @@ replica_config_modify (Slapi_PBlock *pb, Slapi_Entry* entryBefore, Slapi_Entry*
     multimaster_mtnode_extension *mtnode_ext;	
 	Replica *r = NULL;
     char *replica_root = NULL; 
-	char buf [BUFSIZ];
+	char buf [SLAPI_DSE_RETURNTEXT_SIZE];
 	char *errortext = returntext ? returntext : buf;
     char *config_attr, *config_attr_value;
     Slapi_Operation *op;
@@ -208,7 +208,7 @@ replica_config_modify (Slapi_PBlock *pb, Slapi_Entry* entryBefore, Slapi_Entry*
 
     if (mtnode_ext->replica == NULL)
     {
-        sprintf (errortext, "replica does not exist for %s", replica_root);
+        PR_snprintf (errortext, SLAPI_DSE_RETURNTEXT_SIZE, "replica does not exist for %s", replica_root);
         slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, "replica_config_modify: %s\n",
                         errortext);
         *returncode = LDAP_OPERATIONS_ERROR;    
@@ -248,7 +248,7 @@ replica_config_modify (Slapi_PBlock *pb, Slapi_Entry* entryBefore, Slapi_Entry*
                 strcasecmp (config_attr, attr_state) == 0)
             {
                 *returncode = LDAP_UNWILLING_TO_PERFORM;
-                sprintf (errortext, "modification of %s attribute is not allowed", 
+                PR_snprintf (errortext, SLAPI_DSE_RETURNTEXT_SIZE, "modification of %s attribute is not allowed", 
                          config_attr);                         
                 slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, "replica_config_modify: %s\n", 
                                 errortext);
@@ -280,7 +280,7 @@ replica_config_modify (Slapi_PBlock *pb, Slapi_Entry* entryBefore, Slapi_Entry*
                 else
                 {
                     *returncode = LDAP_UNWILLING_TO_PERFORM;
-                    sprintf (errortext, "deletion of %s attribute is not allowed", config_attr);                         
+                    PR_snprintf (errortext, SLAPI_DSE_RETURNTEXT_SIZE, "deletion of %s attribute is not allowed", config_attr);                         
                     slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, "replica_config_modify: %s\n", 
                                     errortext);
                 }                
@@ -372,7 +372,8 @@ replica_config_modify (Slapi_PBlock *pb, Slapi_Entry* entryBefore, Slapi_Entry*
                 else
                 {
                     *returncode = LDAP_UNWILLING_TO_PERFORM;
-                    sprintf (errortext, "modification of attribute %s is not allowed in replica entry", config_attr);
+                    PR_snprintf (errortext, SLAPI_DSE_RETURNTEXT_SIZE,
+								 "modification of attribute %s is not allowed in replica entry", config_attr);
                     slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, "replica_config_modify: %s\n", 
                                     errortext);
                 } 
@@ -497,7 +498,7 @@ replica_config_change_type_and_id (Replica *r, const char *new_type,
         type = atoi (new_type);
         if (type <= REPLICA_TYPE_UNKNOWN || type >= REPLICA_TYPE_END)
         {
-            sprintf (returntext, "invalid replica type %d", type);
+            PR_snprintf (returntext, SLAPI_DSE_RETURNTEXT_SIZE, "invalid replica type %d", type);
             return LDAP_OPERATIONS_ERROR;
         }
     }
@@ -505,7 +506,7 @@ replica_config_change_type_and_id (Replica *r, const char *new_type,
 	/* disallow changing type to itself just to permit a replica ID change */
 	if (oldtype == type)
 	{
-            sprintf (returntext, "replica type is already %d - not changing", type);
+            PR_snprintf (returntext, SLAPI_DSE_RETURNTEXT_SIZE, "replica type is already %d - not changing", type);
             return LDAP_OPERATIONS_ERROR;
 	}
 
@@ -515,7 +516,7 @@ replica_config_change_type_and_id (Replica *r, const char *new_type,
 	}
 	else if (!new_id)
 	{
-		sprintf(returntext, "a replica ID is required when changing replica type to read-write");
+		PR_snprintf (returntext, SLAPI_DSE_RETURNTEXT_SIZE, "a replica ID is required when changing replica type to read-write");
 		return LDAP_UNWILLING_TO_PERFORM;
 	}
 	else
@@ -523,7 +524,7 @@ replica_config_change_type_and_id (Replica *r, const char *new_type,
 		int temprid = atoi (new_id);
 		if (temprid <= 0 || temprid >= READ_ONLY_REPLICA_ID)
 		{
-			sprintf(returntext,
+			PR_snprintf (returntext, SLAPI_DSE_RETURNTEXT_SIZE,
 					"attribute %s must have a value greater than 0 "
 					"and less than %d",
 					attr_replicaId, READ_ONLY_REPLICA_ID);
@@ -538,7 +539,7 @@ replica_config_change_type_and_id (Replica *r, const char *new_type,
 	/* error if old rid == new rid */
 	if (oldrid == rid)
 	{
-            sprintf (returntext, "replica ID is already %d - not changing", rid);
+            PR_snprintf (returntext, SLAPI_DSE_RETURNTEXT_SIZE, "replica ID is already %d - not changing", rid);
             return LDAP_OPERATIONS_ERROR;
 	}
 
@@ -610,7 +611,8 @@ static int replica_execute_task (Object *r, const char *task_name, char *returnt
 	{
 		int temprid = atoi(&(task_name[CLEANRUVLEN]));
 		if (temprid <= 0 || temprid >= READ_ONLY_REPLICA_ID){
-			sprintf(returntext, "Invalid replica id for task - %s", task_name);
+			PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE,
+						"Invalid replica id for task - %s", task_name);
 			slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name,
 							"replica_execute_task: %s\n", returntext);
 			return LDAP_OPERATIONS_ERROR;
@@ -624,7 +626,7 @@ static int replica_execute_task (Object *r, const char *task_name, char *returnt
 	}
 	else
 	{
-        sprintf (returntext, "unsupported replica task - %s", task_name);
+        PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE, "unsupported replica task - %s", task_name);
         slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, 
                         "replica_execute_task: %s\n", returntext);        
         return LDAP_OPERATIONS_ERROR;
@@ -642,7 +644,7 @@ static int replica_execute_cl2ldif_task (Object *r, char *returntext)
 
     if (cl5GetState () != CL5_STATE_OPEN)
     {
-        sprintf (returntext, "changelog is not open");
+        PR_snprintf (returntext, SLAPI_DSE_RETURNTEXT_SIZE, "changelog is not open");
         slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, 
                         "replica_execute_cl2ldif_task: %s\n", returntext);        
         return LDAP_OPERATIONS_ERROR;
@@ -659,13 +661,13 @@ static int replica_execute_cl2ldif_task (Object *r, char *returntext)
     replica = (Replica*)object_get_data (r);
     PR_ASSERT (replica);
 
-    sprintf (fName, "%s/%s.ldif", clDir, replica_get_name (replica));
+    PR_snprintf (fName, MAXPATHLEN, "%s/%s.ldif", clDir, replica_get_name (replica));
     slapi_ch_free ((void**)&clDir);
 
     rc = cl5ExportLDIF (fName, rlist);
     if (rc != CL5_SUCCESS)
     {
-        sprintf (returntext, "failed to export changelog data to file %s; "
+        PR_snprintf (returntext, SLAPI_DSE_RETURNTEXT_SIZE, "failed to export changelog data to file %s; "
                  "changelog error - %d", fName, rc);
         slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, 
                         "replica_execute_cl2ldif_task: %s\n", returntext);        
diff --git a/ldap/servers/plugins/replication/repl5_ruv.c b/ldap/servers/plugins/replication/repl5_ruv.c
index 306c20a2..dfc11227 100644
--- a/ldap/servers/plugins/replication/repl5_ruv.c
+++ b/ldap/servers/plugins/replication/repl5_ruv.c
@@ -978,19 +978,14 @@ ruv_to_bervals(const RUV *ruv, struct berval ***bvals)
 		returned_bervals = (struct berval **)slapi_ch_malloc(sizeof(struct berval *) * count);
 		returned_bervals[count - 1] = NULL;
 		returned_bervals[0] = (struct berval *)slapi_ch_malloc(sizeof(struct berval));
-		returned_bervals[0]->bv_val = slapi_ch_malloc(strlen(prefix_replicageneration) + strlen(ruv->replGen) + 2);
-		sprintf(returned_bervals[0]->bv_val, "%s %s",
+		returned_bervals[0]->bv_val = slapi_ch_smprintf("%s %s",
 			prefix_replicageneration, ruv->replGen);
 		returned_bervals[0]->bv_len = strlen(returned_bervals[0]->bv_val);
 		for (i = 1, replica = dl_get_first (ruv->elements, &cookie); replica;
 			 i++, replica = dl_get_next (ruv->elements, &cookie))
 		{
 			returned_bervals[i] = (struct berval *)slapi_ch_malloc(sizeof(struct berval));
-			returned_bervals[i]->bv_val = slapi_ch_malloc(strlen(prefix_ruvcsn) + RIDSTR_SIZE +
-				((replica->replica_purl == NULL) ? 0 : strlen(replica->replica_purl)) +
-				((replica->min_csn == NULL) ? 0 : CSN_STRSIZE) +
-				((replica->csn == NULL) ? 0 : CSN_STRSIZE) + 5);
-			sprintf(returned_bervals[i]->bv_val, "%s%d%s%s}%s%s%s%s",
+			returned_bervals[i]->bv_val = slapi_ch_smprintf("%s%d%s%s}%s%s%s%s",
 				prefix_ruvcsn, replica->rid,
 				replica->replica_purl == NULL ? "" : " ",
 				replica->replica_purl == NULL ? "" : replica->replica_purl,
diff --git a/ldap/servers/plugins/replication/repl5_schedule.c b/ldap/servers/plugins/replication/repl5_schedule.c
index c07a2339..90a7c13e 100644
--- a/ldap/servers/plugins/replication/repl5_schedule.c
+++ b/ldap/servers/plugins/replication/repl5_schedule.c
@@ -83,7 +83,6 @@ static void schedule_window_state_change_event (Schedule *sch);
 static void unschedule_window_state_change_event (Schedule *sch);
 static void window_state_changed (time_t when, void *arg);
 static int schedule_in_window_now_nolock(Schedule *sch);
-static schedule_item* get_current_schedule_item (Schedule *sch);
 static time_t PRTime2time_t (PRTime tm);
 static PRTime schedule_next_nolock (Schedule *sch, PRBool start);
 static void free_schedule_list(schedule_item **schedule_list);
@@ -426,7 +425,6 @@ schedule_next_nolock (Schedule *sch, PRBool start)
 	{
 		schedule_item *si = sch->schedule_list;
 		PRTime now = PR_Now();
-        unsigned char dow = 1 << day_of_week(now);
 
 		while (NULL != si)
 		{
diff --git a/ldap/servers/plugins/replication/repl5_tot_protocol.c b/ldap/servers/plugins/replication/repl5_tot_protocol.c
index cbbfccf0..b7bb38bd 100644
--- a/ldap/servers/plugins/replication/repl5_tot_protocol.c
+++ b/ldap/servers/plugins/replication/repl5_tot_protocol.c
@@ -60,7 +60,6 @@ repl5_tot_run(Private_Repl_Protocol *prp)
     callback_data cb_data;
     Slapi_PBlock *pb;
     LDAPControl **ctrls;
-	PRBool replica_acquired = PR_FALSE;
 	char *hostname = NULL;
 	int portnum = 0;
 	Slapi_DN *area_sdn = NULL;
diff --git a/ldap/servers/plugins/replication/repl_bind.c b/ldap/servers/plugins/replication/repl_bind.c
index 8671c7bb..6b91915d 100644
--- a/ldap/servers/plugins/replication/repl_bind.c
+++ b/ldap/servers/plugins/replication/repl_bind.c
@@ -17,7 +17,6 @@ legacy_preop_bind( Slapi_PBlock *pb )
 	char *dn = NULL;
 	struct berval *cred = NULL;
 	int method;
-	int one = 1;
     
 	slapi_pblock_get(pb, SLAPI_BIND_METHOD, &method);
 	slapi_pblock_get(pb, SLAPI_BIND_TARGET, &dn);
diff --git a/ldap/servers/plugins/replication/repl_controls.c b/ldap/servers/plugins/replication/repl_controls.c
index d569afc9..d6f25e9a 100644
--- a/ldap/servers/plugins/replication/repl_controls.c
+++ b/ldap/servers/plugins/replication/repl_controls.c
@@ -36,7 +36,6 @@ create_NSDS50ReplUpdateInfoControl(const char *uuid,
 {
 	int retval;
 	BerElement *tmp_bere = NULL;
-	struct berval tmpval = {0};
 	char csn_str[CSN_STRSIZE];	
 
 	if (NULL == ctrlp)
diff --git a/ldap/servers/plugins/replication/repl_extop.c b/ldap/servers/plugins/replication/repl_extop.c
index cb491a39..5f518b81 100644
--- a/ldap/servers/plugins/replication/repl_extop.c
+++ b/ldap/servers/plugins/replication/repl_extop.c
@@ -724,7 +724,7 @@ multimaster_extop_StartNSDS50ReplicationRequest(Slapi_PBlock *pb)
 	 * the session's conn id and op id to identify the the supplier.
 	 */
 	/* junkrc = ruv_get_first_id_and_purl(supplier_ruv, &junkrid, &locking_purl); */
-	sprintf(locking_session, "conn=%d id=%d", connid, opid);
+	PR_snprintf(locking_session, sizeof(locking_session), "conn=%d id=%d", connid, opid);
 	locking_purl = &locking_session[0];
 	if (replica_get_exclusive_access(replica, &isInc, connid, opid,
 									 locking_purl,
@@ -826,7 +826,7 @@ send_response:
 		int resp_log_level = SLAPI_LOG_FATAL;
 		char purlstr[1024] = {0};
 		if (current_purl)
-			sprintf(purlstr, " locked by %s for %s update", current_purl,
+			PR_snprintf(purlstr, sizeof(purlstr), " locked by %s for %s update", current_purl,
 					isInc ? "incremental" : "total");
 
 		/* Don't log replica busy as errors - these are almost always not
diff --git a/ldap/servers/plugins/replication/repl_init.c b/ldap/servers/plugins/replication/repl_init.c
index 35d8bbf4..14475900 100644
--- a/ldap/servers/plugins/replication/repl_init.c
+++ b/ldap/servers/plugins/replication/repl_init.c
@@ -52,7 +52,6 @@ static Slapi_PluginDesc legacypreopdesc = { "replication-legacy-preop", PLUGIN_M
 static Slapi_PluginDesc legacypostopdesc = { "replication-legacy-postop", PLUGIN_MAGIC_VENDOR_STR, PRODUCTTEXT, "Legacy replication post-operation plugin" };
 static Slapi_PluginDesc legacyinternalpreopdesc = { "replication-legacy-internalpreop", PLUGIN_MAGIC_VENDOR_STR, PRODUCTTEXT, "Legacy replication internal pre-operation plugin" };
 static Slapi_PluginDesc legacyinternalpostopdesc = { "replication-legacy-internalpostop", PLUGIN_MAGIC_VENDOR_STR, PRODUCTTEXT, "Legacy replication internal post-operation plugin" };
-static Slapi_PluginDesc legacybepostopdesc = { "replication-legacy-bepostop", PLUGIN_MAGIC_VENDOR_STR, PRODUCTTEXT, "Legacy replication bepost-operation plugin" };
 static Slapi_PluginDesc legacyentrydesc = { "replication-legacy-entry", PLUGIN_MAGIC_VENDOR_STR, PRODUCTTEXT, "Legacy replication entry plugin" };
 
 static int legacy_stopped; /* A flag which is set when all the plugin threads are to stop */        
@@ -173,7 +172,6 @@ legacy_entry_init( Slapi_PBlock *pb )
 static int
 create_config_top()
 {
-	const char *dn = REPL_CONFIG_TOP;
 	char *entry_string = slapi_ch_strdup("dn: cn=replication,cn=config\nobjectclass: top\nobjectclass: extensibleobject\ncn: replication\n");
 	Slapi_PBlock *pb = slapi_pblock_new();
 	Slapi_Entry *e = slapi_str2entry(entry_string, 0);
diff --git a/ldap/servers/plugins/replication/repl_ops.c b/ldap/servers/plugins/replication/repl_ops.c
index aaffe507..28e9f4af 100644
--- a/ldap/servers/plugins/replication/repl_ops.c
+++ b/ldap/servers/plugins/replication/repl_ops.c
@@ -55,13 +55,6 @@ legacy_postop( Slapi_PBlock *pb, const char *caller, int operation_type)
 	return 0;
 }
 
-
-
-static char *not_replicationdn_errmsg =
-	"An operation was submitted that contained copiedFrom or "
-	"copyingFrom attributes, but the connection was not bound "
-	"as the replicationdn.";
-
 int
 legacy_preop(Slapi_PBlock *pb, const char *caller, int operation_type)
 {
diff --git a/ldap/servers/plugins/replication/replutil.c b/ldap/servers/plugins/replication/replutil.c
index bb6b13e4..e1aab69d 100644
--- a/ldap/servers/plugins/replication/replutil.c
+++ b/ldap/servers/plugins/replication/replutil.c
@@ -413,9 +413,9 @@ parse_changes_string(char *str)
 			if (rc != 0)
 			{
 				/* ONREPL - log warning */
-			        if ( errmsg != NULL ) {
-				        slapi_log_error( SLAPI_LOG_PARSE, repl_plugin_name, "%s", errmsg ); 
-					slapi_ch_free( (void**)&errmsg );
+				if ( errmsg != NULL ) {
+					slapi_log_error( SLAPI_LOG_PARSE, repl_plugin_name, "%s", errmsg ); 
+					PR_smprintf_free(errmsg );
 				}
 				slapi_log_error( SLAPI_LOG_REPL, repl_plugin_name, 
 						 "Failed to parse the ldif line.\n");
@@ -907,7 +907,6 @@ repl_enable_chain_on_update(Slapi_DN *suffix)
     /* Submit a Modify operation to add the distribution function to the mapping tree
 	   node for the given suffix */
     slapi_mods smods;
-	Slapi_Operation *op = NULL;
 	int operation_result;
 	Slapi_PBlock *pb= slapi_pblock_new();
 	char *mtnnodedn;
@@ -952,7 +951,6 @@ repl_disable_chain_on_update(Slapi_DN *suffix)
     /* Submit a Modify operation to remove the distribution function from the mapping tree
 	   node for the given suffix */
     slapi_mods smods;
-	Slapi_Operation *op = NULL;
 	int operation_result;
 	Slapi_PBlock *pb= slapi_pblock_new();
 	char *mtnnodedn;
diff --git a/ldap/servers/plugins/replication/urp.c b/ldap/servers/plugins/replication/urp.c
index 70f449b5..db111c21 100644
--- a/ldap/servers/plugins/replication/urp.c
+++ b/ldap/servers/plugins/replication/urp.c
@@ -149,7 +149,7 @@ urp_add_operation( Slapi_PBlock *pb )
 			Slapi_RDN *rdn;
 			char buf[BUFSIZ];
 
-			sprintf(buf, "%s %s", REASON_ANNOTATE_DN, basedn);
+			PR_snprintf(buf, BUFSIZ, "%s %s", REASON_ANNOTATE_DN, basedn);
 			if (slapi_entry_attr_find (addentry, ATTR_NSDS5_REPLCONFLICT, &attr) == 0)
 			{
 				/* ATTR_NSDS5_REPLCONFLICT exists */
@@ -998,8 +998,7 @@ urp_get_min_naming_conflict_entry ( Slapi_PBlock *pb, char *sessionid, CSN *opcs
 	slapi_log_error ( SLAPI_LOG_REPL, sessionid,
 		"Enter urp_get_min_naming_conflict_entry for %s\n", basedn);
 
-	filter = slapi_ch_malloc(50 + strlen(basedn));
-	sprintf(filter, "(%s=%s %s)", ATTR_NSDS5_REPLCONFLICT, REASON_ANNOTATE_DN, basedn);
+	filter = PR_smprintf("(%s=%s %s)", ATTR_NSDS5_REPLCONFLICT, REASON_ANNOTATE_DN, basedn);
 
 	/* server_ctrls will be freed when newpb is destroyed */
 	server_ctrls = (LDAPControl **)slapi_ch_calloc (2, sizeof (LDAPControl *));
@@ -1058,7 +1057,9 @@ urp_get_min_naming_conflict_entry ( Slapi_PBlock *pb, char *sessionid, CSN *opcs
 
 done:
 	slapi_ch_free((void **)&parent_dn);
-	slapi_ch_free((void **)&filter);
+	if (filter) {
+		PR_smprintf_free(filter);
+	}
 	slapi_free_search_results_internal(newpb);
 	slapi_pblock_destroy(newpb);
 	newpb = NULL;
@@ -1239,7 +1240,7 @@ mod_namingconflict_attr (const char *uniqueid, const char *entrydn, const char *
 	char buf[BUFSIZ];
 	int op_result;
 
-	sprintf (buf, "%s %s", REASON_ANNOTATE_DN, conflictdn);
+	PR_snprintf (buf, sizeof(buf), "%s %s", REASON_ANNOTATE_DN, conflictdn);
 	slapi_mods_init (&smods, 2);
 	if ( strncmp (entrydn, SLAPI_ATTR_UNIQUEID, strlen(SLAPI_ATTR_UNIQUEID)) != 0 )
 	{
diff --git a/ldap/servers/plugins/replication/urp_glue.c b/ldap/servers/plugins/replication/urp_glue.c
index 86213393..42be4f27 100644
--- a/ldap/servers/plugins/replication/urp_glue.c
+++ b/ldap/servers/plugins/replication/urp_glue.c
@@ -153,10 +153,7 @@ do_create_glue_entry(const Slapi_RDN *rdn, const Slapi_DN *superiordn, const cha
 				rdnval, rdnval_len, LDIF_OPT_NOWRAP);
 		*rdnpair = '\0';
 	}	  
-	estr= slapi_ch_malloc(strlen(glue_entry) + slapi_sdn_get_ndn_len(sdn) +
-						  strlen(rdnstr) + strlen(uniqueid) +
-						  strlen(ATTR_NSDS5_REPLCONFLICT) + strlen(reason) + 1);
-	sprintf(estr, glue_entry, slapi_sdn_get_ndn(sdn), rdnstr, uniqueid, 
+	estr= slapi_ch_smprintf(glue_entry, slapi_sdn_get_ndn(sdn), rdnstr, uniqueid, 
 			ATTR_NSDS5_REPLCONFLICT, reason);
 	slapi_ch_free((void**)&rdnstr);
 	slapi_rdn_done(newrdn);
@@ -167,8 +164,8 @@ do_create_glue_entry(const Slapi_RDN *rdn, const Slapi_DN *superiordn, const cha
 	{
 		slapi_entry_set_uniqueid (e, slapi_ch_strdup(uniqueid));
 		op_result = urp_fixup_add_entry (e, NULL, NULL, opcsn, 0);
-		slapi_ch_free ( (void **) &estr ); /* XXXggood - this leaks if e == NULL */
 	}
+	slapi_ch_free_string(&estr);
 	slapi_sdn_free(&sdn);
 	return op_result;
 }
diff --git a/ldap/servers/plugins/retrocl/retrocl.c b/ldap/servers/plugins/retrocl/retrocl.c
index d6b7a12d..cf615609 100644
--- a/ldap/servers/plugins/retrocl/retrocl.c
+++ b/ldap/servers/plugins/retrocl/retrocl.c
@@ -45,7 +45,6 @@ Slapi_Backend *retrocl_be_changelog = NULL;
 static Slapi_PluginDesc retrocldesc = {"retrocl", PLUGIN_MAGIC_VENDOR_STR, PRODUCTTEXT, "Retrocl Plugin"};
 static Slapi_PluginDesc retroclpostopdesc = {"retrocl-postop", PLUGIN_MAGIC_VENDOR_STR, PRODUCTTEXT, "retrocl post-operation plugin"};
 static Slapi_PluginDesc retroclinternalpostopdesc = {"retrocl-internalpostop", PLUGIN_MAGIC_VENDOR_STR, PRODUCTTEXT, "retrocl internal post-operation plugin"};
-static Slapi_PluginDesc retroclbepostopdesc = {"retrocl-bepostop", PLUGIN_MAGIC_VENDOR_STR, PRODUCTTEXT, "Retrocl bepost-operation plugin"};
 
 
 /*
@@ -165,7 +164,7 @@ static int retrocl_select_backend(void)
     Slapi_Backend *be = NULL;
     Slapi_Entry *referral = NULL;
     Slapi_Operation *op = NULL;
-    char errbuf[1024];
+    char errbuf[BUFSIZ];
 
     pb = slapi_pblock_new();
 
diff --git a/ldap/servers/plugins/retrocl/retrocl_po.c b/ldap/servers/plugins/retrocl/retrocl_po.c
index c1fbd3d8..bc8110cb 100644
--- a/ldap/servers/plugins/retrocl/retrocl_po.c
+++ b/ldap/servers/plugins/retrocl/retrocl_po.c
@@ -128,7 +128,7 @@ write_replog_db(
     const char          *newsuperior
 )
 {
-    char		*pat, *edn;
+    char		*edn;
     struct berval	*vals[ 2 ];
     struct berval	val;
     Slapi_Entry		*e;
@@ -146,9 +146,7 @@ write_replog_db(
 	    changenum, ( dn == NULL ) ? "NULL" : dn );
 
     /* Construct the dn of this change record */
-    pat = "%s=%lu,%s";
-    edn = slapi_ch_malloc( strlen( pat ) + strlen( RETROCL_CHANGELOG_DN) + 20 );
-    sprintf( edn, pat, attr_changenumber, changenum, RETROCL_CHANGELOG_DN);
+    edn = slapi_ch_smprintf( "%s=%lu,%s", attr_changenumber, changenum, RETROCL_CHANGELOG_DN);
 
     /*
      * Create the entry struct, and fill in fields common to all types
diff --git a/ldap/servers/plugins/retrocl/retrocl_trim.c b/ldap/servers/plugins/retrocl/retrocl_trim.c
index c35f8cfe..92e75502 100644
--- a/ldap/servers/plugins/retrocl/retrocl_trim.c
+++ b/ldap/servers/plugins/retrocl/retrocl_trim.c
@@ -71,10 +71,7 @@ delete_changerecord( changeNumber cnum )
     char	*dnbuf;
     int		delrc;
 
-    dnbuf = slapi_ch_malloc( strlen( attr_changenumber ) + 20 + 
-			     strlen(RETROCL_CHANGELOG_DN));
-    /* Delete the record */
-    sprintf( dnbuf, "%s=%ld, %s", attr_changenumber, cnum, 
+    dnbuf = slapi_ch_smprintf("%s=%ld, %s", attr_changenumber, cnum, 
 	     RETROCL_CHANGELOG_DN);
     pb = slapi_pblock_new ();
     slapi_delete_internal_set_pb ( pb, dnbuf, NULL /*controls*/, NULL /* uniqueid */,
@@ -167,7 +164,7 @@ static Slapi_Entry *get_changerecord( changeNumber cnum, int *err )
 	return NULL;
     }
     crtp->crt_nentries = crtp->crt_err = 0; crtp->crt_entry = NULL;
-    sprintf( fstr, "%s=%ld", attr_changenumber, cnum );
+    PR_snprintf( fstr, sizeof(fstr), "%s=%ld", attr_changenumber, cnum );
     
     pb = slapi_pblock_new ();
     slapi_search_internal_set_pb (pb, RETROCL_CHANGELOG_DN, 
diff --git a/ldap/servers/plugins/rever/des.c b/ldap/servers/plugins/rever/des.c
index eee9d1b2..b9fb94fa 100644
--- a/ldap/servers/plugins/rever/des.c
+++ b/ldap/servers/plugins/rever/des.c
@@ -25,7 +25,8 @@
 #include <seccomon.h>
 #include <pk11func.h>
 
-#include "rever.h" 
+#define NEED_TOK_DES /* see slap.h - defines tokDes and ptokDes */
+#include "rever.h"
 #include <slap.h>
 #include "slapi-plugin.h"
 #include <uuid.h>
@@ -60,8 +61,6 @@ static SVRCOREError cryptPassword(struct pk11ContextStore *store, char * clear,
 static SVRCOREError decryptPassword(struct pk11ContextStore *store, unsigned char *cipher, char **out, int len);
 static void freeDes(struct pk11ContextStore *out);
 
-static int init = 0;
-
 void
 init_des_plugin()
 {
diff --git a/ldap/servers/plugins/roles/Makefile b/ldap/servers/plugins/roles/Makefile
index bbc97abd..5b26225b 100644
--- a/ldap/servers/plugins/roles/Makefile
+++ b/ldap/servers/plugins/roles/Makefile
@@ -84,9 +84,6 @@ endif
 $(OBJDEST):
 	$(MKDIR) $(OBJDEST)
 
-$(LIBDIR):
-	$(MKDIR) $(LIBDIR)
-
 # Target to push the built binary to an installed server
 #ROLES_PUSH = $(addprefix $(INSTDIR)lib/, $(notdir $(ROLES)))
 #push: $(ROLES_PUSH)
diff --git a/ldap/servers/plugins/roles/roles_cache.c b/ldap/servers/plugins/roles/roles_cache.c
index a4417335..59873b54 100644
--- a/ldap/servers/plugins/roles/roles_cache.c
+++ b/ldap/servers/plugins/roles/roles_cache.c
@@ -129,7 +129,6 @@ static void roles_cache_wait_on_change(void * arg);
 static void roles_cache_trigger_update_suffix(void *handle, char *be_name, int old_be_state, int new_be_state);
 static void roles_cache_trigger_update_role(char *dn, Slapi_Entry *role_entry, Slapi_DN *be_dn, int operation);
 static int roles_cache_update(roles_cache_def *suffix_to_update);
-static int roles_get_roles_from_entry(Slapi_DN * suffix, Slapi_PBlock **int_search_pb);
 static int roles_cache_create_role_under(roles_cache_def** roles_cache_suffix, Slapi_Entry *entry);
 static int roles_cache_create_object_from_entry(Slapi_Entry *role_entry, role_object **result, int hint);
 static int roles_cache_determine_class(Slapi_Entry *role_entry);
@@ -955,7 +954,7 @@ static int roles_cache_add_roles_from_suffix(Slapi_DN *suffix_dn, roles_cache_de
 	roles_cache_search_roles info;
 	Slapi_PBlock *int_search_pb = NULL;
 
-    slapi_log_error( SLAPI_LOG_PLUGIN, ROLES_PLUGIN_SUBSYSTEM, "--> roles_get_roles_from_entry\n");
+    slapi_log_error( SLAPI_LOG_PLUGIN, ROLES_PLUGIN_SUBSYSTEM, "--> roles_cache_add_roles_from_suffix\n");
 	
 	info.suffix_def = suffix_def;
 	info.rc = LDAP_NO_SUCH_OBJECT;
@@ -987,7 +986,7 @@ static int roles_cache_add_roles_from_suffix(Slapi_DN *suffix_dn, roles_cache_de
 		rc = 0;
 	}
 
-    slapi_log_error( SLAPI_LOG_PLUGIN, ROLES_PLUGIN_SUBSYSTEM, "<-- roles_get_roles_from_entry\n");
+    slapi_log_error( SLAPI_LOG_PLUGIN, ROLES_PLUGIN_SUBSYSTEM, "<-- roles_cache_add_roles_from_suffix\n");
 
 	return(rc);
 }
@@ -1391,9 +1390,7 @@ static int roles_cache_object_nested_from_dn(Slapi_DN *role_dn, role_object_nest
 int roles_cache_listroles(Slapi_Entry *entry, int return_values, Slapi_ValueSet **valueset_out)
 {
     roles_cache_def *roles_cache = NULL;
-	role_object *this_role = NULL;
     int rc = 0;
-    Avlnode * tree = NULL;
 	roles_cache_build_result arg;
 	Slapi_Backend *backend = NULL;
  
@@ -1946,8 +1943,6 @@ static void roles_cache_role_def_delete(roles_cache_def *role_def)
 */
 static void roles_cache_role_def_free(roles_cache_def *role_def)
 {
-	roles_cache_def *next_def = NULL;
-
 	slapi_log_error(SLAPI_LOG_PLUGIN, 
 					ROLES_PLUGIN_SUBSYSTEM, "--> roles_cache_role_def_free\n");
 	if ( role_def == NULL )
diff --git a/ldap/servers/plugins/roles/roles_plugin.c b/ldap/servers/plugins/roles/roles_plugin.c
index 0b4785ce..77019761 100644
--- a/ldap/servers/plugins/roles/roles_plugin.c
+++ b/ldap/servers/plugins/roles/roles_plugin.c
@@ -186,13 +186,20 @@ int roles_sp_get_value(vattr_sp_handle *handle,
 
 int roles_sp_compare_value(vattr_sp_handle *handle, vattr_context *c, Slapi_Entry *e, char *type, Slapi_Value *test_this, int* result,int flags, void *hint)
 {
-	int rc = 0;
+	int rv;
 	Slapi_DN the_dn;
 
 	/* Extract the role's DN from the value passed in */
+	/* possible problem here - slapi_value_get_string returns a pointer to the
+	   raw bv_val in the value, which is not guaranteed to be null terminated,
+	   but probably is for any value passed into this function */
 	slapi_sdn_init_dn_byref(&the_dn,slapi_value_get_string(test_this));
 
-	return (roles_check(e,&the_dn,result));
+	rv = roles_check(e,&the_dn,result);
+
+	slapi_sdn_done(&the_dn);
+
+	return rv;
 }
 
 int roles_sp_list_types(vattr_sp_handle *handle,Slapi_Entry *e,vattr_type_list_context *type_context,int flags)
diff --git a/ldap/servers/plugins/shared/utils.c b/ldap/servers/plugins/shared/utils.c
index 93bbed3a..cd9efc6c 100644
--- a/ldap/servers/plugins/shared/utils.c
+++ b/ldap/servers/plugins/shared/utils.c
@@ -21,6 +21,7 @@
 ***********************************************************************/
 
 #include "plugin-utils.h"
+#include "nspr.h"
 
 static char *plugin_name = "utils";
 
@@ -129,17 +130,17 @@ entryHasObjectClass(Slapi_PBlock *pb, Slapi_Entry *e,
 Slapi_PBlock *
 dnHasObjectClass( const char *baseDN, const char *objectClass ) {
 	int result = 0;
+	char *filter = NULL;
 	Slapi_PBlock *spb = NULL;
 
 	BEGIN
 		Slapi_Entry **entries;
-		char filter[1024];
 		char *attrs[2];
 
 		/* Perform the search - the new pblock needs to be freed */
 		attrs[0] = "objectclass";
 		attrs[1] = NULL;
-		sprintf( filter, "objectclass=%s", objectClass );
+		filter = PR_smprintf("objectclass=%s", objectClass );
 		if ( !(spb = readPblockAndEntry( baseDN, filter, attrs) ) ) {
 			break;
 		}
@@ -161,6 +162,9 @@ dnHasObjectClass( const char *baseDN, const char *objectClass ) {
 		}
     END
 
+	if (filter) {
+		PR_smprintf_free(filter);
+	}
 	return spb;
 }
 
@@ -174,17 +178,17 @@ Slapi_PBlock *
 dnHasAttribute( const char *baseDN, const char *attrName ) {
 	int result = 0;
 	Slapi_PBlock *spb = NULL;
+	char *filter = NULL;
 
 	BEGIN
         int sres;
 		Slapi_Entry **entries;
-		char filter[1024];
 		char *attrs[2];
 
 		/* Perform the search - the new pblock needs to be freed */
 		attrs[0] = (char *)attrName;
 		attrs[1] = NULL;
-		sprintf( filter, "%s=*", attrName );
+		filter = PR_smprintf( "%s=*", attrName );
 		spb = slapi_search_internal((char *)baseDN, LDAP_SCOPE_BASE,
 									filter, NULL, attrs, 0);
 		if ( !spb ) {
@@ -217,6 +221,9 @@ dnHasAttribute( const char *baseDN, const char *attrName ) {
 		}
     END
 
+	if (filter) {
+		PR_smprintf_free(filter);
+	}
 	return spb;
 }
 
diff --git a/ldap/servers/plugins/statechange/Makefile b/ldap/servers/plugins/statechange/Makefile
index f082af3b..e2efb1c1 100644
--- a/ldap/servers/plugins/statechange/Makefile
+++ b/ldap/servers/plugins/statechange/Makefile
@@ -73,6 +73,3 @@ endif
 
 $(OBJDEST):
 	$(MKDIR) $(OBJDEST)
-
-$(LIBDIR):
-	$(MKDIR) $(LIBDIR)
diff --git a/ldap/servers/plugins/statechange/statechange.c b/ldap/servers/plugins/statechange/statechange.c
index c0e21b4b..7730595a 100644
--- a/ldap/servers/plugins/statechange/statechange.c
+++ b/ldap/servers/plugins/statechange/statechange.c
@@ -330,7 +330,7 @@ static void *_statechange_unregister(char *dn, char *filter, notify_callback the
 
 	slapi_lock_mutex(buffer_lock);
 
-	if(func = statechange_find_notify(dn, filter, thefunc))
+	if((func = statechange_find_notify(dn, filter, thefunc)))
 	{
 		func->prev->next = func->next;
 		func->next->prev = func->prev;
diff --git a/ldap/servers/plugins/uiduniq/7bit.c b/ldap/servers/plugins/uiduniq/7bit.c
index c7448078..15081a90 100644
--- a/ldap/servers/plugins/uiduniq/7bit.c
+++ b/ldap/servers/plugins/uiduniq/7bit.c
@@ -77,7 +77,6 @@ static void
 issue_error(Slapi_PBlock *pb, int result, char *type, char *value)
 {
   char *moreinfop;
-  int sz;
 
   slapi_log_error(SLAPI_LOG_PLUGIN, plugin_name,
       "%s result %d\n", type, result);
@@ -85,9 +84,7 @@ issue_error(Slapi_PBlock *pb, int result, char *type, char *value)
   if (value == NULL) {
     value = "unknown";
   }
-  sz = strlen(moreInfo) + strlen(value) + 1;
-  moreinfop = (char *)slapi_ch_malloc(sz);
-  sprintf(moreinfop, "%s%s", moreInfo, value);
+  moreinfop = slapi_ch_smprintf("%s%s", moreInfo, value);
 
   /* Send failure to the client */
   slapi_send_ldap_result(pb, result, 0, moreinfop, 0, 0);
diff --git a/ldap/servers/plugins/uiduniq/uid.c b/ldap/servers/plugins/uiduniq/uid.c
index 2d1c69b0..e8698a68 100644
--- a/ldap/servers/plugins/uiduniq/uid.c
+++ b/ldap/servers/plugins/uiduniq/uid.c
@@ -443,7 +443,7 @@ findSubtreeAndSearch(char *parentDN, const char *attrName, Slapi_Attr *attr,
 
   while (NULL != (parentDN = slapi_dn_parent(parentDN)))
   {
-        if (spb = dnHasObjectClass(parentDN, markerObjectClass))
+        if ((spb = dnHasObjectClass(parentDN, markerObjectClass)))
         {
           freePblock(spb);
           /*
diff --git a/ldap/servers/plugins/views/Makefile b/ldap/servers/plugins/views/Makefile
index 678a0290..e6e4282c 100644
--- a/ldap/servers/plugins/views/Makefile
+++ b/ldap/servers/plugins/views/Makefile
@@ -74,6 +74,3 @@ endif
 
 $(OBJDEST):
 	$(MKDIR) $(OBJDEST)
-
-$(LIBDIR):
-	$(MKDIR) $(LIBDIR)
diff --git a/ldap/servers/plugins/views/views.c b/ldap/servers/plugins/views/views.c
index 86c2f758..8d7d903f 100644
--- a/ldap/servers/plugins/views/views.c
+++ b/ldap/servers/plugins/views/views.c
@@ -380,7 +380,6 @@ static int views_close( Slapi_PBlock *pb )
 static int views_cache_create()
 {
 	int ret = -1;
-	static int firstTime = 1;
 
 	slapi_log_error( SLAPI_LOG_TRACE, VIEWS_PLUGIN_SUBSYSTEM, "--> views_cache_create\n");
 
@@ -704,8 +703,6 @@ static void views_cache_create_applied_filter(viewEntry *pView)
 	Slapi_Filter *pCurrentFilter = 0;
 	Slapi_Filter *pBuiltFilter = 0;
 	Slapi_Filter *pViewEntryExcludeFilter = 0;
-	char *buf = 0;
-	int len = 0;
 
 	if(pView->includeAncestorFiltersFilter)
 	{
@@ -763,17 +760,13 @@ static void views_cache_create_applied_filter(viewEntry *pView)
  */
 static void views_cache_create_exclusion_filter(viewEntry *pView)
 {
+/*
 	viewEntry *current = pView;
 	Slapi_Filter *pOrSubFilter = 0;
-	Slapi_Filter *excludeChildFiltersFilter = 0;
-	Slapi_Filter *pChildExcludeSubFilter = 0;
-	Slapi_Filter *pViewEntryExcludeFilter = 0;
 	int child_count = 0;
-	int len = 0;
+*/
+	Slapi_Filter *excludeChildFiltersFilter = 0;
 	char *buf = 0;
-	Slapi_RDN *rdn = 0;
-	char *str_rdn = 0;
-	Slapi_Filter *pCurrentFilter = 0;
 
 	/* create exclusion filter for one level searches
 	 * this requires the rdns of the grandchildren of
@@ -853,12 +846,14 @@ Slapi_Filter *views_cache_create_descendent_filter(viewEntry *ancestor, PRBool u
 	while(child_count < ancestor->child_count)
 	{
 		Slapi_Filter *pDescendentSubFilter = 0;
+/*
 		Slapi_RDN *rdn = 0;
 		char *str_rdn = 0;
+		int len = 0;
+*/
 		Slapi_Filter *pCurrentFilter = 0;
 		viewEntry *currentChild = ancestor->pChildren[child_count];
 		char *buf = 0;
-		int len = 0;
 
 		/* for each child we need to add its descendants
 		 * we do this now before processing this view
@@ -920,7 +915,9 @@ Slapi_Filter *views_cache_create_descendent_filter(viewEntry *ancestor, PRBool u
  */
 static void views_cache_create_inclusion_filter(viewEntry *pView)
 {
+#if 0
 	viewEntry *head = theCache.pCacheViews;
+#endif
 /*	viewEntry *current; */
 /*	Slapi_Filter *view_filter; */
 	char *view_filter_str;
@@ -950,7 +947,7 @@ static void views_cache_create_inclusion_filter(viewEntry *pView)
 		slapi_sdn_get_rdn(viewDN,viewRDN);
 		viewRDNstr = (char *)slapi_rdn_get_rdn(viewRDN);
 
-		buf = calloc(1, strlen(viewRDNstr) + 11 ); /* 3 for filter */
+		buf = slapi_ch_calloc(1, strlen(viewRDNstr) + 11 ); /* 3 for filter */
 		sprintf(buf, "(%s)", viewRDNstr );
 		viewSubFilter = slapi_str2filter( buf );
 		
@@ -1050,8 +1047,6 @@ static int views_cache_build_view_list(viewEntry **pViews)
 	char *attrs[2];
 	int suffixIndex = 0;
 	int valIndex = 0;
-	int cos_def_available = 0;
-	static int firstTime = 1;
 
 	slapi_log_error(SLAPI_LOG_TRACE, VIEWS_PLUGIN_SUBSYSTEM, "--> views_cache_build_view_list\n");
 
@@ -1141,7 +1136,6 @@ struct dn_views_info {
 
 static int	views_dn_views_cb (Slapi_Entry* e, void *callback_data) {
 	struct dn_views_info *info;
-	char *filter = 0;
 	char *pDn = 0;
 	struct berval **dnVals;
 	Slapi_Attr *dnAttr;
diff --git a/ldap/servers/slapd/add.c b/ldap/servers/slapd/add.c
index 320bf2a0..0d4f7853 100644
--- a/ldap/servers/slapd/add.c
+++ b/ldap/servers/slapd/add.c
@@ -110,7 +110,6 @@ do_add( Slapi_PBlock *pb )
 		if ( !normtype || !*normtype ) {
 			rc = LDAP_INVALID_SYNTAX;
 			PR_snprintf (ebuf, BUFSIZ, "invalid type '%s'", type);
-			ebuf[BUFSIZ-1] = '\0';
 			op_shared_log_error_access (pb, "ADD", slapi_sdn_get_dn (slapi_entry_get_sdn_const(e)), ebuf);
 			send_ldap_result( pb, rc, NULL, ebuf, 0, NULL );
 			free( type );
diff --git a/ldap/servers/slapd/attr.c b/ldap/servers/slapd/attr.c
index 0e07fa1d..112d5caf 100644
--- a/ldap/servers/slapd/attr.c
+++ b/ldap/servers/slapd/attr.c
@@ -245,9 +245,7 @@ slapi_attr_init_locking_optional(Slapi_Attr *a, const char *type, PRBool use_loc
 				char	*normalized_options;
 
 				normalized_options = attr_syntax_normalize_no_lookup( attroptions );
-				a->a_type = slapi_ch_malloc( strlen(asi->asi_name)
-						+ strlen(normalized_options) +1 );
-				sprintf( a->a_type, "%s%s", asi->asi_name, normalized_options );
+				a->a_type = slapi_ch_smprintf("%s%s", asi->asi_name, normalized_options );
 				slapi_ch_free_string( &normalized_options );
 			}
 		}
diff --git a/ldap/servers/slapd/auth.c b/ldap/servers/slapd/auth.c
index 92643cf9..2b0828d4 100644
--- a/ldap/servers/slapd/auth.c
+++ b/ldap/servers/slapd/auth.c
@@ -267,7 +267,7 @@ client_auth_init ()
     	*val = '\0';
     } 
 
-    strcpy(netsite_root, instancedir);
+    PL_strncpyz(netsite_root, instancedir, MAXPATHLEN);
     slapi_ch_free_string(&instancedir);
     filename = PR_smprintf("%s%s", netsite_root, client_auth_config_file);
 
diff --git a/ldap/servers/slapd/back-ldbm/archive.c b/ldap/servers/slapd/back-ldbm/archive.c
index 58460a84..e3eb0152 100644
--- a/ldap/servers/slapd/back-ldbm/archive.c
+++ b/ldap/servers/slapd/back-ldbm/archive.c
@@ -165,9 +165,7 @@ int ldbm_back_archive2ldbm( Slapi_PBlock *pb )
                 c = *p;
                 *p = '\0';
             }
-            bakup_dir = (char *)slapi_ch_malloc(strlen(directory) + 
-                                                 sizeof("tmp") + 13);
-            sprintf(bakup_dir, "%s%ctmp_%010d", directory, c, time(0));
+            bakup_dir = slapi_ch_smprintf("%s%ctmp_%010d", directory, c, time(0));
             LDAPDebug( LDAP_DEBUG_ANY,
                       "archive2db: backup dir: %s\n", bakup_dir, 0, 0);
             *p = c;
diff --git a/ldap/servers/slapd/back-ldbm/dblayer.c b/ldap/servers/slapd/back-ldbm/dblayer.c
index 9d4aa094..34bb51ba 100644
--- a/ldap/servers/slapd/back-ldbm/dblayer.c
+++ b/ldap/servers/slapd/back-ldbm/dblayer.c
@@ -544,6 +544,7 @@ static void dblayer_select_ncache(size_t cachesize, int *ncachep)
    the maximum chunk size, then we should use that instead.
    For now we just guess in dblayer_pick_ncache().
  */
+#if 0
 static void dblayer_get_ncache(size_t cachesize, int *ncachep)
 {
     int myncache;
@@ -597,6 +598,7 @@ cleanup:
     slapi_ch_free((void **)&head);
     return;
 }
+#endif
 
 static void dblayer_init_dbenv(DB_ENV *pEnv, dblayer_private *priv)
 {
@@ -921,7 +923,7 @@ static int dblayer_grok_directory(char *directory, int flags)
         {
             break;
         }
-        sprintf(filename,"%s/%s",directory,direntry->name);
+        PR_snprintf(filename, MAXPATHLEN, "%s/%s",directory,direntry->name);
         
         /* Right now this is set up to only look at files here. 
          * With multiple instances of the backend the are now other directories
@@ -1003,7 +1005,7 @@ dblayer_inst_exists(ldbm_instance *inst, char *dbname)
         dbnamep = dbname;
     else
         dbnamep = ID2ENTRY LDBM_FILENAME_SUFFIX;
-    sprintf(id2entry_file, "%s%c%s%c%s", parent_dir, sep, inst->inst_dir_name,
+    PR_snprintf(id2entry_file, sizeof(id2entry_file), "%s%c%s%c%s", parent_dir, sep, inst->inst_dir_name,
                                          sep, dbnamep);
     prst = PR_Access(id2entry_file, PR_ACCESS_EXISTS);
     if (PR_SUCCESS == prst)
@@ -1014,7 +1016,6 @@ dblayer_inst_exists(ldbm_instance *inst, char *dbname)
 /*
  * create a new DB_ENV and fill it with the goodies from dblayer_private
  */
-#define INIT_MAX_DIRS 32
 static int 
 dblayer_make_env(struct dblayer_private_env **env, struct ldbminfo *li)
 {
@@ -1022,7 +1023,6 @@ dblayer_make_env(struct dblayer_private_env **env, struct ldbminfo *li)
     struct dblayer_private_env *pEnv;
     char *home_dir = NULL;
     int ret;
-    int data_dirs = INIT_MAX_DIRS;
     Object *inst_obj;
     ldbm_instance *inst = NULL;
 
@@ -1753,9 +1753,7 @@ int dblayer_instance_start(backend *be, int mode)
         char *subname;
         struct dblayer_private_env *mypEnv;
 
-        id2entry_file = slapi_ch_malloc(strlen(inst->inst_dir_name) +
-                                     strlen(ID2ENTRY LDBM_FILENAME_SUFFIX) + 2);
-        sprintf(id2entry_file, "%s/%s", inst->inst_dir_name, 
+        id2entry_file = slapi_ch_smprintf("%s/%s", inst->inst_dir_name, 
                 ID2ENTRY LDBM_FILENAME_SUFFIX);
 
         open_flags = DB_CREATE | DB_THREAD;
@@ -1877,13 +1875,9 @@ int dblayer_instance_start(backend *be, int mode)
             !dblayer_inst_exists(inst, NULL))
         {
             char *abs_id2entry_file = NULL;
-            int abs_len;
             /* create a file with abs path, then try again */
 
-            abs_len = strlen(inst_dirp) +
-                      strlen(ID2ENTRY LDBM_FILENAME_SUFFIX) + 2;
-            abs_id2entry_file = (char *)slapi_ch_malloc(abs_len);
-            sprintf(abs_id2entry_file, "%s%c%s", inst_dirp, 
+            abs_id2entry_file = slapi_ch_smprintf( "%s%c%s", inst_dirp, 
                     get_sep(inst_dirp), ID2ENTRY LDBM_FILENAME_SUFFIX);
             DB_OPEN(mypEnv->dblayer_openflags,
                 dbp, NULL/* txnid */, abs_id2entry_file, subname, DB_BTREE,
@@ -2054,8 +2048,7 @@ int dblayer_get_aux_id2entry(backend *be, DB **ppDB, DB_ENV **ppEnv)
 
     inst_dirp = dblayer_get_full_inst_dir(li, inst, inst_dir, MAXPATHLEN);
     priv->dblayer_home_directory =
-            slapi_ch_malloc(strlen(inst_dirp) + strlen("dbenv") + 2);
-    sprintf(priv->dblayer_home_directory, "%s/dbenv", inst_dirp);
+            slapi_ch_smprintf("%s/dbenv", inst_dirp);
     priv->dblayer_log_directory = slapi_ch_strdup(priv->dblayer_home_directory);
 
     prst = PR_GetFileInfo(inst_dirp, &prfinfo);
@@ -2126,9 +2119,7 @@ int dblayer_get_aux_id2entry(backend *be, DB **ppDB, DB_ENV **ppEnv)
         goto err;
     }
 
-    id2entry_file = slapi_ch_malloc(strlen(inst->inst_dir_name) +
-                                     strlen(ID2ENTRY LDBM_FILENAME_SUFFIX) + 2);
-    sprintf(id2entry_file, "%s/%s",
+    id2entry_file = slapi_ch_smprintf("%s/%s",
         inst->inst_dir_name, ID2ENTRY LDBM_FILENAME_SUFFIX);
 
     PR_ASSERT(dblayer_inst_exists(inst, NULL));
@@ -2183,16 +2174,17 @@ int dblayer_release_aux_id2entry(backend *be, DB *pDB, DB_ENV *pEnv)
 
     inst_dirp = dblayer_get_full_inst_dir(inst->inst_li, inst,
                                           inst_dir, MAXPATHLEN);
-    envdir = slapi_ch_malloc(strlen(inst_dirp) + strlen("dbenv") + 2);
-    sprintf(envdir, "%s/dbenv", inst_dirp);
+    envdir = slapi_ch_smprintf("%s/dbenv", inst_dirp);
 
 done:
     if (pDB)
        pDB->close(pDB, 0);
     if (pEnv)
        pEnv->close(pEnv, 0);
-    if (envdir)
+    if (envdir) {
         ldbm_delete_dirs(envdir);
+		slapi_ch_free_string(&envdir);
+	}
     if (inst_dirp != inst_dir)
         slapi_ch_free_string(&inst_dirp);
     return 0;
@@ -2462,7 +2454,6 @@ int dblayer_open_file(backend *be, char* indexname, int open_flag, int index_fla
     char *rel_path = NULL;
     dblayer_private_env *pENV = 0;
     dblayer_private *priv = NULL;
-    int len;
     int return_value = 0;
     DB *dbp = NULL;
     char *subname = NULL;
@@ -2491,18 +2482,14 @@ int dblayer_open_file(backend *be, char* indexname, int open_flag, int index_fla
             return -1;
         }
     }
-    len = strlen(indexname) + strlen(LDBM_FILENAME_SUFFIX) + 1;
-    file_name = slapi_ch_malloc(len);
-    len += strlen(inst->inst_dir_name) + 1;
-    rel_path = slapi_ch_malloc(len);
 
     pENV = priv->dblayer_env;
     if (inst->import_env)
         pENV = inst->import_env;
 
     PR_ASSERT(NULL != pENV);
-    sprintf(file_name, "%s%s", indexname, LDBM_FILENAME_SUFFIX);
-    sprintf(rel_path, "%s/%s", inst->inst_dir_name, file_name);
+    file_name = slapi_ch_smprintf("%s%s", indexname, LDBM_FILENAME_SUFFIX);
+    rel_path = slapi_ch_smprintf("%s/%s", inst->inst_dir_name, file_name);
 
     open_flags = DB_THREAD;
     if (open_flag & DBOPEN_CREATE)
@@ -2582,13 +2569,10 @@ int dblayer_open_file(backend *be, char* indexname, int open_flag, int index_fla
         char inst_dir[MAXPATHLEN];
         char *inst_dirp = NULL;
         char *abs_file_name = NULL;
-        int abs_len;
         /* create a file with abs path, then try again */
 
         inst_dirp = dblayer_get_full_inst_dir(li, inst, inst_dir, MAXPATHLEN);
-        abs_len = strlen(inst_dirp) + strlen(file_name) + 2;
-        abs_file_name = (char *)slapi_ch_malloc(abs_len);
-        sprintf(abs_file_name, "%s%c%s",
+        abs_file_name = slapi_ch_smprintf("%s%c%s",
                 inst_dirp, get_sep(inst_dirp), file_name);
         DB_OPEN(pENV->dblayer_openflags,
                 dbp, NULL/* txnid */, abs_file_name, subname, DB_BTREE,
@@ -3476,14 +3460,14 @@ static int checkpoint_threadmain(void *param)
                 /* zap 'em ! */
                 for (listp = list; *listp != NULL; ++listp)
                 {    
-                    sprintf(filename,"%s/%s",prefix,*listp);
+                    PR_snprintf(filename,sizeof(filename),"%s/%s",prefix,*listp);
                     if (priv->dblayer_circular_logging) {
                         checkpoint_debug_message(debug_checkpointing,
                             "Deleting %s\n",filename, 0, 0);
                         unlink(filename);    
                     } else {
                         char new_filename[MAXPATHLEN];
-                        sprintf(new_filename,"%s/old.%s",
+                        PR_snprintf(new_filename,sizeof(new_filename),"%s/old.%s",
                                 prefix,*listp);
                         checkpoint_debug_message(debug_checkpointing,
                             "Renaming %s\n",filename,0, 0);
@@ -3760,7 +3744,7 @@ static int commit_good_database(dblayer_private *priv)
     int return_value = 0;
     int num_bytes;
 
-    sprintf(filename,"%s/guardian",priv->dblayer_home_directory);
+    PR_snprintf(filename,sizeof(filename), "%s/guardian",priv->dblayer_home_directory);
 
     prfd = PR_Open(filename, PR_RDWR | PR_CREATE_FILE | PR_TRUNCATE,
         priv->dblayer_file_mode );
@@ -3770,7 +3754,7 @@ static int commit_good_database(dblayer_private *priv)
             filename, PR_GetError(), slapd_pr_strerror(PR_GetError()) );
         return -1;
     } 
-    sprintf(line,"cachesize:%lu\nncache:%d\nversion:%d\n",
+    PR_snprintf(line,sizeof(line),"cachesize:%lu\nncache:%d\nversion:%d\n",
             priv->dblayer_cachesize, priv->dblayer_ncache, 3);
     num_bytes = strlen(line);
     return_value = slapi_write_buffer(prfd, line, num_bytes);
@@ -3814,7 +3798,7 @@ static int read_metadata(struct ldbminfo *li)
     priv->dblayer_previous_cachesize = 0;
     priv->dblayer_previous_ncache = 0;
     /* Open the guard file and read stuff, then delete it */
-    sprintf(filename,"%s/guardian",priv->dblayer_home_directory);
+    PR_snprintf(filename,sizeof(filename),"%s/guardian",priv->dblayer_home_directory);
 
     memset(&prfinfo, '\0', sizeof(PRFileInfo));
     (void)PR_GetFileInfo(filename, &prfinfo);
@@ -4042,7 +4026,7 @@ static int _dblayer_delete_instance_dir(ldbm_instance *inst, int startdb)
                                           PR_SKIP_DOT_DOT))) {
         if (! direntry->name)
             break;
-        sprintf(filename, "%s/%s", inst_dirp, direntry->name);
+        PR_snprintf(filename, MAXPATHLEN, "%s/%s", inst_dirp, direntry->name);
         if (pEnv &&
             strcmp(LDBM_FILENAME_SUFFIX , last_four_chars(direntry->name)) == 0)
         {
@@ -4153,7 +4137,7 @@ int dblayer_delete_database_ex(struct ldbminfo *li, char *instance)
         if (! direntry->name)
             break;
 
-		sprintf(filename, "%s/%s", priv->dblayer_home_directory, 
+		PR_snprintf(filename, MAXPATHLEN, "%s/%s", priv->dblayer_home_directory, 
 			direntry->name);
 
 		/* Do not call PR_Delete on the instance directories if they exist.
@@ -4244,7 +4228,7 @@ int dblayer_database_size(struct ldbminfo *li, unsigned int *size)
             {
                 break;
             }
-            sprintf(filename,"%s/%s",priv->dblayer_home_directory,direntry->name);
+            PR_snprintf(filename,MAXPATHLEN, "%s/%s",priv->dblayer_home_directory,direntry->name);
             return_value = PR_GetFileInfo(filename, &info);
             if (PR_SUCCESS == return_value)
             {
@@ -4292,9 +4276,7 @@ static int count_dbfiles_in_dir(char *directory, int *count, int recurse)
             if (NULL == direntry->name) {
                 break;
             }
-            direntry_name = slapi_ch_malloc(strlen(directory) +
-                                            strlen(direntry->name) + 2);
-            sprintf(direntry_name, "%s/%s", directory, direntry->name);
+            direntry_name = PR_smprintf("%s/%s", directory, direntry->name);
             if ((PR_GetFileInfo(direntry_name, &info) == PR_SUCCESS) &&
                 (PR_FILE_DIRECTORY == info.type) && recurse) {
                 /* Recurse into this directory but not any further.  This is
@@ -4303,7 +4285,9 @@ static int count_dbfiles_in_dir(char *directory, int *count, int recurse)
                  * not be any more directories in an instance directory. */
                 count_dbfiles_in_dir(direntry_name, count, 0 /* don't recurse */);
             }
-            slapi_ch_free((void**)&direntry_name);
+			if (direntry_name) {
+				PR_smprintf_free(direntry_name);
+			}
             if (strcmp( LDBM_FILENAME_SUFFIX , last_four_chars(direntry->name)) == 0) {
                 (*count)++;
             }
@@ -4481,8 +4465,7 @@ int dblayer_copy_directory(struct ldbminfo *li,
         sep = get_sep(inst_dirp);
         if (*(inst_dirp+len-1) == sep)
             sep = '\0';
-        new_src_dir = (char *)slapi_ch_malloc(strlen(src_dir) + len + 2);
-        sprintf(new_src_dir, "%s%c%s", inst_dirp, sep, src_dir);
+        new_src_dir = slapi_ch_smprintf("%s%c%s", inst_dirp, sep, src_dir);
     }
 
     dirhandle = PR_OpenDir(new_src_dir);
@@ -4529,14 +4512,11 @@ int dblayer_copy_directory(struct ldbminfo *li,
                     mysep = get_sep(prefix);
                 }
 
-                new_dest_dir = slapi_ch_malloc(strlen(dest_dir) +
-                                   strlen(relative_instance_name) + 
-                                   strlen(prefix) + 3);
                 if (mysep)
-                    sprintf(new_dest_dir, "%s%c%s%c%s",
+                    new_dest_dir = slapi_ch_smprintf("%s%c%s%c%s",
                         prefix, mysep, dest_dir, mysep, relative_instance_name);
                 else
-                    sprintf(new_dest_dir, "%s/%s",
+                    new_dest_dir = slapi_ch_smprintf("%s/%s",
                         dest_dir, relative_instance_name);
                 /* } */
                 if (PR_SUCCESS == PR_GetFileInfo(new_dest_dir, &info))
@@ -4553,12 +4533,8 @@ int dblayer_copy_directory(struct ldbminfo *li,
                 }
             }
 
-            filename1 = slapi_ch_malloc(strlen(new_src_dir) +
-                                        strlen(direntry->name) + 2);
-            sprintf(filename1, "%s/%s", new_src_dir, direntry->name);
-            filename2 = slapi_ch_malloc(strlen(new_dest_dir) +
-                                        strlen(direntry->name) + 2);
-            sprintf(filename2, "%s/%s", new_dest_dir, direntry->name);
+            filename1 = slapi_ch_smprintf("%s/%s", new_src_dir, direntry->name);
+            filename2 = slapi_ch_smprintf("%s/%s", new_dest_dir, direntry->name);
 
             if (restore) {
                 LDAPDebug(LDAP_DEBUG_ANY, "Restoring file %d (%s)\n",
@@ -4763,6 +4739,7 @@ int dblayer_backup(struct ldbminfo *li, char *dest_dir, Slapi_Task *task)
             }
 
             if (ok) {
+				size_t p1len, p2len;
                 char **listptr;
                 
                 prefix = NULL;
@@ -4773,14 +4750,14 @@ int dblayer_backup(struct ldbminfo *li, char *dest_dir, Slapi_Task *task)
                     prefix = home_dir;
                 }
                 /* log files have the same filename len(100 is a safety net:) */
-                pathname1 = (char *)slapi_ch_malloc(strlen(prefix) +
-                    strlen(*listB) + 100);
-                pathname2 = (char *)slapi_ch_malloc(strlen(dest_dir) +
-                    strlen(*listB) + 100);
+				p1len = strlen(prefix) + strlen(*listB) + 100;
+                pathname1 = (char *)slapi_ch_malloc(p1len);
+				p2len = strlen(dest_dir) + strlen(*listB) + 100;
+                pathname2 = (char *)slapi_ch_malloc(p2len);
                 /* We copy those over */
                 for (listptr = listB; (*listptr) && ok; ++listptr) {
-                    sprintf(pathname1, "%s/%s", prefix, *listptr);
-                    sprintf(pathname2, "%s/%s", dest_dir, *listptr);
+                    PR_snprintf(pathname1, p1len, "%s/%s", prefix, *listptr);
+                    PR_snprintf(pathname2, p2len, "%s/%s", dest_dir, *listptr);
                     LDAPDebug(LDAP_DEBUG_ANY, "Backing up file %d (%s)\n",
                         cnt, pathname2, 0);
                     if (task)
@@ -4831,12 +4808,8 @@ int dblayer_backup(struct ldbminfo *li, char *dest_dir, Slapi_Task *task)
     }
 
     /* now copy the version file */
-    pathname1 = (char *)slapi_ch_malloc(strlen(home_dir) +
-                                        strlen(DBVERSION_FILENAME) + 2);
-    pathname2 = (char *)slapi_ch_malloc(strlen(dest_dir) +
-                                        strlen(DBVERSION_FILENAME) + 2);
-    sprintf(pathname1, "%s/%s", home_dir, DBVERSION_FILENAME);
-    sprintf(pathname2, "%s/%s", dest_dir, DBVERSION_FILENAME);
+    pathname1 = slapi_ch_smprintf("%s/%s", home_dir, DBVERSION_FILENAME);
+    pathname2 = slapi_ch_smprintf("%s/%s", dest_dir, DBVERSION_FILENAME);
     LDAPDebug(LDAP_DEBUG_ANY, "Backing up file %d (%s)\n",
               cnt, pathname2, 0);
     if (task) {
@@ -4914,7 +4887,7 @@ int dblayer_delete_transaction_logs(const char * log_dir)
                 PR_GetError(),slapd_pr_strerror(PR_GetError()), 0);
                 break;
             }
-            sprintf(filename1, "%s/%s", log_dir, direntry->name);
+            PR_snprintf(filename1, MAXPATHLEN, "%s/%s", log_dir, direntry->name);
             pre = PR_GetFileInfo(filename1, &info);
             if (pre == PR_SUCCESS && PR_FILE_DIRECTORY == info.type) {
                 continue;
@@ -4981,8 +4954,8 @@ static int dblayer_copy_dirand_contents(char* src_dir, char* dst_dir, int mode,
       }
 
 
-       sprintf(filename1, "%s/%s", src_dir, direntry->name);
-       sprintf(filename2, "%s/%s", dst_dir, direntry->name);
+       PR_snprintf(filename1, MAXPATHLEN, "%s/%s", src_dir, direntry->name);
+       PR_snprintf(filename2, MAXPATHLEN, "%s/%s", dst_dir, direntry->name);
        LDAPDebug(LDAP_DEBUG_ANY, "Moving file %s\n",
                           filename2, 0, 0);
       /* Is this entry a directory? */
@@ -5040,7 +5013,7 @@ static int dblayer_fri_trim(char *fri_dir_path, char* bename)
 			break;
 			}
 
-			sprintf(filename, "%s/%s", fri_dir_path, direntry->name);
+			PR_snprintf(filename, MAXPATHLEN, "%s/%s", fri_dir_path, direntry->name);
 
 			/* Is this entry a directory? */
 			tmp_rval = PR_GetFileInfo(filename, &info);
@@ -5092,7 +5065,6 @@ error:
 static int dblayer_fri_restore(char *home_dir, char *src_dir, dblayer_private *priv, Slapi_Task *task, char** new_src_dir, char* bename)
 {
 		int retval = 0;
-		size_t fribak_dir_length = 0;
 		char *fribak_dir_path = NULL;
 		char *fribak_dir_name = "fribak";
 		int mode = priv->dblayer_file_mode;
@@ -5101,9 +5073,7 @@ static int dblayer_fri_restore(char *home_dir, char *src_dir, dblayer_private *p
 
 
 		/* First create the recovery directory */
-		fribak_dir_length = strlen(home_dir) + strlen(fribak_dir_name) + 4; /* 4 for the '/../' */
-		fribak_dir_path = (char *) slapi_ch_malloc(fribak_dir_length + 1); /* add one for the terminator */		
-		sprintf(fribak_dir_path,"%s/../%s",home_dir,fribak_dir_name);
+		fribak_dir_path = slapi_ch_smprintf("%s/../%s",home_dir,fribak_dir_name);
 		if((-1 == PR_MkDir(fribak_dir_path,NEWDIR_MODE)))
 		{
 		  LDAPDebug(LDAP_DEBUG_ANY, "dblayer_fri_restore: %s exists\n",fribak_dir_path, 0, 0);
@@ -5220,7 +5190,7 @@ int dblayer_restore(struct ldbminfo *li, char *src_dir, Slapi_Task *task, char *
     	while ((direntry = PR_ReadDir(dirhandle, PR_SKIP_DOT | PR_SKIP_DOT_DOT))
 			&& direntry->name)
 		{
-            sprintf(filename1, "%s/%s", src_dir, direntry->name);
+            PR_snprintf(filename1, MAXPATHLEN, "%s/%s", src_dir, direntry->name);
 			if(!frirestore || strcmp(direntry->name,bename)==0)
 			{
                 tmp_rval = PR_GetFileInfo(filename1, &info);
@@ -5285,7 +5255,7 @@ int dblayer_restore(struct ldbminfo *li, char *src_dir, Slapi_Task *task, char *
 
 
                 /* Is this entry a directory? */
-                sprintf(filename1, "%s/%s", real_src_dir, direntry->name);
+                PR_snprintf(filename1, MAXPATHLEN, "%s/%s", real_src_dir, direntry->name);
                 tmp_rval = PR_GetFileInfo(filename1, &info);
                 if (tmp_rval == PR_SUCCESS && PR_FILE_DIRECTORY == info.type) {
                     /* This is an instance directory. It contains the *.db#
@@ -5334,8 +5304,8 @@ int dblayer_restore(struct ldbminfo *li, char *src_dir, Slapi_Task *task, char *
                     prefix = home_dir;
                 }
                 mkdir_p(prefix, 0700);
-                sprintf(filename1, "%s/%s", real_src_dir, direntry->name);
-                sprintf(filename2, "%s/%s", prefix, direntry->name);
+                PR_snprintf(filename1, MAXPATHLEN, "%s/%s", real_src_dir, direntry->name);
+                PR_snprintf(filename2, MAXPATHLEN, "%s/%s", prefix, direntry->name);
                 LDAPDebug(LDAP_DEBUG_ANY, "Restoring file %d (%s)\n",
                           cnt, filename2, 0);
                 if (task) {
@@ -5454,20 +5424,6 @@ error_out:
     return return_value;
 }
 
-
-static char *dblayer_make_friendly_instance_name(ldbm_instance *inst)
-{
-    char *name = slapi_ch_strdup(inst->inst_name);
-    int x;
-
-    if (name == NULL)
-        return NULL;
-    for (x = 0; name[x]; x++)
-        if (name[x] == ' ')
-            name[x] = '_';
-    return name;
-}
-
 /*
  * inst_dir_name is a relative path  (from 6.21)
  *     ==> txn log stores relative paths and becomes relocatable
@@ -5479,7 +5435,6 @@ static char *dblayer_make_friendly_instance_name(ldbm_instance *inst)
  */
 int dblayer_get_instance_data_dir(backend *be)
 {
-    struct ldbminfo *li = (struct ldbminfo *)be->be_database->plg_private;
     ldbm_instance *inst = (ldbm_instance *)be->be_instance_info;
     char *full_namep = NULL;
     char full_name[MAXPATHLEN];
@@ -5582,9 +5537,7 @@ int dblayer_update_db_ext(ldbm_instance *inst, char *oldext, char *newext)
          a = (struct attrinfo *)avl_getnext())
     {
         PRFileInfo info;
-        ofile = slapi_ch_malloc(strlen(inst_dirp) +
-                                strlen(a->ai_type) + strlen(oldext) + 2);
-        sprintf(ofile, "%s/%s%s", inst_dirp, a->ai_type, oldext);
+        ofile = slapi_ch_smprintf("%s/%s%s", inst_dirp, a->ai_type, oldext);
 
         if (PR_GetFileInfo(ofile, &info) != PR_SUCCESS)
         {
@@ -5600,9 +5553,7 @@ int dblayer_update_db_ext(ldbm_instance *inst, char *oldext, char *newext)
                     rval, dblayer_strerror(rval), 0);
             goto done;
         }
-        nfile = slapi_ch_malloc(strlen(inst_dirp) +
-                                strlen(a->ai_type) + strlen(newext) + 2);
-        sprintf(nfile, "%s/%s%s", inst_dirp, a->ai_type, newext);
+        nfile = slapi_ch_smprintf("%s/%s%s", inst_dirp, a->ai_type, newext);
         LDAPDebug(LDAP_DEBUG_TRACE, "update_db_ext: rename %s -> %s\n",
             ofile, nfile, 0);
 
@@ -5628,12 +5579,8 @@ int dblayer_update_db_ext(ldbm_instance *inst, char *oldext, char *newext)
                     rval, dblayer_strerror(rval), 0);
         goto done;
     }
-    ofile = slapi_ch_malloc(strlen(inst_dirp) +
-                            strlen(ID2ENTRY) + strlen(oldext) + 2);
-    nfile = slapi_ch_malloc(strlen(inst_dirp) +
-                            strlen(ID2ENTRY) + strlen(newext) + 2);
-    sprintf(ofile, "%s/%s%s", inst_dirp, ID2ENTRY, oldext);
-    sprintf(nfile, "%s/%s%s", inst_dirp, ID2ENTRY, newext);
+    ofile = slapi_ch_smprintf("%s/%s%s", inst_dirp, ID2ENTRY, oldext);
+    nfile = slapi_ch_smprintf("%s/%s%s", inst_dirp, ID2ENTRY, newext);
     LDAPDebug(LDAP_DEBUG_TRACE, "update_db_ext: rename %s -> %s\n",
             ofile, nfile, 0);
     rval = thisdb->rename(thisdb, (const char *)ofile, NULL /* subdb */,
diff --git a/ldap/servers/slapd/back-ldbm/dbversion.c b/ldap/servers/slapd/back-ldbm/dbversion.c
index 5b8bbe9a..3dccb36d 100644
--- a/ldap/servers/slapd/back-ldbm/dbversion.c
+++ b/ldap/servers/slapd/back-ldbm/dbversion.c
@@ -13,18 +13,18 @@ mk_dbversion_fullpath(struct ldbminfo *li, const char *directory, char *filename
     {
         if (is_fullpath((char *)directory))
         {
-            sprintf(filename, "%s/%s", directory, DBVERSION_FILENAME);
+            PR_snprintf(filename, MAXPATHLEN*2, "%s/%s", directory, DBVERSION_FILENAME);
         }
         else
         {
             char *home_dir = dblayer_get_home_dir(li, NULL);
             /* if relpath, nsslapd-dbhome_directory should be set */
-            sprintf(filename,"%s/%s/%s", home_dir,directory,DBVERSION_FILENAME);
+            PR_snprintf(filename, MAXPATHLEN*2,"%s/%s/%s", home_dir,directory,DBVERSION_FILENAME);
         }
     }
     else
     {
-        sprintf(filename, "%s/%s", directory, DBVERSION_FILENAME);
+        PR_snprintf(filename, MAXPATHLEN*2, "%s/%s", directory, DBVERSION_FILENAME);
     }
 }
 
diff --git a/ldap/servers/slapd/back-ldbm/id2entry.c b/ldap/servers/slapd/back-ldbm/id2entry.c
index 9b53c4af..c63d6550 100644
--- a/ldap/servers/slapd/back-ldbm/id2entry.c
+++ b/ldap/servers/slapd/back-ldbm/id2entry.c
@@ -13,7 +13,6 @@
 int
 id2entry_add_ext( backend *be, struct backentry *e, back_txn *txn, int encrypt  )
 {
-    struct ldbminfo *li = (struct ldbminfo *) be->be_database->plg_private;
     ldbm_instance *inst = (ldbm_instance *) be->be_instance_info;
     DB     *db = NULL;
     DB_TXN *db_txn = NULL;
@@ -137,7 +136,6 @@ id2entry_delete( backend *be, struct backentry *e, back_txn *txn )
 struct backentry *
 id2entry( backend *be, ID id, back_txn *txn, int *err  )
 {
-    struct ldbminfo  *li = (struct ldbminfo *) be->be_database->plg_private;
     ldbm_instance    *inst = (ldbm_instance *) be->be_instance_info;
     DB               *db = NULL;
     DB_TXN           *db_txn = NULL;
diff --git a/ldap/servers/slapd/back-ldbm/import-merge.c b/ldap/servers/slapd/back-ldbm/import-merge.c
index fcffde31..61414604 100644
--- a/ldap/servers/slapd/back-ldbm/import-merge.c
+++ b/ldap/servers/slapd/back-ldbm/import-merge.c
@@ -277,16 +277,13 @@ static int import_count_merge_input_files(ldbm_instance *inst,
 
     for (i = 0; i < passes; i++) {
 	int fd;
-	char *filename = NULL;
-	size_t filename_length = strlen(inst->inst_dir_name) + 1 + 
-	    strlen(indexname) + 10 ;
+	char *filename = slapi_ch_smprintf("%s/%s.%d%s", inst->inst_dir_name, indexname, i+1,
+		LDBM_FILENAME_SUFFIX);
 
-	filename = slapi_ch_malloc(filename_length);
 	if (NULL == filename) {
 	    return -1;
 	}
-	sprintf(filename, "%s/%s.%d%s", inst->inst_dir_name, indexname, i+1,
-		LDBM_FILENAME_SUFFIX);
+
 	fd = dblayer_open_huge_file(filename, O_RDONLY, 0);
 	slapi_ch_free( (void**)&filename);
 	if (fd >= 0) {
@@ -320,14 +317,11 @@ static int import_open_merge_input_files(backend *be, char *indexname,
     }
     for (i = 0; i < passes; i++) {
 	DB *pDB = NULL;
-	char *filename = NULL;
-	size_t filename_length = strlen(indexname) + 10 ;
+	char *filename = slapi_ch_smprintf("%s.%d", indexname, i+1);
 
-	filename = slapi_ch_malloc(filename_length);
 	if (NULL == filename) {
 	    return -1;
 	}
-	sprintf(filename,"%s.%d", indexname, i+1);
 
 	if (vlv_isvlv(filename)) {
 		ret = dblayer_open_file(be, filename, 0, INDEX_VLV, &pDB);
diff --git a/ldap/servers/slapd/back-ldbm/import-threads.c b/ldap/servers/slapd/back-ldbm/import-threads.c
index 76de92c2..489668b7 100644
--- a/ldap/servers/slapd/back-ldbm/import-threads.c
+++ b/ldap/servers/slapd/back-ldbm/import-threads.c
@@ -252,7 +252,7 @@ import_get_version(char *str)
 		my_version = atoi(valuecharptr);
 		*(str + offset) = '#';
 		/* the memory below was not allocated by the slapi_ch_ functions */
-		if (errmsg) slapi_ch_free((void **) &errmsg);
+		if (errmsg) PR_smprintf_free(errmsg);
 		if (retmalloc) slapi_ch_free((void **) &valuecharptr);
 		break;
 	    } 
@@ -1736,8 +1736,7 @@ dse_conf_backup_core(struct ldbminfo *li, char *dest_dir, char *file_name, char
     }
     else
     {
-        filename = (char *)slapi_ch_malloc(strlen(file_name) + dlen + 2);
-        sprintf(filename, "%s/%s", dest_dir, file_name);
+        filename = slapi_ch_smprintf("%s/%s", dest_dir, file_name);
     }
     LDAPDebug(LDAP_DEBUG_TRACE, "dse_conf_backup(%s): backup file %s\n",
               filter, filename, 0);
@@ -1896,8 +1895,7 @@ dse_conf_verify_core(struct ldbminfo *li, char *src_dir, char *file_name, char *
     Slapi_Entry **curr_entries = NULL;
     Slapi_PBlock srch_pb;
     
-    filename = (char *)slapi_ch_malloc(strlen(file_name) + strlen(src_dir) + 2);
-    sprintf(filename, "%s/%s", src_dir, file_name);
+    filename = slapi_ch_smprintf("%s/%s", src_dir, file_name);
 
     if (PR_SUCCESS != PR_Access(filename, PR_ACCESS_READ_OK))
     {
@@ -1961,10 +1959,7 @@ dse_conf_verify_core(struct ldbminfo *li, char *src_dir, char *file_name, char *
 
 	if (entry_filter != NULL)
 	{ /* Single instance restoration */
-		int mylen = 0;
-		mylen = strlen(entry_filter) + strlen(li->li_plugin->plg_dn) + 2;
-        search_scope = slapi_ch_malloc(mylen);
-		sprintf(search_scope, "%s,%s", entry_filter, li->li_plugin->plg_dn);
+        search_scope = slapi_ch_smprintf("%s,%s", entry_filter, li->li_plugin->plg_dn);
 	} else { /* Normal restoration */
         search_scope = slapi_ch_strdup(li->li_plugin->plg_dn);
 	}
@@ -1993,8 +1988,7 @@ out:
 
     slapi_ch_free_string(&filename);
 
-	if (search_scope)
-		slapi_ch_free(&search_scope);
+	slapi_ch_free_string(&search_scope);
 
 
     if (fd > 0)
@@ -2012,17 +2006,11 @@ dse_conf_verify(struct ldbminfo *li, char *src_dir, char *bename)
 	
 	if (bename != NULL) /* This was a restore of a single backend */
 	{
-		int mylen = 0;
 		/* Entry filter string */
-		mylen = strlen(bename) + strlen("cn=") + 2;
-        entry_filter = slapi_ch_malloc(mylen);
-		sprintf(entry_filter, "cn=%s", bename);
+        entry_filter = slapi_ch_smprintf("cn=%s", bename);
 
-		mylen = 0;
 		/* Instance search filter */
-		mylen = strlen(DSE_INSTANCE_FILTER) + strlen(bename) + strlen("(&(cn=))") + 2;
-        instance_entry_filter = slapi_ch_malloc(mylen);
-		sprintf(instance_entry_filter, "(&%s(cn=%s))", DSE_INSTANCE_FILTER, bename);
+        instance_entry_filter = slapi_ch_smprintf("(&%s(cn=%s))", DSE_INSTANCE_FILTER, bename);
 	} else {
 	    instance_entry_filter = slapi_ch_strdup(DSE_INSTANCE_FILTER);
 	}
@@ -2032,10 +2020,8 @@ dse_conf_verify(struct ldbminfo *li, char *src_dir, char *bename)
     rval += dse_conf_verify_core(li, src_dir, DSE_INDEX, DSE_INDEX_FILTER,
                 "Index Config", entry_filter);
 
-	if (entry_filter)
-		slapi_ch_free(&entry_filter);
-	if (instance_entry_filter)
-		slapi_ch_free(&instance_entry_filter);
+	slapi_ch_free_string(&entry_filter);
+	slapi_ch_free_string(&instance_entry_filter);
 
     return rval;
 }
diff --git a/ldap/servers/slapd/back-ldbm/import.c b/ldap/servers/slapd/back-ldbm/import.c
index 0e5744b4..49d478a9 100644
--- a/ldap/servers/slapd/back-ldbm/import.c
+++ b/ldap/servers/slapd/back-ldbm/import.c
@@ -902,20 +902,14 @@ int import_make_merge_filenames(char *directory, char *indexname, int pass,
        and need to be renamed to: attributename<LDBM_FILENAME_SUFFIX>.n
        where n is the pass number.
        */
-    size_t oldname_length = strlen(directory) + 1 + strlen(indexname) + 
-    strlen(LDBM_FILENAME_SUFFIX) + 1 ;
-    /* Enough space for an 8-digit pass number */
-    size_t newname_length = oldname_length + 9;
-
-    *oldname = slapi_ch_malloc(oldname_length);
-    if (NULL == oldname)
-    return -1;
-    *newname = slapi_ch_malloc(newname_length);
-    if (NULL == newname)
-    return -1;
-    sprintf(*oldname, "%s/%s%s", directory, indexname, LDBM_FILENAME_SUFFIX);
-    sprintf(*newname, "%s/%s.%d%s", directory, indexname, pass,
+    *oldname = slapi_ch_smprintf("%s/%s%s", directory, indexname, LDBM_FILENAME_SUFFIX);
+    *newname = slapi_ch_smprintf("%s/%s.%d%s", directory, indexname, pass,
         LDBM_FILENAME_SUFFIX);
+	if (!*oldname || !*newname) {
+		slapi_ch_free_string(oldname);
+		slapi_ch_free_string(newname);
+		return -1;
+	}
     return 0;
 }
 
diff --git a/ldap/servers/slapd/back-ldbm/index.c b/ldap/servers/slapd/back-ldbm/index.c
index 5dc2bd2a..0b9bc3a5 100644
--- a/ldap/servers/slapd/back-ldbm/index.c
+++ b/ldap/servers/slapd/back-ldbm/index.c
@@ -23,8 +23,6 @@ valuearray_minus_valuearray(
     Slapi_Value **a, 
     Slapi_Value **b
 );
-static int index_addordel_values( backend *be, const char *type, struct berval **vals, struct berval **evals, ID id, int flags, back_txn *txn );
-static int index_addordel_values_ext( backend *be, const char *type, struct berval **vals, struct berval **evals, ID id, int flags, back_txn *txn,int *idl_disposition, void *buffer_handle );
 
 const char* indextype_PRESENCE = "pres";
 const char* indextype_EQUALITY = "eq";
@@ -1519,7 +1517,7 @@ index_addordel_values_ext_sv(
     char	*basetmp, *basetype;
     
     LDAPDebug( LDAP_DEBUG_TRACE,
-               "=> index_addordel_values( \"%s\", %lu )\n", type, (u_long)id, 0 );
+               "=> index_addordel_values_ext_sv( \"%s\", %lu )\n", type, (u_long)id, 0 );
 
     basetype = buf;
     if ( (basetmp = slapi_attr_basetype( type, buf, sizeof(buf) ))
@@ -1533,7 +1531,7 @@ index_addordel_values_ext_sv(
 		slapi_ch_free_string( &basetmp );
         return( 0 );
     }
-    LDAPDebug( LDAP_DEBUG_ARGS, "   index_addordel_values indexmask 0x%x\n",
+    LDAPDebug( LDAP_DEBUG_ARGS, "   index_addordel_values_ext_sv indexmask 0x%x\n",
                ai->ai_indexmask, 0, 0 );
     if ( (err = dblayer_get_index_file( be, ai, &db, DBOPEN_CREATE )) != 0 ) {
         LDAPDebug( LDAP_DEBUG_ANY,
@@ -1678,7 +1676,7 @@ index_addordel_values_ext_sv(
         slapi_ch_free( (void**)&basetmp );
     }
 
-    LDAPDebug (LDAP_DEBUG_TRACE, "<= index_addordel_values\n", 0, 0, 0 );
+    LDAPDebug (LDAP_DEBUG_TRACE, "<= index_addordel_values_ext_sv\n", 0, 0, 0 );
     return( 0 );
 
  bad:
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_attr.c b/ldap/servers/slapd/back-ldbm/ldbm_attr.c
index 657de14a..47586996 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_attr.c
+++ b/ldap/servers/slapd/back-ldbm/ldbm_attr.c
@@ -203,8 +203,7 @@ attr_index_config(
 				    if (!strcasecmp (index_rules[j], officialOID)) {
 					official_rules[k++] = slapi_ch_strdup (officialOID);
 				    } else {
-					char* preamble = slapi_ch_malloc (strlen (fname) + 30);
-					sprintf (preamble, "%s: line %d", fname, lineno);
+					char* preamble = slapi_ch_smprintf("%s: line %d", fname, lineno);
 					LDAPDebug (LDAP_DEBUG_ANY, "%s: use \"%s\" instead of \"%s\" (ignored)\n",
 						   preamble, officialOID, index_rules[j] );
 					slapi_ch_free((void**)&preamble);
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_attrcrypt.c b/ldap/servers/slapd/back-ldbm/ldbm_attrcrypt.c
index 8912aeec..01673b9e 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_attrcrypt.c
+++ b/ldap/servers/slapd/back-ldbm/ldbm_attrcrypt.c
@@ -107,14 +107,11 @@ attrcrypt_keymgmt_get_key(ldbm_instance *li, attrcrypt_cipher_state *acs, SECKEY
 	Slapi_Entry *entry = NULL;
 	char *dn_template = "cn=%s,cn=encrypted attribute keys,cn=%s,cn=ldbm database,cn=plugins,cn=config";
 	char *instance_name =  li->inst_name;
-	size_t dn_string_length = 0;
 	char *dn_string = NULL;
 	Slapi_Attr *keyattr = NULL;
 	
 	LDAPDebug(LDAP_DEBUG_TRACE,"-> attrcrypt_keymgmt_get_key\n", 0, 0, 0);
-	dn_string_length = strlen(dn_template) + strlen(instance_name) + strlen(acs->ace->cipher_display_name);
-	dn_string = slapi_ch_malloc(dn_string_length);
-	sprintf(dn_string, dn_template, acs->ace->cipher_display_name, instance_name);
+	dn_string = slapi_ch_smprintf(dn_template, acs->ace->cipher_display_name, instance_name);
 	/* Fetch the entry */
 	getConfigEntry(dn_string, &entry);
 	/* Did we find the entry ? */
@@ -136,6 +133,7 @@ attrcrypt_keymgmt_get_key(ldbm_instance *li, attrcrypt_cipher_state *acs, SECKEY
 	} else {
 		ret = -2; /* Means: we didn't find the entry (which happens if the key has never been generated) */	
 	}
+	slapi_ch_free_string(&dn_string);
 	LDAPDebug(LDAP_DEBUG_TRACE,"<- attrcrypt_keymgmt_get_key\n", 0, 0, 0);
 	return ret;
 }
@@ -162,10 +160,7 @@ attrcrypt_keymgmt_store_key(ldbm_instance *li, attrcrypt_cipher_state *acs, SECK
     			"objectclass:extensibleObject\n"
     			"cn:%s\n";
 		char *instance_name =  li->inst_name;
-		char *entry_string = NULL;
-		size_t entry_string_length = strlen(entry_template) + strlen(instance_name) + (strlen(acs->ace->cipher_display_name)*2);
-		entry_string = slapi_ch_malloc(entry_string_length);
-		sprintf(entry_string, entry_template,acs->ace->cipher_display_name,instance_name,acs->ace->cipher_display_name);
+		char *entry_string = slapi_ch_smprintf(entry_template,acs->ace->cipher_display_name,instance_name,acs->ace->cipher_display_name);
 		e = slapi_str2entry(entry_string, 0);
 		/* Add the key as a binary attribute */
 		key_as_berval.bv_val = wrapped_symmetric_key.data;
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_attrcrypt_config.c b/ldap/servers/slapd/back-ldbm/ldbm_attrcrypt_config.c
index 8d08178e..dc8b91af 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_attrcrypt_config.c
+++ b/ldap/servers/slapd/back-ldbm/ldbm_attrcrypt_config.c
@@ -166,7 +166,7 @@ ldbm_instance_attrcrypt_config_add_callback(Slapi_PBlock *pb, Slapi_Entry* e, Sl
         ret = SLAPI_DSE_CALLBACK_ERROR;
     }
 	if (attribute_name) {
-		slapi_ch_free(&attribute_name);
+		slapi_ch_free_string(&attribute_name);
 	}
 	return ret;
 }
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_config.c b/ldap/servers/slapd/back-ldbm/ldbm_config.c
index f0ddfd3b..96fb225d 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_config.c
+++ b/ldap/servers/slapd/back-ldbm/ldbm_config.c
@@ -54,7 +54,7 @@ int ldbm_config_add_dse_entries(struct ldbminfo *li, char **entries, char *strin
 
     for(x = 0; strlen(entries[x]) > 0; x++) {
         util_pb = slapi_pblock_new();
-        sprintf(entry_string, entries[x], string1, string2, string3);
+        PR_snprintf(entry_string, 512, entries[x], string1, string2, string3);
         e = slapi_str2entry(entry_string, 0);
         slapi_add_entry_internal_set_pb(util_pb, e, NULL, li->li_identity, 0);
         slapi_pblock_set(util_pb, SLAPI_DSE_DONT_WRITE_WHEN_ADDING, 
@@ -252,7 +252,7 @@ done:
             if (res != LDAP_SUCCESS) {
                 return res;
             }
-            sprintf(tmpbuf, "%s/db", s );
+            PR_snprintf(tmpbuf, BUFSIZ, "%s/db", s );
             val = tmpbuf;
         }
         slapi_ch_free((void **) &(li->li_new_directory));
@@ -628,7 +628,8 @@ static int ldbm_config_db_trickle_percentage_set(void *arg, void *value, char *e
     int val = (int) value;
     
     if (val < 0 || val > 100) {
-        sprintf(errorbuf, "Error: Invalid value for %s (%d). Must be between 0 and 100\n", CONFIG_DB_TRICKLE_PERCENTAGE, val);
+        PR_snprintf(errorbuf, SLAPI_DSE_RETURNTEXT_SIZE,
+					"Error: Invalid value for %s (%d). Must be between 0 and 100\n", CONFIG_DB_TRICKLE_PERCENTAGE, val);
         LDAPDebug(LDAP_DEBUG_ANY, "%s", errorbuf, 0, 0);
             return LDAP_UNWILLING_TO_PERFORM;
     }
@@ -1039,7 +1040,6 @@ static int ldbm_config_set_use_vlv_index(void *arg, void *value, char *errorbuf,
     int val = (int) value;
         
     if (apply) {
-        int setval = 0;
         if (val) {
             li->li_use_vlv = 1;
         } else {
@@ -1197,7 +1197,7 @@ static config_info ldbm_config[] = {
 void ldbm_config_setup_default(struct ldbminfo *li) 
 {
     config_info *config;
-    char err_buf[BUFSIZ];
+    char err_buf[SLAPI_DSE_RETURNTEXT_SIZE];
     
     for (config = ldbm_config; config->config_name != NULL; config++) {
         ldbm_config_set((void *)li, config->config_name, ldbm_config, NULL /* use default */, err_buf, CONFIG_PHASE_INITIALIZATION, 1 /* apply */);
@@ -1212,7 +1212,7 @@ ldbm_config_read_instance_entries(struct ldbminfo *li, const char *backend_type)
     Slapi_Entry **entries = NULL;
 
     /* Construct the base dn of the subtree that holds the instance entries. */
-    sprintf(basedn, "cn=%s, cn=plugins, cn=config", backend_type);
+    PR_snprintf(basedn, BUFSIZ, "cn=%s, cn=plugins, cn=config", backend_type);
 
     /* Do a search of the subtree containing the instance entries */
     tmp_pb = slapi_pblock_new();
@@ -1246,8 +1246,8 @@ int ldbm_config_load_dse_info(struct ldbminfo *li)
      * cn=config, cn=ldbm database, cn=plugins, cn=config.  If the entry is
      * there, then we process the config information it stores.
      */
-    sprintf(dn, "cn=config, cn=%s, cn=plugins, cn=config", 
-            li->li_plugin->plg_name);
+    PR_snprintf(dn, BUFSIZ, "cn=config, cn=%s, cn=plugins, cn=config", 
+				li->li_plugin->plg_name);
     search_pb = slapi_pblock_new();
     slapi_search_internal_set_pb(search_pb, dn, LDAP_SCOPE_BASE, 
         "objectclass=*", NULL, 0, NULL, NULL, li->li_identity, 0);
@@ -1285,7 +1285,7 @@ int ldbm_config_load_dse_info(struct ldbminfo *li)
     ldbm_config_read_instance_entries(li, li->li_plugin->plg_name);
 
     /* setup the dse callback functions for the ldbm backend config entry */
-    sprintf(dn, "cn=config, cn=%s, cn=plugins, cn=config",
+    PR_snprintf(dn, BUFSIZ, "cn=config, cn=%s, cn=plugins, cn=config",
             li->li_plugin->plg_name);
     slapi_config_register_callback(SLAPI_OPERATION_SEARCH, DSE_FLAG_PREOP, dn,
         LDAP_SCOPE_BASE, "(objectclass=*)", ldbm_config_search_entry_callback,
@@ -1298,14 +1298,14 @@ int ldbm_config_load_dse_info(struct ldbminfo *li)
         (void *) li);
 
     /* setup the dse callback functions for the ldbm backend monitor entry */
-    sprintf(dn, "cn=monitor, cn=%s, cn=plugins, cn=config",
+    PR_snprintf(dn, BUFSIZ, "cn=monitor, cn=%s, cn=plugins, cn=config",
             li->li_plugin->plg_name);
     slapi_config_register_callback(SLAPI_OPERATION_SEARCH, DSE_FLAG_PREOP, dn,
         LDAP_SCOPE_BASE, "(objectclass=*)", ldbm_back_monitor_search,
         (void *)li);
 
     /* And the ldbm backend database monitor entry */
-    sprintf(dn, "cn=database, cn=monitor, cn=%s, cn=plugins, cn=config",
+    PR_snprintf(dn, BUFSIZ, "cn=database, cn=monitor, cn=%s, cn=plugins, cn=config",
         li->li_plugin->plg_name);
     slapi_config_register_callback(SLAPI_OPERATION_SEARCH, DSE_FLAG_PREOP, dn,
         LDAP_SCOPE_BASE, "(objectclass=*)", ldbm_back_dbmonitor_search,
@@ -1313,7 +1313,7 @@ int ldbm_config_load_dse_info(struct ldbminfo *li)
 
     /* setup the dse callback functions for the ldbm backend instance
      * entries */
-    sprintf(dn, "cn=%s, cn=plugins, cn=config", li->li_plugin->plg_name);
+    PR_snprintf(dn, BUFSIZ, "cn=%s, cn=plugins, cn=config", li->li_plugin->plg_name);
     slapi_config_register_callback(SLAPI_OPERATION_ADD, DSE_FLAG_PREOP, dn,
         LDAP_SCOPE_SUBTREE, "(objectclass=nsBackendInstance)",
         ldbm_instance_add_instance_entry_callback, (void *) li);
@@ -1334,6 +1334,7 @@ int ldbm_config_load_dse_info(struct ldbminfo *li)
 /* Utility function used in creating config entries.  Using the
  * config_info, this function gets info and formats in the correct
  * way.
+ * buf is char[BUFSIZ]
  */
 void ldbm_config_get(void *arg, config_info *config, char *buf)
 {
@@ -1360,7 +1361,7 @@ void ldbm_config_get(void *arg, config_info *config, char *buf)
         /* Remember the get function for strings returns memory
          * that must be freed. */
         tmp_string = (char *) config->config_get_fn(arg);
-        sprintf(buf, "%s", (char *) tmp_string);
+        PR_snprintf(buf, BUFSIZ, "%s", (char *) tmp_string);
         slapi_ch_free((void **)&tmp_string);
         break;
     case CONFIG_TYPE_ONOFF:
@@ -1455,14 +1456,14 @@ int ldbm_config_set(void *arg, char *attr_name, config_info *config_array, struc
     config = get_config_info(config_array, attr_name);
     if (NULL == config) {
         LDAPDebug(LDAP_DEBUG_CONFIG, "Unknown config attribute %s\n", attr_name, 0, 0);
-        sprintf(err_buf, "Unknown config attribute %s\n", attr_name);
+        PR_snprintf(err_buf, SLAPI_DSE_RETURNTEXT_SIZE, "Unknown config attribute %s\n", attr_name);
         return LDAP_SUCCESS; /* Ignore unknown attributes */
     }
 
     /* Some config attrs can't be changed while the server is running. */
     if (phase == CONFIG_PHASE_RUNNING && 
         !(config->config_flags & CONFIG_FLAG_ALLOW_RUNNING_CHANGE)) {
-        sprintf(err_buf, "%s can't be modified while the server is running.\n", attr_name);
+        PR_snprintf(err_buf, SLAPI_DSE_RETURNTEXT_SIZE, "%s can't be modified while the server is running.\n", attr_name);
         LDAPDebug(LDAP_DEBUG_ANY, "%s", err_buf, 0, 0);
         return LDAP_UNWILLING_TO_PERFORM;
     }
@@ -1491,19 +1492,19 @@ int ldbm_config_set(void *arg, char *attr_name, config_info *config_array, struc
 		llval = db_atoi(str_val, &err);
 		/* check for parsing error (e.g. not a number) */
 		if (err) {
-			sprintf(err_buf, "Error: value %s for attr %s is not a number\n",
+			PR_snprintf(err_buf, SLAPI_DSE_RETURNTEXT_SIZE, "Error: value %s for attr %s is not a number\n",
 					str_val, attr_name);
 			LDAPDebug(LDAP_DEBUG_ANY, "%s", err_buf, 0, 0);
 			return LDAP_UNWILLING_TO_PERFORM;
 		/* check for overflow */
 		} else if (LL_CMP(llval, >, llmaxint)) {
-			sprintf(err_buf, "Error: value %s for attr %s is greater than the maximum %d\n",
+			PR_snprintf(err_buf, SLAPI_DSE_RETURNTEXT_SIZE, "Error: value %s for attr %s is greater than the maximum %d\n",
 					str_val, attr_name, maxint);
 			LDAPDebug(LDAP_DEBUG_ANY, "%s", err_buf, 0, 0);
 			return LDAP_UNWILLING_TO_PERFORM;
 		/* check for underflow */
 		} else if (LL_CMP(llval, <, llminint)) {
-			sprintf(err_buf, "Error: value %s for attr %s is less than the minimum %d\n",
+			PR_snprintf(err_buf, SLAPI_DSE_RETURNTEXT_SIZE, "Error: value %s for attr %s is less than the minimum %d\n",
 					str_val, attr_name, minint);
 			LDAPDebug(LDAP_DEBUG_ANY, "%s", err_buf, 0, 0);
 			return LDAP_UNWILLING_TO_PERFORM;
@@ -1530,19 +1531,19 @@ int ldbm_config_set(void *arg, char *attr_name, config_info *config_array, struc
 		llval = db_atoi(str_val, &err);
 		/* check for parsing error (e.g. not a number) */
 		if (err) {
-			sprintf(err_buf, "Error: value %s for attr %s is not a number\n",
+			PR_snprintf(err_buf, SLAPI_DSE_RETURNTEXT_SIZE, "Error: value %s for attr %s is not a number\n",
 					str_val, attr_name);
 			LDAPDebug(LDAP_DEBUG_ANY, "%s", err_buf, 0, 0);
 			return LDAP_UNWILLING_TO_PERFORM;
 		/* check for overflow */
 		} else if (LL_CMP(llval, >, llmaxint)) {
-			sprintf(err_buf, "Error: value %s for attr %s is greater than the maximum %d\n",
+			PR_snprintf(err_buf, SLAPI_DSE_RETURNTEXT_SIZE, "Error: value %s for attr %s is greater than the maximum %d\n",
 					str_val, attr_name, maxint);
 			LDAPDebug(LDAP_DEBUG_ANY, "%s", err_buf, 0, 0);
 			return LDAP_UNWILLING_TO_PERFORM;
 		/* check for underflow */
 		} else if (LL_CMP(llval, <, llminint)) {
-			sprintf(err_buf, "Error: value %s for attr %s is less than the minimum %d\n",
+			PR_snprintf(err_buf, SLAPI_DSE_RETURNTEXT_SIZE, "Error: value %s for attr %s is less than the minimum %d\n",
 					str_val, attr_name, minint);
 			LDAPDebug(LDAP_DEBUG_ANY, "%s", err_buf, 0, 0);
 			return LDAP_UNWILLING_TO_PERFORM;
@@ -1563,13 +1564,13 @@ int ldbm_config_set(void *arg, char *attr_name, config_info *config_array, struc
 
         /* check for parsing error (e.g. not a number) */
         if (err == EINVAL) {
-            sprintf(err_buf, "Error: value %s for attr %s is not a number\n",
+            PR_snprintf(err_buf, SLAPI_DSE_RETURNTEXT_SIZE, "Error: value %s for attr %s is not a number\n",
                     str_val, attr_name);
             LDAPDebug(LDAP_DEBUG_ANY, "%s", err_buf, 0, 0);
             return LDAP_UNWILLING_TO_PERFORM;
             /* check for overflow */
         } else if (err == ERANGE) {
-            sprintf(err_buf, "Error: value %s for attr %s is outside the range of representable values\n",
+            PR_snprintf(err_buf, SLAPI_DSE_RETURNTEXT_SIZE, "Error: value %s for attr %s is outside the range of representable values\n",
                     str_val, attr_name);
             LDAPDebug(LDAP_DEBUG_ANY, "%s", err_buf, 0, 0);
             return LDAP_UNWILLING_TO_PERFORM;
@@ -1605,7 +1606,7 @@ static int parse_ldbm_config_entry(struct ldbminfo *li, Slapi_Entry *e, config_i
         char *attr_name = NULL;
         Slapi_Value *sval = NULL;
         struct berval *bval;
-        char err_buf[BUFSIZ];
+        char err_buf[SLAPI_DSE_RETURNTEXT_SIZE];
         
         slapi_attr_get_type(attr, &attr_name);
         
@@ -1613,7 +1614,6 @@ static int parse_ldbm_config_entry(struct ldbminfo *li, Slapi_Entry *e, config_i
         if (ldbm_config_ignored_attr(attr_name)) {
             continue;
         }
-        
         slapi_attr_first_value(attr, &sval);
         bval = (struct berval *) slapi_value_get_berval(sval);
         
@@ -1663,7 +1663,7 @@ int ldbm_config_modify_entry_callback(Slapi_PBlock *pb, Slapi_Entry* entryBefore
             if ((mods[i]->mod_op & LDAP_MOD_DELETE) || 
                 ((mods[i]->mod_op & ~LDAP_MOD_BVALUES) == LDAP_MOD_ADD)) { 
                 rc= LDAP_UNWILLING_TO_PERFORM; 
-                sprintf(returntext, "%s attributes is not allowed", 
+                PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE, "%s attributes is not allowed", 
                         (mods[i]->mod_op & LDAP_MOD_DELETE) ? "Deleting" : "Adding"); 
             } else if (mods[i]->mod_op & LDAP_MOD_REPLACE) {
                 /* This assumes there is only one bval for this mod. */
@@ -1694,7 +1694,7 @@ int ldbm_config_modify_entry_callback(Slapi_PBlock *pb, Slapi_Entry* entryBefore
  */
 void ldbm_config_internal_set(struct ldbminfo *li, char *attrname, char *value)
 {
-    char err_buf[BUFSIZ];
+    char err_buf[SLAPI_DSE_RETURNTEXT_SIZE];
     struct berval bval;
     
     bval.bv_val = value;
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_index_config.c b/ldap/servers/slapd/back-ldbm/ldbm_index_config.c
index b227d1d1..63826abb 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_index_config.c
+++ b/ldap/servers/slapd/back-ldbm/ldbm_index_config.c
@@ -172,7 +172,7 @@ ldbm_index_init_entry_callback(Slapi_PBlock *pb, Slapi_Entry* e, Slapi_Entry* en
     if (*returncode == LDAP_SUCCESS) {
         return SLAPI_DSE_CALLBACK_OK;
     } else {
-        sprintf(returntext, "Problem initializing index entry %s\n",
+        PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE, "Problem initializing index entry %s\n",
                 slapi_entry_get_dn(e));
         return SLAPI_DSE_CALLBACK_ERROR;
     }
@@ -486,7 +486,7 @@ int ldbm_instance_config_add_index_entry(
     char **attrs = NULL;
     char **indexes = NULL;
     char **matchingRules = NULL;
-    char eBuf[BUFSIZ];
+    char *eBuf;
     int i = 0;
     int j = 0;
     char *basetype = NULL;
@@ -500,13 +500,13 @@ int ldbm_instance_config_add_index_entry(
         return(-1);
     }
 
-    strcpy(tmpAttrsStr,argv[0]);
+    PL_strncpyz(tmpAttrsStr,argv[0], 256);
     attrs = str2charray( tmpAttrsStr, "," );
-    strcpy(tmpIndexesStr,argv[1]);
+    PL_strncpyz(tmpIndexesStr,argv[1], 256);
     indexes = str2charray( tmpIndexesStr, ",");
 
     if(argc > 2) {
-        strcpy(tmpMatchingRulesStr,argv[2]);
+        PL_strncpyz(tmpMatchingRulesStr,argv[2], 1024);
         matchingRules = str2charray( tmpMatchingRulesStr, ",");
     }
 
@@ -514,7 +514,7 @@ int ldbm_instance_config_add_index_entry(
     {
         if('\0' == attrs[i][0]) continue;
         basetype = slapi_attr_basetype(attrs[i], NULL, 0);
-        sprintf(eBuf,
+        eBuf = PR_smprintf(
                 "dn: cn=%s, cn=index, cn=%s, cn=%s, cn=plugins, cn=config\n"
                 "objectclass:top\n"
                 "objectclass:nsIndex\n"
@@ -525,21 +525,20 @@ int ldbm_instance_config_add_index_entry(
                 (ldbm_attribute_always_indexed(basetype)?"true":"false"));
         for(j=0; indexes[j] != NULL; j++)
         {
-            strcat(eBuf, "nsIndexType:");
-            strcat(eBuf,indexes[j]);
-            strcat(eBuf,"\n");
+			eBuf = PR_sprintf_append(eBuf, "nsIndexType:%s\n", indexes[j]);
         }
         if((argc>2)&&(argv[2]))
         {
             for(j=0; matchingRules[j] != NULL; j++)
             { 
-                strcat(eBuf,"nsMatchingRule:");
-                strcat(eBuf,matchingRules[j]);
-                strcat(eBuf,"\n");
+				eBuf = PR_sprintf_append(eBuf, "nsMatchingRule:%s\n", matchingRules[j]);
             }
         }
 
         ldbm_config_add_dse_entry(li, eBuf, flags);
+		if (eBuf) {
+			PR_smprintf_free(eBuf);
+		}
 
         slapi_ch_free((void**)&basetype);
     }
@@ -615,7 +614,7 @@ int ldbm_instance_create_default_user_indexes(ldbm_instance *inst)
     strcpy(tmpBuf,"");
 
     /* Construct the base dn of the subtree that holds the default user indexes. */
-    sprintf(basedn, "cn=default indexes, cn=config, cn=%s, cn=plugins, cn=config", 
+    PR_snprintf(basedn, BUFSIZ, "cn=default indexes, cn=config, cn=%s, cn=plugins, cn=config", 
 	li->li_plugin->plg_name);
 
     /* Do a search of the subtree containing the index entries */
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_instance_config.c b/ldap/servers/slapd/back-ldbm/ldbm_instance_config.c
index 74fa64de..0b4ad372 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_instance_config.c
+++ b/ldap/servers/slapd/back-ldbm/ldbm_instance_config.c
@@ -114,7 +114,7 @@ ldbm_instance_config_instance_dir_get(void *arg)
         int len = strlen(inst->inst_parent_dir_name) +
                   strlen(inst->inst_dir_name) + 2;
         char *full_inst_dir = (char *)slapi_ch_malloc(len);
-        sprintf(full_inst_dir, "%s%c%s",
+        PR_snprintf(full_inst_dir, len, "%s%c%s",
             inst->inst_parent_dir_name, get_sep(inst->inst_parent_dir_name),
             inst->inst_dir_name);
         return full_inst_dir;
@@ -274,7 +274,7 @@ read_instance_index_entries(ldbm_instance *inst)
 
     /* Construct the base dn of the subtree that holds the index entries 
      * for this instance. */
-    sprintf(basedn, "cn=index, cn=%s, cn=%s, cn=plugins, cn=config",
+    PR_snprintf(basedn, BUFSIZ, "cn=index, cn=%s, cn=%s, cn=plugins, cn=config",
             inst->inst_name, inst->inst_li->li_plugin->plg_name); 
 
     /* Set up a tmp callback that will handle the init for each index entry */
@@ -310,7 +310,7 @@ read_instance_attrcrypt_entries(ldbm_instance *inst)
 
     /* Construct the base dn of the subtree that holds the index entries 
      * for this instance. */
-    sprintf(basedn, "cn=encrypted attributes, cn=%s, cn=%s, cn=plugins, cn=config",
+    PR_snprintf(basedn, BUFSIZ, "cn=encrypted attributes, cn=%s, cn=%s, cn=plugins, cn=config",
             inst->inst_name, inst->inst_li->li_plugin->plg_name); 
 
     /* Set up a tmp callback that will handle the init for each index entry */
@@ -417,7 +417,7 @@ ldbm_instance_config_load_dse_info(ldbm_instance *inst)
      * cn=instance_name, cn=ldbm database, cn=plugins, cn=config.  If the
      * entry is there, then we process the config information it stores.
      */
-    sprintf(dn, "cn=%s, cn=%s, cn=plugins, cn=config",
+    PR_snprintf(dn, BUFSIZ, "cn=%s, cn=%s, cn=plugins, cn=config",
             inst->inst_name, li->li_plugin->plg_name);
     search_pb = slapi_pblock_new();
     slapi_search_internal_set_pb(search_pb, dn, LDAP_SCOPE_BASE, 
@@ -451,7 +451,7 @@ ldbm_instance_config_load_dse_info(ldbm_instance *inst)
 
     /* now check for cn=monitor -- if not present, add default child entries */
     search_pb = slapi_pblock_new();
-    sprintf(dn, "cn=monitor, cn=%s, cn=%s, cn=plugins, cn=config",
+    PR_snprintf(dn, BUFSIZ, "cn=monitor, cn=%s, cn=%s, cn=plugins, cn=config",
             inst->inst_name, li->li_plugin->plg_name);
     slapi_search_internal_set_pb(search_pb, dn, LDAP_SCOPE_BASE,
                                  "objectclass=*", NULL, 0, NULL, NULL,
@@ -472,7 +472,7 @@ ldbm_instance_config_load_dse_info(ldbm_instance *inst)
     }
 
     /* setup the dse callback functions for the ldbm instance config entry */
-    sprintf(dn, "cn=%s, cn=%s, cn=plugins, cn=config",
+    PR_snprintf(dn, BUFSIZ, "cn=%s, cn=%s, cn=plugins, cn=config",
             inst->inst_name, li->li_plugin->plg_name);
     slapi_config_register_callback(SLAPI_OPERATION_SEARCH, DSE_FLAG_PREOP, dn,
         LDAP_SCOPE_BASE, "(objectclass=*)",
@@ -489,7 +489,7 @@ ldbm_instance_config_load_dse_info(ldbm_instance *inst)
     /* delete is handled by a callback set in ldbm_config.c */
 
     /* don't forget the monitor! */
-    sprintf(dn, "cn=monitor, cn=%s, cn=%s, cn=plugins, cn=config",
+    PR_snprintf(dn, BUFSIZ, "cn=monitor, cn=%s, cn=%s, cn=plugins, cn=config",
             inst->inst_name, li->li_plugin->plg_name);
     /* make callback on search; deny add/modify/delete */
     slapi_config_register_callback(SLAPI_OPERATION_SEARCH, DSE_FLAG_PREOP, dn,
@@ -504,7 +504,7 @@ ldbm_instance_config_load_dse_info(ldbm_instance *inst)
     /* delete is okay */
 
     /* Callbacks to handle indexes */
-    sprintf(dn, "cn=index, cn=%s, cn=%s, cn=plugins, cn=config",
+    PR_snprintf(dn, BUFSIZ, "cn=index, cn=%s, cn=%s, cn=plugins, cn=config",
             inst->inst_name, li->li_plugin->plg_name);
     slapi_config_register_callback(SLAPI_OPERATION_ADD, DSE_FLAG_PREOP, dn,
         LDAP_SCOPE_SUBTREE, "(objectclass=nsIndex)",
@@ -517,7 +517,7 @@ ldbm_instance_config_load_dse_info(ldbm_instance *inst)
         ldbm_instance_index_config_modify_callback, (void *) inst);
 
     /* Callbacks to handle attribute encryption */
-    sprintf(dn, "cn=encrypted attributes, cn=%s, cn=%s, cn=plugins, cn=config",
+    PR_snprintf(dn, BUFSIZ, "cn=encrypted attributes, cn=%s, cn=%s, cn=plugins, cn=config",
             inst->inst_name, li->li_plugin->plg_name);
     slapi_config_register_callback(SLAPI_OPERATION_ADD, DSE_FLAG_PREOP, dn,
         LDAP_SCOPE_SUBTREE, ldbm_instance_attrcrypt_filter,
@@ -641,8 +641,8 @@ ldbm_instance_modify_config_entry_callback(Slapi_PBlock *pb, Slapi_Entry* entryB
                 /* naughty naughty, we don't allow this */
                 rc = LDAP_UNWILLING_TO_PERFORM;
                 if (returntext) {
-                    sprintf(returntext,
-                            "Can't change the root suffix of a backend");
+					PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE,
+								"Can't change the root suffix of a backend");
                 }
                 LDAPDebug(LDAP_DEBUG_ANY,
                           "ldbm: modify attempted to change the root suffix "
@@ -660,7 +660,7 @@ ldbm_instance_modify_config_entry_callback(Slapi_PBlock *pb, Slapi_Entry* entryB
             if ((mods[i]->mod_op & LDAP_MOD_DELETE) || 
                 (mods[i]->mod_op & LDAP_MOD_ADD)) { 
                 rc= LDAP_UNWILLING_TO_PERFORM; 
-                sprintf(returntext, "%s attributes is not allowed", 
+                PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE, "%s attributes is not allowed", 
                         (mods[i]->mod_op & LDAP_MOD_DELETE) ?
                         "Deleting" : "Adding"); 
             } else if (mods[i]->mod_op & LDAP_MOD_REPLACE) {
@@ -785,7 +785,7 @@ ldbm_instance_add_instance_entry_callback(Slapi_PBlock *pb, Slapi_Entry* entryBe
         LDAPDebug(LDAP_DEBUG_ANY, "WARNING: ldbm instance %s already exists\n",
                   instance_name, 0, 0);
         if (returntext != NULL)
-            sprintf(returntext, "An ldbm instance with the name %s already exists\n",
+            PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE, "An ldbm instance with the name %s already exists\n",
                     instance_name);
         if (returncode != NULL)
             *returncode = LDAP_UNWILLING_TO_PERFORM;
@@ -818,7 +818,7 @@ static void ldbm_instance_unregister_callbacks(ldbm_instance *inst)
     char dn[BUFSIZ];
 
     /* tear down callbacks for the instance config entry */
-    sprintf(dn, "cn=%s, cn=%s, cn=plugins, cn=config",
+    PR_snprintf(dn, BUFSIZ, "cn=%s, cn=%s, cn=plugins, cn=config",
             inst->inst_name, li->li_plugin->plg_name);
     slapi_config_remove_callback(SLAPI_OPERATION_SEARCH, DSE_FLAG_PREOP, dn,
         LDAP_SCOPE_BASE, "(objectclass=*)",
@@ -834,7 +834,7 @@ static void ldbm_instance_unregister_callbacks(ldbm_instance *inst)
         ldbm_instance_deny_config);
 
     /* now the cn=monitor entry */
-    sprintf(dn, "cn=monitor, cn=%s, cn=%s, cn=plugins, cn=config",
+    PR_snprintf(dn, BUFSIZ, "cn=monitor, cn=%s, cn=%s, cn=plugins, cn=config",
             inst->inst_name, li->li_plugin->plg_name);
     slapi_config_remove_callback(SLAPI_OPERATION_SEARCH, DSE_FLAG_PREOP, dn,
         LDAP_SCOPE_BASE, "(objectclass=*)", ldbm_back_monitor_instance_search);
@@ -844,7 +844,7 @@ static void ldbm_instance_unregister_callbacks(ldbm_instance *inst)
         LDAP_SCOPE_BASE, "(objectclass=*)", ldbm_instance_deny_config);
 
     /* now the cn=index entries */
-    sprintf(dn, "cn=index, cn=%s, cn=%s, cn=plugins, cn=config",
+    PR_snprintf(dn, BUFSIZ, "cn=index, cn=%s, cn=%s, cn=plugins, cn=config",
             inst->inst_name, li->li_plugin->plg_name);
     slapi_config_remove_callback(SLAPI_OPERATION_ADD, DSE_FLAG_PREOP, dn,
         LDAP_SCOPE_SUBTREE, "(objectclass=nsIndex)",
@@ -857,7 +857,7 @@ static void ldbm_instance_unregister_callbacks(ldbm_instance *inst)
         ldbm_instance_index_config_modify_callback);
 
     /* now the cn=encrypted attributes entries */
-    sprintf(dn, "cn=encrypted attributes, cn=%s, cn=%s, cn=plugins, cn=config",
+    PR_snprintf(dn, BUFSIZ, "cn=encrypted attributes, cn=%s, cn=%s, cn=plugins, cn=config",
             inst->inst_name, li->li_plugin->plg_name);
     slapi_config_remove_callback(SLAPI_OPERATION_ADD, DSE_FLAG_PREOP, dn,
         LDAP_SCOPE_SUBTREE, ldbm_instance_attrcrypt_filter,
@@ -887,7 +887,7 @@ ldbm_instance_post_delete_instance_entry_callback(Slapi_PBlock *pb, Slapi_Entry*
         LDAPDebug(LDAP_DEBUG_ANY, "ldbm: instance '%s' does not exist! (2)\n",
                   instance_name, 0, 0);
         if (returntext) {
-            sprintf(returntext, "No ldbm instance exists with the name '%s' (2)\n",
+            PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE, "No ldbm instance exists with the name '%s' (2)\n",
                     instance_name);
         }
         if (returncode) {
@@ -957,7 +957,7 @@ ldbm_instance_delete_instance_entry_callback(Slapi_PBlock *pb, Slapi_Entry* entr
         LDAPDebug(LDAP_DEBUG_ANY, "ldbm: instance '%s' does not exist!\n",
                   instance_name, 0, 0);
         if (returntext) {
-            sprintf(returntext, "No ldbm instance exists with the name '%s'\n",
+            PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE, "No ldbm instance exists with the name '%s'\n",
                     instance_name);
         }
         if (returncode) {
@@ -973,7 +973,7 @@ ldbm_instance_delete_instance_entry_callback(Slapi_PBlock *pb, Slapi_Entry* entr
                   "Cancel the task or wait for it to finish, "
                   "then try again.\n", instance_name, 0, 0);
         if (returntext) {
-            sprintf(returntext, "ldbm instance '%s' is in the middle of a "
+            PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE, "ldbm instance '%s' is in the middle of a "
                     "task. Cancel the task or wait for it to finish, "
                     "then try again.\n", instance_name);
         }
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_search.c b/ldap/servers/slapd/back-ldbm/ldbm_search.c
index 3e740f76..65f1a6f0 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_search.c
+++ b/ldap/servers/slapd/back-ldbm/ldbm_search.c
@@ -200,7 +200,7 @@ ldbm_back_search( Slapi_PBlock *pb )
 
                     dummyAttrs[0] = dummyAttr;
 
-                    sprintf(dn,"dn: oid=%s,cn=features,cn=config",LDAP_CONTROL_VLVREQUEST);
+                    PR_snprintf(dn,sizeof(dn),"dn: oid=%s,cn=features,cn=config",LDAP_CONTROL_VLVREQUEST);
                     feature= slapi_str2entry(dn,0);
                     r= plugin_call_acl_plugin (pb, feature, dummyAttrs, NULL, SLAPI_ACL_READ, ACLPLUGIN_ACCESS_DEFAULT, NULL);
                     slapi_entry_free(feature);
diff --git a/ldap/servers/slapd/back-ldbm/ldif2ldbm.c b/ldap/servers/slapd/back-ldbm/ldif2ldbm.c
index 980c76e1..2e3d1d8d 100644
--- a/ldap/servers/slapd/back-ldbm/ldif2ldbm.c
+++ b/ldap/servers/slapd/back-ldbm/ldif2ldbm.c
@@ -85,14 +85,14 @@ int ldbm_back_fetch_incl_excl(Slapi_PBlock *pb, char ***include,
     /* normalize */
     if (pb_excl) {
 	for (i = 0; pb_excl[i]; i++) {
-	    strcpy(subtreeDn, pb_excl[i]);
+	    PL_strncpyz(subtreeDn, pb_excl[i], BUFSIZ);
 	    normSubtreeDn = slapi_dn_normalize_case(subtreeDn);
 	    charray_add(exclude, slapi_ch_strdup(normSubtreeDn));
 	}
     }
     if (pb_incl) {
 	for (i = 0; pb_incl[i]; i++) {
-	    strcpy(subtreeDn, pb_incl[i]);
+	    PL_strncpyz(subtreeDn, pb_incl[i], BUFSIZ);
 	    normSubtreeDn = slapi_dn_normalize_case(subtreeDn);
 	    charray_add(include, slapi_ch_strdup(normSubtreeDn));
 	}
@@ -2049,8 +2049,7 @@ int ldbm_back_upgradedb(Slapi_PBlock *pb)
             {
                 time_t tm = time(0);    /* long */
 
-                char *tmpname = (char *)slapi_ch_malloc(strlen(dest_dir) + 32);
-                sprintf(tmpname, "%s/%d", dest_dir, tm);
+                char *tmpname = slapi_ch_smprintf("%s/%d", dest_dir, tm);
                 dest_dir = tmpname;
             }
             else    /* not a directory */
diff --git a/ldap/servers/slapd/back-ldbm/misc.c b/ldap/servers/slapd/back-ldbm/misc.c
index 6f6a7cdb..1cfbbe81 100644
--- a/ldap/servers/slapd/back-ldbm/misc.c
+++ b/ldap/servers/slapd/back-ldbm/misc.c
@@ -14,14 +14,14 @@ void ldbm_nasty(const char* str, int c, int err)
     char *msg = NULL;
     char buffer[200];
     if (err == DB_LOCK_DEADLOCK) {
-        sprintf(buffer,"%s WARNING %d",str,c);
+        PR_snprintf(buffer,200,"%s WARNING %d",str,c);
     LDAPDebug(LDAP_DEBUG_TRACE,"%s, err=%d %s\n",
           buffer,err,(msg = dblayer_strerror( err )) ? msg : "");
    } else if (err == DB_RUNRECOVERY) {
         LDAPDebug(LDAP_DEBUG_ANY,"FATAL ERROR at %s (%d); server stopping as database recovery needed.\n", str,c,0);
     exit(1);
     } else {
-        sprintf(buffer,"%s BAD %d",str,c);
+        PR_snprintf(buffer,200,"%s BAD %d",str,c);
     LDAPDebug(LDAP_DEBUG_ANY,"%s, err=%d %s\n",
           buffer,err,(msg = dblayer_strerror( err )) ? msg : "");
     }
@@ -97,17 +97,12 @@ ldbm_attribute_always_indexed(const char *attrtype)
 char *
 compute_entry_tombstone_dn(const char *entrydn, const char *uniqueid)
 {
-    const char *tombstone_dn_pattern = "%s=%s, %s";
     char *tombstone_dn;
 
     PR_ASSERT(NULL != entrydn);
     PR_ASSERT(NULL != uniqueid);
 
-    tombstone_dn = slapi_ch_malloc(strlen(SLAPI_ATTR_UNIQUEID) +
-        strlen(tombstone_dn_pattern) +
-        strlen(uniqueid) +
-        strlen(entrydn) + 1);
-    sprintf(tombstone_dn, tombstone_dn_pattern,
+    tombstone_dn = slapi_ch_smprintf("%s=%s, %s",
         SLAPI_ATTR_UNIQUEID,
         uniqueid,
         entrydn);
@@ -248,7 +243,7 @@ ldbm_delete_dirs(char *path)
         if (! direntry->name)
             break;
 
-        sprintf(fullpath, "%s/%s", path, direntry->name);
+        PR_snprintf(fullpath, MAXPATHLEN, "%s/%s", path, direntry->name);
         rval = PR_GetFileInfo(fullpath, &info);
         if (PR_SUCCESS == rval)
         {
diff --git a/ldap/servers/slapd/back-ldbm/monitor.c b/ldap/servers/slapd/back-ldbm/monitor.c
index d182cd21..81c86f12 100644
--- a/ldap/servers/slapd/back-ldbm/monitor.c
+++ b/ldap/servers/slapd/back-ldbm/monitor.c
@@ -18,7 +18,7 @@
 
 #define MSETF(_attr, _x) do { \
     char tmp_atype[37]; \
-    sprintf(tmp_atype, _attr, _x); \
+    PR_snprintf(tmp_atype, sizeof(tmp_atype), _attr, _x); \
     MSET(tmp_atype); \
 } while (0)
 
@@ -63,11 +63,11 @@ int ldbm_back_monitor_instance_search(Slapi_PBlock *pb, Slapi_Entry *e,
     vals[1] = NULL;
 
     /* database name */
-    sprintf(buf, "%s", li->li_plugin->plg_name);
+    PR_snprintf(buf, sizeof(buf), "%s", li->li_plugin->plg_name);
     MSET("database");
 
     /* read-only status */
-    sprintf( buf, "%d", inst->inst_be->be_readonly );
+    PR_snprintf( buf, sizeof(buf), "%d", inst->inst_be->be_readonly );
     MSET("readOnly");
 
     /* fetch cache statistics */
@@ -110,7 +110,6 @@ int ldbm_back_monitor_instance_search(Slapi_PBlock *pb, Slapi_Entry *e,
         int fpos = 0;
 #endif
 		char *absolute_pathname = NULL;
-		size_t absolute_pathname_size = 0;
 
         /* only print out stats on files used by this instance */
         if (strlen(mpfstat[i]->file_name) < strlen(inst->inst_dir_name))
@@ -123,11 +122,9 @@ int ldbm_back_monitor_instance_search(Slapi_PBlock *pb, Slapi_Entry *e,
 		 * for the purpose of stat() etc below...
 		 */
 		if (absolute_pathname) {
-			slapi_ch_free(&absolute_pathname);
+			slapi_ch_free_string(&absolute_pathname);
 		}
-		absolute_pathname_size = strlen(inst->inst_parent_dir_name) + strlen(mpfstat[i]->file_name) + 2;
-		absolute_pathname = slapi_ch_malloc(absolute_pathname_size);
-		sprintf(absolute_pathname, "%s%c%s" , inst->inst_parent_dir_name, get_sep(inst->inst_parent_dir_name), mpfstat[i]->file_name );
+		absolute_pathname = slapi_ch_smprintf("%s%c%s" , inst->inst_parent_dir_name, get_sep(inst->inst_parent_dir_name), mpfstat[i]->file_name );
 
 /* NPCTE fix for bugid 544365, esc 0. <P.R> <04-Jul-2001> */
 	/* Hide statistic of deleted files (mainly indexes) */
@@ -146,7 +143,7 @@ int ldbm_back_monitor_instance_search(Slapi_PBlock *pb, Slapi_Entry *e,
 /* end of NPCTE fix for bugid 544365 */
 
         /* Get each file's stats */
-        sprintf(buf, "%s", mpfstat[i]->file_name);
+        PR_snprintf(buf, sizeof(buf), "%s", mpfstat[i]->file_name);
 #ifdef _WIN32
         /* 
          * For NT, switch the last
@@ -172,7 +169,7 @@ int ldbm_back_monitor_instance_search(Slapi_PBlock *pb, Slapi_Entry *e,
         MSETF("dbFilePageOut-%d", i);
 
 		if (absolute_pathname) {
-				slapi_ch_free(&absolute_pathname);
+			slapi_ch_free_string(&absolute_pathname);
 		}
 
     }
@@ -206,7 +203,7 @@ int ldbm_back_monitor_search(Slapi_PBlock *pb, Slapi_Entry *e,
     vals[1] = NULL;
 
     /* database name */
-    sprintf(buf, "%s", li->li_plugin->plg_name);
+    PR_snprintf(buf, sizeof(buf), "%s", li->li_plugin->plg_name);
     MSET("database");
 
     /* we have to ask for file stats in order to get correct global stats */
diff --git a/ldap/servers/slapd/back-ldbm/sort.c b/ldap/servers/slapd/back-ldbm/sort.c
index e3a740c5..b99ab379 100644
--- a/ldap/servers/slapd/back-ldbm/sort.c
+++ b/ldap/servers/slapd/back-ldbm/sort.c
@@ -78,7 +78,7 @@ void sort_log_access(Slapi_PBlock *pb,sort_spec_thing *s,IDList *candidates)
 	int prefix_size = strlen(prefix);
 
 	buffer = stack_buffer;
-	size -= sprintf(buffer,"%s",prefix);
+	size -= PR_snprintf(buffer,sizeof(stack_buffer),"%s",prefix);
 	ret = print_out_sort_spec(buffer+prefix_size,s,&size);
 	if (0 != ret) {
 		/* It wouldn't fit in the buffer */
diff --git a/ldap/servers/slapd/back-ldbm/vlv.c b/ldap/servers/slapd/back-ldbm/vlv.c
index a93cd3e5..ff3aa79a 100644
--- a/ldap/servers/slapd/back-ldbm/vlv.c
+++ b/ldap/servers/slapd/back-ldbm/vlv.c
@@ -280,9 +280,7 @@ vlv_init(ldbm_instance *inst)
 
     /* Initialize lock first time through */
     if(be->vlvSearchList_lock == NULL) {
-        char *rwlockname = (char *)slapi_ch_malloc(sizeof("vlvSearchList") +
-                            strlen(inst->inst_name) + 2);
-        sprintf(rwlockname, "vlvSearchList_%s", inst->inst_name);
+        char *rwlockname = slapi_ch_smprintf("vlvSearchList_%s", inst->inst_name);
         be->vlvSearchList_lock = PR_NewRWLock(PR_RWLOCK_RANK_NONE, rwlockname);
         slapi_ch_free((void**)&rwlockname);
     }
@@ -303,7 +301,7 @@ vlv_init(ldbm_instance *inst)
     if (inst == NULL) {
         basedn = NULL;
     } else {
-        sprintf(buf, "cn=%s,cn=%s,cn=plugins,cn=config",
+        PR_snprintf(buf, sizeof(buf), "cn=%s,cn=%s,cn=plugins,cn=config",
                 inst->inst_name, inst->inst_li->li_plugin->plg_name);
         basedn = buf;
     }
@@ -359,7 +357,7 @@ vlv_remove_callbacks(ldbm_instance *inst) {
     if (inst == NULL) {
         basedn = NULL;
     } else {
-        sprintf(buf, "cn=%s,cn=%s,cn=plugins,cn=config",
+        PR_snprintf(buf, sizeof(buf), "cn=%s,cn=%s,cn=plugins,cn=config",
                 inst->inst_name, inst->inst_li->li_plugin->plg_name);
         basedn = buf;
     }
@@ -1888,8 +1886,7 @@ int vlv_delete_search_entry(Slapi_PBlock *pb, Slapi_Entry* e, ldbm_instance *ins
 	backend *be= inst->inst_be;
 
 	tag1=create_vlv_search_tag(dn);
-	buf=slapi_ch_malloc(strlen("cn=MCC ")+strlen(tag1)+strlen(", cn=")+strlen(inst->inst_name)+strlen(LDBM_PLUGIN_ROOT) + 1);
-	sprintf(buf,"%s%s%s%s%s","cn=MCC ",tag1,", cn=",inst->inst_name,LDBM_PLUGIN_ROOT);
+	buf=slapi_ch_smprintf("%s%s%s%s%s","cn=MCC ",tag1,", cn=",inst->inst_name,LDBM_PLUGIN_ROOT);
 	newdn=slapi_sdn_new_dn_byval(buf);
 	PR_RWLock_Wlock(be->vlvSearchList_lock);
 	p = vlvSearch_finddn((struct vlvSearch *)be->vlvSearchList, newdn);
@@ -1897,8 +1894,7 @@ int vlv_delete_search_entry(Slapi_PBlock *pb, Slapi_Entry* e, ldbm_instance *ins
     {	
 		LDAPDebug( LDAP_DEBUG_ANY, "Deleted Virtual List View Search (%s).\n", p->vlv_name, 0, 0);
 		tag2=create_vlv_search_tag(dn);
-		buf2=slapi_ch_malloc(strlen(TAG)+strlen(tag2)+strlen(buf)+2);
-		sprintf(buf2,"%s%s,%s",TAG,tag2,buf);
+		buf2=slapi_ch_smprintf("%s%s,%s",TAG,tag2,buf);
 		vlvSearch_removefromlist((struct vlvSearch **)&be->vlvSearchList,p->vlv_dn);
 		/* This line release lock to prevent recursive deadlock caused by slapi_internal_delete calling vlvDeleteSearchEntry */
 		PR_RWLock_Unlock(be->vlvSearchList_lock); 
diff --git a/ldap/servers/slapd/back-ldbm/vlv_srch.c b/ldap/servers/slapd/back-ldbm/vlv_srch.c
index ea59dfbc..42012af1 100644
--- a/ldap/servers/slapd/back-ldbm/vlv_srch.c
+++ b/ldap/servers/slapd/back-ldbm/vlv_srch.c
@@ -586,12 +586,10 @@ vlvIndex_init(struct vlvIndex* p, backend *be, struct vlvSearch* pSearch, const
     /* Create an index filename for the search */
     if(vlvIndex_createfilename(p,&filename))
     {
-        p->vlv_filename= slapi_ch_malloc(strlen(file_prefix) + strlen(filename) + strlen(file_suffix) + 1);
-        sprintf(p->vlv_filename,"%s%s%s",file_prefix,filename,file_suffix);
+        p->vlv_filename= slapi_ch_smprintf("%s%s%s",file_prefix,filename,file_suffix);
 
         /* Create an attrinfo structure */
-        p->vlv_attrinfo->ai_type= slapi_ch_malloc(strlen(file_prefix) + strlen(filename) + 1);
-        sprintf(p->vlv_attrinfo->ai_type,"%s%s",file_prefix,filename);
+        p->vlv_attrinfo->ai_type= slapi_ch_smprintf("%s%s",file_prefix,filename);
     	p->vlv_attrinfo->ai_indexmask= INDEX_VLV;
 
         /* Check if the index file actually exists */
diff --git a/ldap/servers/slapd/back-ldif/monitor.c b/ldap/servers/slapd/back-ldif/monitor.c
index 9ea741e1..facd79a3 100644
--- a/ldap/servers/slapd/back-ldif/monitor.c
+++ b/ldap/servers/slapd/back-ldif/monitor.c
@@ -47,7 +47,7 @@ ldif_back_monitor_info( Slapi_PBlock *pb, LDIF *db)
   
   /* Get the database name (be_type) */
   slapi_pblock_get( pb, SLAPI_BE_TYPE, &type);
-  sprintf( buf, "%s", type );
+  PR_snprintf( buf, sizeof(buf), "%s", type );
   val.bv_val = buf;
   val.bv_len = strlen( buf );
   slapi_entry_attr_merge( e, "database", vals );
diff --git a/ldap/servers/slapd/backend.c b/ldap/servers/slapd/backend.c
index 4c917310..bef800e5 100644
--- a/ldap/servers/slapd/backend.c
+++ b/ldap/servers/slapd/backend.c
@@ -16,11 +16,11 @@ be_init( Slapi_Backend *be, const char *type, const char *name, int isprivate, i
     be->be_suffixlock= PR_NewLock();
     be->be_suffixcount= 0;
 	/* e.g. dn: cn=config,cn=NetscapeRoot,cn=ldbm database,cn=plugins,cn=config */
-	sprintf(text, "cn=%s,cn=%s,cn=plugins,cn=config", name, type);
+	PR_snprintf(text, sizeof(text),"cn=%s,cn=%s,cn=plugins,cn=config", name, type);
     be->be_basedn= slapi_ch_strdup(slapi_dn_normalize(text));
-	sprintf(text, "cn=config,cn=%s,cn=%s,cn=plugins,cn=config", name, type);
+	PR_snprintf(text, sizeof(text), "cn=config,cn=%s,cn=%s,cn=plugins,cn=config", name, type);
 	be->be_configdn= slapi_ch_strdup(slapi_dn_normalize(text));
-	sprintf(text, "cn=monitor,cn=%s,cn=%s,cn=plugins,cn=config", name, type);
+	PR_snprintf(text, sizeof(text), "cn=monitor,cn=%s,cn=%s,cn=plugins,cn=config", name, type);
 	be->be_monitordn= slapi_ch_strdup(slapi_dn_normalize(text));
 	be->be_sizelimit = sizelimit;
 	be->be_timelimit = timelimit;
diff --git a/ldap/servers/slapd/backend_manager.c b/ldap/servers/slapd/backend_manager.c
index 10653aa5..842d2a55 100644
--- a/ldap/servers/slapd/backend_manager.c
+++ b/ldap/servers/slapd/backend_manager.c
@@ -417,31 +417,15 @@ be_add_instance (const char *name, void *plugin_identity)
 static char* 
 be_get_instance_dn (const char *index_name, const char *name)
 {
-	int len;
 	char *dn;
 
 	PR_ASSERT (name);
 
-	len =  strlen ("cn=config,") + strlen (name) + 
-		   strlen (LDBM_CLASS_PREFIX) + 4; /* 4 = "cn=" + ',' + '\0' */
-
-	if (index_name)
-	{
-		len += strlen (index_name) + strlen ("cn=index,") + 4; /* 4 = "cn=" + ',' */
-	}
-
-	dn = (char*)slapi_ch_malloc (len);
-	if (dn)
-	{
-		if (index_name)
-		{
-			sprintf (dn, "cn=%s,cn=index,cn=config,cn=%s,%s", index_name, name, 
-					 LDBM_CLASS_PREFIX);				
-		}
-		else
-		{
-			sprintf (dn, "cn=config,cn=%s,%s", name, LDBM_CLASS_PREFIX);	
-		}
+	if (index_name) {
+		dn = slapi_ch_smprintf("cn=%s,cn=index,cn=config,cn=%s,%s", index_name, name, 
+							   LDBM_CLASS_PREFIX);				
+	} else {
+		dn = slapi_ch_smprintf("cn=config,cn=%s,%s", name, LDBM_CLASS_PREFIX);	
 	}
 
 	return dn;
@@ -690,7 +674,6 @@ slapi_lookup_instance_name_by_suffix(char *suffix,
 	const char *thisdn;
 	int thisdnlen;
 	int suffixlen;
-	int maxinst = 1;
 	int i;
 	int rval = -1;
 
diff --git a/ldap/servers/slapd/bind.c b/ldap/servers/slapd/bind.c
index 617b464b..929b9a12 100644
--- a/ldap/servers/slapd/bind.c
+++ b/ldap/servers/slapd/bind.c
@@ -485,7 +485,7 @@ do_bind( Slapi_PBlock *pb )
                         break;
                     case LDAP_AUTH_SASL:
                         /* authtype = SLAPD_AUTH_SASL && saslmech: */
-                        sprintf(authtypebuf, "%s%s", SLAPD_AUTH_SASL, saslmech);
+                        PR_snprintf(authtypebuf, sizeof(authtypebuf), "%s%s", SLAPD_AUTH_SASL, saslmech);
                         authtype = authtypebuf;
                     break;
                     default: /* ??? */
diff --git a/ldap/servers/slapd/ch_malloc.c b/ldap/servers/slapd/ch_malloc.c
index 8e4e0ab2..615a664c 100644
--- a/ldap/servers/slapd/ch_malloc.c
+++ b/ldap/servers/slapd/ch_malloc.c
@@ -355,6 +355,51 @@ slapi_ch_free_string(char **s)
 	slapi_ch_free((void **)s);
 }
 
+/*
+  This function is just like PR_smprintf.  It works like sprintf
+  except that it allocates enough memory to hold the result
+  string and returns that allocated memory to the caller.  The
+  caller must use slapi_ch_free_string to free the memory.
+  It should only be used in those situations that will eventually free
+  the memory using slapi_ch_free_string e.g. allocating a string
+  that will be freed as part of pblock cleanup, or passed in to create
+  a Slapi_DN, or things of that nature.  If you have control of the
+  flow such that the memory will be allocated and freed in the same
+  scope, better to just use PR_smprintf and PR_smprintf_free instead
+  because it is likely faster.
+*/
+char *
+slapi_ch_smprintf(const char *fmt, ...)
+{
+	int ret;
+	int size = 100; /* plus strlen fmt */
+	int incr = 100; /* increment to add each time through */
+	char *p = NULL;
+
+	va_list ap;
+	size += strlen(fmt); /* need at least strlen(fmt) bytes */
+	if ((p = slapi_ch_malloc(size)) == NULL) {
+		return NULL;
+	}
+	while (1) {
+		/* Try to print in the allocated space. */
+		va_start(ap, fmt);
+		ret = PR_vsnprintf(p, size, fmt, ap);
+		va_end(ap);
+		/* If that worked, return the string. */
+		if (ret > -1 && ret < size) {
+			break; /* return p */
+		} else { /* try again with more space */
+			size += incr;
+			if ((p = slapi_ch_realloc(p, size)) == NULL) {
+				break;
+			}
+		}
+	}
+
+	return p;
+}
+
 /* ========================= NT Specific Leak Checking Code ================================== */
 
 #if defined(_WIN32) && defined(DEBUG)
@@ -640,7 +685,7 @@ memory_record_dump( caddr_t data, caddr_t arg )
 	}
 	mr_to_hex_dump(b1, mr->p, size, MR_DUMP_AMOUNT);
 	mr_to_char_dump(b2, mr->p, size, MR_DUMP_AMOUNT);
-	sprintf(b3,"%p %ld %s %s",mr->p,mr->size,b1,b2);
+	PR_snprintf(b3,sizeof(b3),"%p %ld %s %s",mr->p,mr->size,b1,b2);
 	LDAPDebug( LDAP_DEBUG_ANY, "%s\n",b3,0,0);
 	while(mr->ra[frame]!=0)
 	{
diff --git a/ldap/servers/slapd/configdse.c b/ldap/servers/slapd/configdse.c
index b396d685..b78ab7ce 100644
--- a/ldap/servers/slapd/configdse.c
+++ b/ldap/servers/slapd/configdse.c
@@ -339,7 +339,7 @@ modify_config_dse(Slapi_PBlock *pb, Slapi_Entry* entryBefore, Slapi_Entry* e, in
 			if ((mods[i]->mod_op & LDAP_MOD_DELETE) ||
 				(mods[i]->mod_op & LDAP_MOD_ADD)) {
 				rc= LDAP_UNWILLING_TO_PERFORM;
-				sprintf(returntext, "%s attributes is not allowed",
+				PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE, "%s attributes is not allowed",
 						(mods[i]->mod_op & LDAP_MOD_DELETE) ? "Deleting" : "Adding");
 			} else if (mods[i]->mod_op & LDAP_MOD_REPLACE) {
 				/* send all aci modifications to the backend */
@@ -410,7 +410,7 @@ postop_modify_config_dse(Slapi_PBlock *pb, Slapi_Entry* entryBefore, Slapi_Entry
 					continue;
 				while ( *(++p) == ' ' || *p == '\t' );
 				if ( strcasecmp (p, mods[i]->mod_type) == 0 ) {
-					sprintf(returntext,
+					PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE,
 						"The change of %s will not take effect "
 						"until the server is restarted", mods[i]->mod_type);
 					slapi_log_error (SLAPI_LOG_FATAL, NULL, "%s\n", returntext);
diff --git a/ldap/servers/slapd/connection.c b/ldap/servers/slapd/connection.c
index 4e3994d1..8fc6e533 100644
--- a/ldap/servers/slapd/connection.c
+++ b/ldap/servers/slapd/connection.c
@@ -173,7 +173,6 @@ void
 connection_reset(Connection* conn, int ns, PRNetAddr * from, int fromLen, int is_SSL)
 {
     char *		pTmp = is_SSL ? "SSL " : "";
-    TCPLEN_T		l_fromLen = (TCPLEN_T)fromLen;
     TCPLEN_T		addrlen, destaddrlen;
     struct sockaddr_in	addr, destaddr;
     char		*str_ip, *str_destip, buf_ip[ 256 ], buf_destip[ 256 ];
diff --git a/ldap/servers/slapd/conntable.c b/ldap/servers/slapd/conntable.c
index 0eb82aeb..119ca8d7 100644
--- a/ldap/servers/slapd/conntable.c
+++ b/ldap/servers/slapd/conntable.c
@@ -220,6 +220,7 @@ connection_table_dump_active_connection (Connection *c)
                     c->c_mutex, c->c_next, c->c_prev);
 }
 
+#if 0 /* useful for debugging */
 static void 
 connection_table_dump_active_connections (Connection_Table *ct)
 {
@@ -237,6 +238,7 @@ connection_table_dump_active_connections (Connection_Table *ct)
     slapi_log_error(SLAPI_LOG_FATAL, "connection", "********** END DUMP ************\n");
 	PR_Unlock(ct->table_mutex);
 }
+#endif
 
 /*
  * There's a double linked list of active connections running through the array
diff --git a/ldap/servers/slapd/daemon.c b/ldap/servers/slapd/daemon.c
index ba8df8dd..66088cbc 100644
--- a/ldap/servers/slapd/daemon.c
+++ b/ldap/servers/slapd/daemon.c
@@ -141,7 +141,7 @@ void *slapd_service_exit_wait()
 
 	_splitpath( module, drive, dir, fname, ext );
 
-	sprintf( exit_file_name, "%s%s%s", drive, dir, "exitnow.txt" );
+	PR_snprintf( exit_file_name, sizeof(exit_file_name), "%s%s%s", drive, dir, "exitnow.txt" );
 
     LDAPDebug( LDAP_DEBUG_ANY, "PURIFYING - Create %s to terminate the process.\n", exit_file_name, 0, 0 );
 
@@ -163,7 +163,7 @@ void *slapd_service_exit_wait()
 	DWORD dwWait;
 	char szDoneEvent[256];
 
-	sprintf(szDoneEvent, "NS_%s", pszServerName);
+	PR_snprintf(szDoneEvent, sizeof(szDoneEvent), "NS_%s", pszServerName);
 
 	hServDoneEvent = CreateEvent( NULL,			// default security attributes (LocalSystem)
 								  TRUE,			// manual reset event
@@ -242,8 +242,6 @@ accept_and_configure(int s, PRFileDesc *pr_acceptfd, PRNetAddr *pr_netaddr,
 	int addrlen, int secure, PRFileDesc **pr_clonefd)
 {
 	int ns = 0;
-	int ioblock_timeout = config_get_ioblocktimeout();
-	int enable_nagle = config_get_nagle();
 
 	PRIntervalTime pr_timeout = PR_MillisecondsToInterval(slapd_wakeup_timer);
 
@@ -2529,7 +2527,6 @@ int configure_pr_socket( PRFileDesc **pr_socket, int secure )
 {
 	int ns = 0;
 	int reservedescriptors = config_get_reservedescriptors();
-	int ioblock_timeout = config_get_ioblocktimeout();
 	int enable_nagle = config_get_nagle();
 
 	PRSocketOptionData pr_socketoption;
@@ -2641,7 +2638,6 @@ int configure_pr_socket( PRFileDesc **pr_socket, int secure )
 void configure_ns_socket( int * ns )
 {
 
-	int ioblock_timeout = config_get_ioblocktimeout();
 	int enable_nagle = config_get_nagle();
         int on;
 
diff --git a/ldap/servers/slapd/dn.c b/ldap/servers/slapd/dn.c
index 71e2fc8d..d1166054 100644
--- a/ldap/servers/slapd/dn.c
+++ b/ldap/servers/slapd/dn.c
@@ -1353,7 +1353,7 @@ int
 slapi_sdn_get_ndn_len(const Slapi_DN *sdn)
 {
     int r= 0;
-	const char *ndn=slapi_sdn_get_ndn(sdn);
+	(void)slapi_sdn_get_ndn(sdn); /* does the normalization if needed */
 	if(sdn->ndn!=NULL)
 	{
 		r= sdn->ndn_len;	
diff --git a/ldap/servers/slapd/dse.c b/ldap/servers/slapd/dse.c
index 4ce9063e..2c47bcd5 100644
--- a/ldap/servers/slapd/dse.c
+++ b/ldap/servers/slapd/dse.c
@@ -327,11 +327,9 @@ dse_new( char *filename, char *tmpfilename, char *backfilename, char *startokfil
     char *realconfigdir = NULL;
 
     if (configdir!=NULL) {
-		realconfigdir = slapi_ch_malloc(strlen(configdir)+1);
-		strcpy(realconfigdir, configdir);
+		realconfigdir = slapi_ch_strdup(configdir);
     } else if (id!=NULL) {
-		realconfigdir = slapi_ch_malloc(strlen(id)+strlen(config_sub_dir)+3);
-		sprintf(realconfigdir, "%s/%s", id, config_sub_dir);
+		realconfigdir = slapi_ch_smprintf("%s/%s", id, config_sub_dir);
     }
     if(realconfigdir!=NULL)
     {
@@ -342,17 +340,13 @@ dse_new( char *filename, char *tmpfilename, char *backfilename, char *startokfil
             /* Set the full path name for the config DSE entry */
 			if (!strstr(filename, realconfigdir))
 			{
-				pdse->dse_filename = slapi_ch_malloc( strlen( realconfigdir ) +
-													  strlen( filename ) + 3 );
-				sprintf( pdse->dse_filename, "%s/%s", realconfigdir, filename );
+				pdse->dse_filename = slapi_ch_smprintf("%s/%s", realconfigdir, filename );
 			}
 			else
 				pdse->dse_filename = slapi_ch_strdup(filename);
 
 			if (!strstr(tmpfilename, realconfigdir)) {
-				pdse->dse_tmpfile = slapi_ch_malloc( strlen( realconfigdir ) +
-													 strlen( tmpfilename ) + 3 );
-				sprintf( pdse->dse_tmpfile, "%s/%s", realconfigdir, tmpfilename );
+				pdse->dse_tmpfile = slapi_ch_smprintf("%s/%s", realconfigdir, tmpfilename );
 			}
 			else
 				pdse->dse_tmpfile = slapi_ch_strdup(tmpfilename);
@@ -360,9 +354,7 @@ dse_new( char *filename, char *tmpfilename, char *backfilename, char *startokfil
 			if ( backfilename != NULL )
 			{
 				if (!strstr(backfilename, realconfigdir)) {
-					pdse->dse_fileback = slapi_ch_malloc( strlen( realconfigdir ) +
-														 strlen( backfilename ) + 3 );
-					sprintf( pdse->dse_fileback, "%s/%s", realconfigdir, backfilename );
+					pdse->dse_fileback = slapi_ch_smprintf("%s/%s", realconfigdir, backfilename );
 				}
 				else
 					pdse->dse_fileback = slapi_ch_strdup(backfilename);
@@ -373,9 +365,7 @@ dse_new( char *filename, char *tmpfilename, char *backfilename, char *startokfil
 			if ( startokfilename != NULL )
 			{
 				if (!strstr(startokfilename, realconfigdir)) {
-					pdse->dse_filestartOK = slapi_ch_malloc( strlen( realconfigdir ) +
-														 strlen( startokfilename ) + 3 );
-					sprintf( pdse->dse_filestartOK, "%s/%s", realconfigdir, startokfilename );
+					pdse->dse_filestartOK = slapi_ch_smprintf("%s/%s", realconfigdir, startokfilename );
 				}
 				else
 					pdse->dse_filestartOK = slapi_ch_strdup(startokfilename);
@@ -1343,8 +1333,8 @@ dse_delete_entry(struct dse* pdse, Slapi_PBlock *pb, const Slapi_Entry *e)
 
 	/* keep write lock for both tree deleting and file writing */
 	PR_RWLock_Wlock(pdse->dse_rwlock);
-    if (deleted_node = (struct dse_node *)avl_delete(&pdse->dse_tree,
-													 n, entry_dn_cmp))
+    if ((deleted_node = (struct dse_node *)avl_delete(&pdse->dse_tree,
+													  n, entry_dn_cmp)))
 		dse_node_delete(&deleted_node);
     dse_node_delete(&n);
 
diff --git a/ldap/servers/slapd/entry.c b/ldap/servers/slapd/entry.c
index d4d49733..0989b37f 100644
--- a/ldap/servers/slapd/entry.c
+++ b/ldap/servers/slapd/entry.c
@@ -176,7 +176,7 @@ str2entry_fast( char *s, int flags, int read_stateinfo )
 			if ( errmsg != NULL ) {
 			         LDAPDebug( LDAP_DEBUG_PARSE, "%s", errmsg, 0, 0 );
 				 /* the memory below was not allocated by the slapi_ch_ functions */
-				 slapi_ch_free( (void**)&errmsg );
+				 PR_smprintf_free(errmsg );
 			}
 			LDAPDebug( LDAP_DEBUG_TRACE,
 			    "<= str2entry_fast NULL (parse_line)\n", 0, 0, 0 );
@@ -584,7 +584,7 @@ str2entry_dupcheck( char *s, int flags, int read_stateinfo )
 		    if ( errmsg != NULL ) {
 		             LDAPDebug( LDAP_DEBUG_PARSE, "%s", errmsg, 0, 0 );
 			     /* the memory below was not allocated by the slapi_ch_ functions */
-			     slapi_ch_free( (void**)&errmsg );
+			     PR_smprintf_free(errmsg );
 		    }
 		    LDAPDebug( LDAP_DEBUG_TRACE,
 			    "<= slapi_str2entry NULL (parse_line)\n", 0, 0, 0 );
@@ -3018,8 +3018,7 @@ slapi_entries_diff(Slapi_Entry **old_entries, Slapi_Entry **curr_entries,
 
     if (NULL != logging_prestr && '\0' != *logging_prestr)
     {
-        my_logging_prestr = (char *)slapi_ch_malloc(strlen(logging_prestr) + 2);
-        sprintf(my_logging_prestr, "%s ", logging_prestr);
+        my_logging_prestr = slapi_ch_smprintf("%s ", logging_prestr);
     }
 
     for (oep = old_entries; oep != NULL && *oep != NULL; )
diff --git a/ldap/servers/slapd/extendop.c b/ldap/servers/slapd/extendop.c
index c4da7c89..0d9a573b 100644
--- a/ldap/servers/slapd/extendop.c
+++ b/ldap/servers/slapd/extendop.c
@@ -72,7 +72,7 @@ static void extop_handle_import_start(Slapi_PBlock *pb, char *extoid,
 		/* slapi_str2entry modify its dn parameter so we must copy
 		 * this string each time we call it !
 		 */
-		sprintf(dn, "dn: oid=%s,cn=features,cn=config",
+		PR_snprintf(dn, sizeof(dn), "dn: oid=%s,cn=features,cn=config",
 			EXTOP_BULK_IMPORT_START_OID);
 
 		dummyAttrs[0] = dummyAttr;
diff --git a/ldap/servers/slapd/factory.c b/ldap/servers/slapd/factory.c
index dac2eb8c..d9acf0b9 100644
--- a/ldap/servers/slapd/factory.c
+++ b/ldap/servers/slapd/factory.c
@@ -445,7 +445,6 @@ void
 slapi_set_object_extension(int objecttype, void *object, int extensionhandle,
                            void *extension)
 {
-    void *object_extension = NULL;
     struct factory_type *ft = factory_type_store_get_factory_type(objecttype);
     if (ft != NULL) {
         char *object_base = (char *)object;
diff --git a/ldap/servers/slapd/fedse.c b/ldap/servers/slapd/fedse.c
index 6ef97b62..2b30760f 100644
--- a/ldap/servers/slapd/fedse.c
+++ b/ldap/servers/slapd/fedse.c
@@ -1691,7 +1691,7 @@ search_easter_egg( Slapi_PBlock *pb, Slapi_Entry *entryBefore, Slapi_Entry *entr
     char *fstr= NULL;
     int retmalloc= 0;
 	char eggfilter[64];
-	sprintf(eggfilter,"(objectclass=%s)",EGG_OBJECT_CLASS);
+	PR_snprintf(eggfilter,sizeof(eggfilter),"(objectclass=%s)",EGG_OBJECT_CLASS);
     slapi_pblock_get( pb, SLAPI_SEARCH_STRFILTER, &fstr );
     if(fstr!=NULL && strcasecmp(fstr,eggfilter)==0)
     {
@@ -1711,7 +1711,7 @@ search_easter_egg( Slapi_PBlock *pb, Slapi_Entry *entryBefore, Slapi_Entry *entr
 		    if ( errmsg != NULL ) {
 		             slapi_log_error( SLAPI_LOG_PARSE, "dse", "%s", errmsg );
 			     /* the memory below was not allocated by the slapi_ch_ functions */
-			     slapi_ch_free( (void**)&errmsg );
+			     PR_smprintf_free(errmsg );
 		    }
 		    return SLAPI_DSE_CALLBACK_ERROR;
 		}
@@ -1844,8 +1844,7 @@ int fedse_create_startOK(char *filename,  char *startokfilename, const char *con
         realconfigdir = slapi_ch_malloc(strlen(configdir)+1);
         strcpy(realconfigdir, configdir);
     } else if (id!=NULL) {
-        realconfigdir = slapi_ch_malloc(strlen(id)+strlen(config_sub_dir)+3);
-        sprintf(realconfigdir, "%s/%s", id, config_sub_dir);
+        realconfigdir = slapi_ch_smprintf("%s/%s", id, config_sub_dir);
     }
 	slapi_ch_free_string(&id);
     if(realconfigdir!=NULL)
@@ -1853,17 +1852,13 @@ int fedse_create_startOK(char *filename,  char *startokfilename, const char *con
 		/* Set the full path name for the config DSE entry */
 		if (!strstr(filename, realconfigdir))
 		{
-			dse_filename = slapi_ch_malloc( strlen( realconfigdir ) +
-												  strlen( filename ) + 3 );
-			sprintf( dse_filename, "%s/%s", realconfigdir, filename );
+			dse_filename = slapi_ch_smprintf("%s/%s", realconfigdir, filename );
 		}
 		else
 			dse_filename = slapi_ch_strdup(filename);
 
 		if (!strstr(startokfilename, realconfigdir)) {
-			dse_filestartOK = slapi_ch_malloc( strlen( realconfigdir ) +
-												 strlen( startokfilename ) + 3 );
-			sprintf( dse_filestartOK, "%s/%s", realconfigdir, startokfilename );
+			dse_filestartOK = slapi_ch_smprintf("%s/%s", realconfigdir, startokfilename );
 		}
 		else
 			dse_filestartOK = slapi_ch_strdup(startokfilename);
diff --git a/ldap/servers/slapd/filter.c b/ldap/servers/slapd/filter.c
index 1a382adf..b62fa425 100644
--- a/ldap/servers/slapd/filter.c
+++ b/ldap/servers/slapd/filter.c
@@ -101,18 +101,9 @@ filter_escape_filter_value_extended(struct slapi_filter *f)
 {
     char ebuf[BUFSIZ], *ptr;
     const char *estr;
-    size_t len = 9;
     
     estr  = escape_filter_value( f->f_mr_value.bv_val, f->f_mr_value.bv_len, ebuf );
-    if ( f->f_mr_type ) {
-        len += strlen( f->f_mr_type );
-    }
-    len += strlen(estr);
-    if ( f->f_mr_oid ) {
-        len += strlen( f->f_mr_oid );
-    }
-    ptr = slapi_ch_malloc( len );
-    sprintf( ptr, FILTER_EXTENDED_FMT,
+	ptr = slapi_ch_smprintf(FILTER_EXTENDED_FMT,
         f->f_mr_type ? f->f_mr_type : "",
         f->f_mr_dnAttrs ? ":dn" : "",
         f->f_mr_oid ? ":" : "",
@@ -131,8 +122,7 @@ filter_escape_filter_value(struct slapi_filter *f, const char *fmt, size_t len)
     
 	estr  = escape_filter_value( f->f_avvalue.bv_val, f->f_avvalue.bv_len, ebuf );
 	filter_compute_hash(f);
-    ptr = slapi_ch_malloc( len + strlen(f->f_avtype) + strlen( estr ));
-    sprintf( ptr, fmt, f->f_avtype, estr );
+    ptr = slapi_ch_smprintf(fmt, f->f_avtype, estr );
     return ptr;
 }
 
@@ -277,8 +267,7 @@ get_filter_internal( Connection *conn, BerElement *ber,
 			f->f_type = slapi_attr_syntax_normalize( type );
 			free( type );
 			filter_compute_hash(f);
-			*fstr = slapi_ch_malloc( 5 + strlen( f->f_type ) );
-			sprintf( *fstr, "(%s=*)", f->f_type );
+			*fstr = slapi_ch_smprintf( "(%s=*)", f->f_type );
 		}
 		break;
 
@@ -318,8 +307,7 @@ get_filter_internal( Connection *conn, BerElement *ber,
 					curdepth, subentry_dont_rewrite, has_tombstone_filter ))
 					== 0 ) {
 			filter_compute_hash(f);
-			*fstr = slapi_ch_malloc( 4 + strlen( ftmp ) );
-			sprintf( *fstr, "(&%s)", ftmp );
+			*fstr = slapi_ch_smprintf( "(&%s)", ftmp );
 			slapi_ch_free((void**)&ftmp );
 		}
 		break;
@@ -330,8 +318,7 @@ get_filter_internal( Connection *conn, BerElement *ber,
 					curdepth, subentry_dont_rewrite, has_tombstone_filter ))
 					== 0 ) {
 			filter_compute_hash(f);
-			*fstr = slapi_ch_malloc( 4 + strlen( ftmp ) );
-			sprintf( *fstr, "(|%s)", ftmp );
+			*fstr = slapi_ch_smprintf( "(|%s)", ftmp );
 			slapi_ch_free((void**)&ftmp );
 		}
 		break;
@@ -343,8 +330,7 @@ get_filter_internal( Connection *conn, BerElement *ber,
 					curdepth, subentry_dont_rewrite, has_tombstone_filter ))
 					== 0 ) {
 			filter_compute_hash(f);
-			*fstr = slapi_ch_malloc( 4 + strlen( ftmp ) );
-			sprintf( *fstr, "(!%s)", ftmp );
+			*fstr = slapi_ch_smprintf( "(!%s)", ftmp );
 			slapi_ch_free((void**)&ftmp );
 		}
 		break;
@@ -1193,7 +1179,7 @@ slapi_filter_to_string_internal( const struct slapi_filter *f, char *buf, size_t
 			   specifier .* with the bv_len as the length to avoid reading
 			   past bv_len in bv_val */
 			sprintf( buf, "(%s%s%.*s)", f->f_ava.ava_type, operator,
-					 f->f_ava.ava_value.bv_len,
+					 (int)f->f_ava.ava_value.bv_len,
 					 f->f_ava.ava_value.bv_val );
 			*bufsize -= size;
 		}
diff --git a/ldap/servers/slapd/generation.c b/ldap/servers/slapd/generation.c
index c9b8fb5b..3da1271f 100644
--- a/ldap/servers/slapd/generation.c
+++ b/ldap/servers/slapd/generation.c
@@ -24,8 +24,7 @@ new_dataversion()
 #else
     gmtime_r (&curtime, &t);
 #endif
-    dataversion = slapi_ch_malloc(16);
-    sprintf (dataversion, "0%.4li%.2i%.2i%.2i%.2i%.2i", 1900L + t.tm_year, 1 + t.tm_mon, t.tm_mday, t.tm_hour, t.tm_min, t.tm_sec);
+    dataversion = slapi_ch_smprintf("0%.4li%.2i%.2i%.2i%.2i%.2i", 1900L + t.tm_year, 1 + t.tm_mon, t.tm_mday, t.tm_hour, t.tm_min, t.tm_sec);
 	return dataversion;
 }
 
diff --git a/ldap/servers/slapd/getfilelist.c b/ldap/servers/slapd/getfilelist.c
index 38f334e3..48990bf2 100644
--- a/ldap/servers/slapd/getfilelist.c
+++ b/ldap/servers/slapd/getfilelist.c
@@ -35,15 +35,12 @@ add_file_to_list(caddr_t data, caddr_t arg)
 {
 	struct data_wrapper *dw = (struct data_wrapper *)arg;
 	if (dw) {
-		size_t size;
 		/* max is number of entries; the range of n is 0 - max-1 */
 		PR_ASSERT(dw->n <= dw->max);
 		PR_ASSERT(dw->list);
 		PR_ASSERT(data);
 		/* this strdup is free'd by free_filelist */
-		size = strlen(dw->dirname) + strlen(data) + 5;
-		dw->list[dw->n] = slapi_ch_calloc(size, 1);
-		sprintf(dw->list[dw->n++], "%s/%s", dw->dirname, data);
+		dw->list[dw->n++] = slapi_ch_smprintf("%s/%s", dw->dirname, data);
 		return 0;
 	}
 
@@ -61,10 +58,7 @@ file_is_type_x(const char *dirname, const char *filename, PRFileType x)
 {
 	struct PRFileInfo inf;
 	int status = 0;
-	size_t size = strlen(dirname) + strlen(filename) + 2; /* 1 for slash + 1 for null */
-	char *fullpath = slapi_ch_calloc(sizeof(char), size);
-
-	sprintf(fullpath, "%s/%s", dirname, filename);
+	char *fullpath = slapi_ch_smprintf("%s/%s", dirname, filename);
 	if (PR_SUCCESS == PR_GetFileInfo(fullpath, &inf) &&
 		inf.type == x)
 		status = 1;
@@ -197,14 +191,15 @@ free_filelist(char **filelist)
 /**
  * Returns a list of files in order of "priority" where priority is defined
  * as:
- * The filename must begin with the letter S.  The next two characters in
- * the filename are digits representing a number from 00 to 99.  The lower the
- * number the higher the priority.  For example, S00 is in the list before S01,
- * and S99 is the last item in the list.  The ordering of files with the same
- * priority cannot be guaranteed.  The pattern is the grep style regular expression
- * of filenames to match which is applied to the end of the string.
- * If you are a Solaris person, you may recognize this as the rules for init level
- * initialization using shell scripts under /etc/rcX.d/
+ * The first two characters in the filename are digits representing a
+ * number from 00 to 99.  The lower the number the higher the
+ * priority.  For example, 00 is in the list before 01, and 99 is the
+ * last item in the list.  The ordering of files with the same
+ * priority cannot be guaranteed.  The pattern is the grep style
+ * regular expression of filenames to match which is applied to the
+ * end of the string.  If you are a Solaris person, you may recognize
+ * this as the rules for init level initialization using shell scripts
+ * under /etc/rcX.d/
  */
 char **
 get_priority_filelist(const char *directory, const char *pattern)
@@ -212,15 +207,12 @@ get_priority_filelist(const char *directory, const char *pattern)
 	char *basepattern = "^[0-9][0-9]";
 	char *genericpattern = ".*"; /* used if pattern is null */
 	char *bigpattern = 0;
-	size_t len = 0;
 	char **retval = 0;
 
 	if (!pattern)
 		pattern = genericpattern;
 
-	len = strlen(basepattern) + strlen(pattern) + 1;
-	bigpattern = slapi_ch_calloc(sizeof(char), len);
-	sprintf(bigpattern, "%s%s", basepattern, pattern);
+	bigpattern = slapi_ch_smprintf("%s%s", basepattern, pattern);
 
 	retval = get_filelist(directory, bigpattern, 0, 0, 1);
 
diff --git a/ldap/servers/slapd/index_subsystem.c b/ldap/servers/slapd/index_subsystem.c
index f4946f3c..c8415496 100644
--- a/ldap/servers/slapd/index_subsystem.c
+++ b/ldap/servers/slapd/index_subsystem.c
@@ -73,7 +73,6 @@ static int index_subsys_decoder_done(Slapi_Filter *f);
 static int index_subsys_assign_decoders(Slapi_Filter *f);
 static int index_subsys_assign_decoder(Slapi_Filter *f);
 static int index_subsys_group_decoders(Slapi_Filter *f);
-static indexEntry *index_subsys_find_decoder(Slapi_Filter *f);
 static int index_subsys_unlink_subfilter(Slapi_Filter *fcomplex, Slapi_Filter *fsub);
 static int index_subsys_index_matches_associated(indexEntry *index, Slapi_Filter *f);
 
@@ -996,7 +995,6 @@ int slapi_index_register_index(char *plugin_id, indexed_item *registration_item,
 	indexEntry *index;
 	int a_matched_index = 0;
 	Slapi_Filter *tmp_f = slapi_str2filter(registration_item->index_filter);
-	int i = 0;
 	Slapi_Backend *be;
 	
 	if(!theCache)
diff --git a/ldap/servers/slapd/libglobs.c b/ldap/servers/slapd/libglobs.c
index 06d5aa16..f5816dcd 100644
--- a/ldap/servers/slapd/libglobs.c
+++ b/ldap/servers/slapd/libglobs.c
@@ -1165,7 +1165,7 @@ config_set_pw_storagescheme( const char *attrname, char *value, char *errorbuf,
 	they are in clear. We don't take it */ 
 
 	if ( scheme_list != NULL ) {
-		sprintf( errorbuf,
+			PR_snprintf ( errorbuf, SLAPI_DSE_RETURNTEXT_SIZE,
 				"pw_storagescheme: invalid encoding scheme - %s\nValid values are: %s\n", value, scheme_list );
 	}
 	retVal = LDAP_UNWILLING_TO_PERFORM;
@@ -1445,14 +1445,6 @@ config_set_pw_exp( const char *attrname, char *value, char *errorbuf, int apply
   int retVal = LDAP_SUCCESS;
   slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig();
 
-  /* password policy is disabled in DirLite. */
-  if ( config_is_slapd_lite() ) {
-	if ( NULL != value && strcasecmp(value, "off") != 0 ) {
-	  PR_snprintf ( errorbuf, SLAPI_DSE_RETURNTEXT_SIZE, LITE_PW_EXP_ERR );
-	  retVal = LDAP_UNWILLING_TO_PERFORM;
-	  return retVal;
-	}
-  }
   retVal = config_set_onoff ( attrname,
 							  value, 
 							  &(slapdFrontendConfig->pw_policy.pw_exp),
@@ -1765,7 +1757,6 @@ int
 config_set_rootpw( const char *attrname, char *value, char *errorbuf, int apply ) {
   int retVal =  LDAP_SUCCESS;
   slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig();
-  char *hashedpw = NULL;
   struct pw_scheme *is_hashed = NULL;
 
   if ( config_value_is_null( attrname, value, errorbuf, 0 )) {
@@ -1787,8 +1778,8 @@ config_set_rootpw( const char *attrname, char *value, char *errorbuf, int apply
 	free_pw_scheme(is_hashed);
   }
   else {
-	hashedpw = (slapdFrontendConfig->rootpwstoragescheme->pws_enc)(value); 
-	slapdFrontendConfig->rootpw = slapi_ch_strdup ( hashedpw );
+	/* pwd enc func returns slapi_ch_malloc memory */
+	slapdFrontendConfig->rootpw = (slapdFrontendConfig->rootpwstoragescheme->pws_enc)(value); 
   }
   
   CFG_UNLOCK_WRITE(slapdFrontendConfig);
@@ -2032,17 +2023,7 @@ config_set_maxdescriptors( const char *attrname, char *value, char *errorbuf, in
   if ( 0 == getrlimit( RLIMIT_NOFILE, &rlp ) ) {
 	  maxVal = (int)rlp.rlim_max;
   }
-  
-  /* DirLite: limit the number of concurent connections by limiting 
-   * maxdescriptors.
-   */
-
-  if ( config_is_slapd_lite() && nValue > SLAPD_LITE_MAXDESCRIPTORS ) {
-	PR_snprintf ( errorbuf, SLAPI_DSE_RETURNTEXT_SIZE, LITE_MAXDESCRIPTORS_ERR );
-	retVal = LDAP_UNWILLING_TO_PERFORM;
-	nValue = SLAPD_LITE_MAXDESCRIPTORS;
-  }
-	  
+  	  
   if ( nValue < 1 || nValue > maxVal ) {
 	PR_snprintf ( errorbuf, SLAPI_DSE_RETURNTEXT_SIZE, "%s: invalid value %d, maximum file descriptors must range from 1 to %d (the current process limit)",
 			attrname, nValue, maxVal );
@@ -2220,12 +2201,6 @@ config_set_defaultreferral( const char *attrname, struct berval **value, char *e
   int retVal =  LDAP_SUCCESS;
   slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig();
   
-  if ( config_is_slapd_lite() ) {
-	PR_snprintf ( errorbuf, SLAPI_DSE_RETURNTEXT_SIZE, LITE_DEFAULT_REFERRAL_ERR );
-	retVal = LDAP_UNWILLING_TO_PERFORM;
-	return retVal;
-  }
-
   if ( config_value_is_null( attrname, (char *)value, errorbuf, 0 )) {
 	return LDAP_OPERATIONS_ERROR;
   }
@@ -2531,10 +2506,6 @@ int config_set_referral_mode(const char *attrname, char *url, char *errorbuf, in
     slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig();
 
 	slapdFrontendConfig->refer_mode=REFER_MODE_OFF;
-	if ( config_is_slapd_lite() ) {
-	  PR_snprintf ( errorbuf, SLAPI_DSE_RETURNTEXT_SIZE, LITE_REFERRAL_MODE_ERR );
-	  return LDAP_UNWILLING_TO_PERFORM;
-	}
 
     if ((!url) || (!url[0])) {
 	strcpy(errorbuf, "referral url must have a value");
@@ -2554,7 +2525,7 @@ config_set_versionstring( const char *attrname, char *version, char *errorbuf, i
   slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig();
   
   if ((!version) || (!version[0])) {
-	strcpy(errorbuf, "versionstring must have a value");
+	PL_strncpyz(errorbuf, "versionstring must have a value", SLAPI_DSE_RETURNTEXT_SIZE);
 	return LDAP_OPERATIONS_ERROR;
   }
   if (apply) {
diff --git a/ldap/servers/slapd/libslapd.def b/ldap/servers/slapd/libslapd.def
index 44f5cb70..eee9cc2e 100644
--- a/ldap/servers/slapd/libslapd.def
+++ b/ldap/servers/slapd/libslapd.def
@@ -401,7 +401,7 @@ EXPORTS
     slapi_matchingrule_get                  @398
     slapi_matchingrule_set                  @399
 	config_set_port 	@400
-; Available for reuse 	@401
+	slapi_ch_smprintf 	@401
 	config_set_secureport 	@402
 	config_set_SSLclientAuth 	@403
 	config_set_workingdir	@404
diff --git a/ldap/servers/slapd/localhost.c b/ldap/servers/slapd/localhost.c
index 3afb9331..0a367ad7 100644
--- a/ldap/servers/slapd/localhost.c
+++ b/ldap/servers/slapd/localhost.c
@@ -226,7 +226,7 @@ get_config_DN()
 						 0, 0, 0);
 			c = slapi_ch_malloc (20);
 		}
-		sprintf (c, "cn=ldap://%s:%lu", host ? host : "", config_get_port());
+		sprintf (c, "cn=ldap://%s:%d", host ? host : "", config_get_port());
 		config_DN = c;
 	}
 
diff --git a/ldap/servers/slapd/lock.c b/ldap/servers/slapd/lock.c
index ef21b841..6f13497e 100644
--- a/ldap/servers/slapd/lock.c
+++ b/ldap/servers/slapd/lock.c
@@ -25,8 +25,7 @@ lock_fopen( char *fname, char *type, FILE **lfp )
 	char	buf[MAXPATHLEN];
 
 	/* open the lock file */
-	strcpy( buf, fname );
-	strcat( buf, ".lock" );
+	PR_snprintf( buf, MAXPATHLEN, "%s%s", fname, ".lock" );
 	if ( (*lfp = fopen( buf, "w" )) == NULL ) {
 		LDAPDebug( LDAP_DEBUG_ANY, "could not open \"%s\"\n", buf, 0, 0 );
 		return( NULL );
diff --git a/ldap/servers/slapd/log.c b/ldap/servers/slapd/log.c
index 10b6032b..091abca2 100644
--- a/ldap/servers/slapd/log.c
+++ b/ldap/servers/slapd/log.c
@@ -184,7 +184,9 @@ void g_set_detached(int val)
 void g_log_init(int log_enabled)
 {
 	slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig();
+#if defined( XP_WIN32 )
 	char * instancedir = NULL;
+#endif
 
 	ts_time_lock = PR_NewLock();
 	if (! ts_time_lock)
@@ -208,7 +210,7 @@ void g_log_init(int log_enabled)
     if( !hSlapdEventSource  )
     {
         char szMessage[256];
-        sprintf( szMessage, "Directory Server %s is terminating. Failed "
+        PR_snprintf( szMessage, sizeof(szMessage), "Directory Server %s is terminating. Failed "
             "to set the EventLog source.", pszServerName);
         MessageBox(GetDesktopWindow(), szMessage, " ", 
             MB_ICONEXCLAMATION | MB_OK);
@@ -1568,7 +1570,7 @@ int error_log_openf( char *pathname, int locked)
 	loginfo.log_error_file = slapi_ch_strdup(pathname); 		
 
 	/* store the rotation info fiel path name */
-	 sprintf (buf, "%s.rotationinfo",pathname);
+	PR_snprintf (buf, sizeof(buf), "%s.rotationinfo",pathname);
 	slapi_ch_free ((void**)&loginfo.log_errorinfo_file);
 	loginfo.log_errorinfo_file = slapi_ch_strdup ( buf );
 
@@ -1607,7 +1609,7 @@ audit_log_openf( char *pathname, int locked)
 	loginfo.log_audit_file = slapi_ch_strdup ( pathname );
 
 	/* store the rotation info file path name */
-	sprintf (buf, "%s.rotationinfo",pathname);
+	PR_snprintf (buf, sizeof(buf), "%s.rotationinfo",pathname);
 	loginfo.log_auditinfo_file = slapi_ch_strdup ( buf );
 
 	/*
@@ -1795,7 +1797,7 @@ vslapd_log_error(
     else  /* stderr is always unbuffered */
 	fprintf(stderr, "%s", buffer);
 
-    free (vbuf);
+    PR_smprintf_free (vbuf);
     return( 0 );
 }
 
@@ -1962,7 +1964,7 @@ int access_log_openf(char *pathname, int locked)
 	loginfo.log_access_file = slapi_ch_strdup ( pathname );
 
 	/* store the rotation info fiel path name */
-	sprintf (buf, "%s.rotationinfo",pathname);
+	PR_snprintf (buf, sizeof(buf), "%s.rotationinfo",pathname);
 	loginfo.log_accessinfo_file = slapi_ch_strdup ( buf );
 
 	/*
@@ -2038,7 +2040,7 @@ log__open_accesslogfile(int logfile_state, int locked)
 			log->l_size = f_size;
 
 			log_convert_time (log->l_ctime, tbuf, 1 /*short */);
-			sprintf(newfile, "%s.%s", loginfo.log_access_file, tbuf);
+			PR_snprintf(newfile, sizeof(newfile), "%s.%s", loginfo.log_access_file, tbuf);
 			if (PR_Rename (loginfo.log_access_file, newfile) != PR_SUCCESS) {
 				loginfo.log_access_fdes = NULL;
     				if (!locked)  LOG_ACCESS_UNLOCK_WRITE();
@@ -2085,13 +2087,13 @@ log__open_accesslogfile(int logfile_state, int locked)
 	/* write the header in the log */
 	now = current_time();
 	log_convert_time (now, tbuf, 2 /* long */);
-	sprintf (buffer,"LOGINFO:Log file created at: %s (%lu)\n", tbuf, now);
+	PR_snprintf (buffer,sizeof(buffer),"LOGINFO:Log file created at: %s (%lu)\n", tbuf, now);
 	LOG_WRITE(fpinfo, buffer, strlen(buffer), 0);
 
 	logp = loginfo.log_access_logchain;
 	while ( logp) {
 		log_convert_time (logp->l_ctime, tbuf, 1 /*short*/);
-		sprintf(buffer, "LOGINFO:Previous Log File:%s.%s (%lu) (%u)\n",
+		PR_snprintf(buffer, sizeof(buffer), "LOGINFO:Previous Log File:%s.%s (%lu) (%u)\n",
                         loginfo.log_access_file, tbuf, logp->l_ctime, logp->l_size);
 		LOG_WRITE(fpinfo, buffer, strlen(buffer), 0);
 		logp = logp->l_next;
@@ -2265,14 +2267,14 @@ log__delete_access_logfile()
 	if (loginfo.log_access_maxnumlogs == 1) {
 		LOG_CLOSE(loginfo.log_access_fdes);
                 loginfo.log_access_fdes = NULL;
-		sprintf (buffer, "%s", loginfo.log_access_file);
+		PR_snprintf (buffer, sizeof(buffer), "%s", loginfo.log_access_file);
 		if (PR_Delete(buffer) != PR_SUCCESS) {
 			LDAPDebug(LDAP_DEBUG_TRACE, 
 				"LOGINFO:Unable to remove file:%s\n", loginfo.log_access_file,0,0);
 		}
 
 		/* Delete the rotation file also. */
-		sprintf (buffer, "%s.rotationinfo", loginfo.log_access_file);
+		PR_snprintf (buffer, sizeof(buffer), "%s.rotationinfo", loginfo.log_access_file);
 		if (PR_Delete(buffer) != PR_SUCCESS) {
 			LDAPDebug(LDAP_DEBUG_TRACE, 
 				"LOGINFO:Unable to remove file:%s.rotationinfo\n", loginfo.log_access_file,0,0);
@@ -2375,7 +2377,7 @@ delete_logfile:
 
 	/* Delete the access file */
 	log_convert_time (delete_logp->l_ctime, tbuf, 1 /*short */);
-	sprintf (buffer, "%s.%s", loginfo.log_access_file, tbuf);
+	PR_snprintf (buffer, sizeof(buffer), "%s.%s", loginfo.log_access_file, tbuf);
 	if (PR_Delete(buffer) != PR_SUCCESS) {
 		LDAPDebug(LDAP_DEBUG_TRACE, 
 				"LOGINFO:Unable to remove file:%s.%s\n",
@@ -2686,7 +2688,7 @@ log_get_loglist(int logtype)
 	i = 0;
 	while (logp) {
 		log_convert_time (logp->l_ctime, tbuf, 1 /*short */);
-		sprintf(buf, "%s.%s", file, tbuf);
+		PR_snprintf(buf, sizeof(buf), "%s.%s", file, tbuf);
 		list[i] = slapi_ch_strdup(buf);
 		i++;
 		logp = logp->l_next;
@@ -2739,14 +2741,14 @@ log__delete_error_logfile()
 	if (loginfo.log_error_maxnumlogs == 1) {
 		LOG_CLOSE(loginfo.log_error_fdes);
                 loginfo.log_error_fdes = NULL;
-		sprintf (buffer, "%s", loginfo.log_error_file);
+		PR_snprintf (buffer, sizeof(buffer), "%s", loginfo.log_error_file);
 		if (PR_Delete(buffer) != PR_SUCCESS) {
 			LDAPDebug(LDAP_DEBUG_TRACE, 
 				"LOGINFO:Unable to remove file:%s\n", loginfo.log_error_file,0,0);
 		}
 
 		/* Delete the rotation file also. */
-		sprintf (buffer, "%s.rotationinfo", loginfo.log_error_file);
+		PR_snprintf (buffer, sizeof(buffer), "%s.rotationinfo", loginfo.log_error_file);
 		if (PR_Delete(buffer) != PR_SUCCESS) {
 			LDAPDebug(LDAP_DEBUG_TRACE, 
 				"LOGINFO:Unable to remove file:%s.rotationinfo\n", loginfo.log_error_file,0,0);
@@ -2848,7 +2850,7 @@ delete_logfile:
 
 	/* Delete the error file */
 	log_convert_time (delete_logp->l_ctime, tbuf, 1 /*short */);
-	sprintf (buffer, "%s.%s", loginfo.log_error_file, tbuf);
+	PR_snprintf (buffer, sizeof(buffer), "%s.%s", loginfo.log_error_file, tbuf);
 	PR_Delete(buffer);
 	slapi_ch_free((void**)&delete_logp);
 	loginfo.log_numof_error_logs--;
@@ -2886,14 +2888,14 @@ log__delete_audit_logfile()
 	if (loginfo.log_audit_maxnumlogs == 1) {
 		LOG_CLOSE(loginfo.log_audit_fdes);
                 loginfo.log_audit_fdes = NULL;
-		sprintf (buffer, "%s", loginfo.log_audit_file);
+		PR_snprintf(buffer, sizeof(buffer), "%s", loginfo.log_audit_file);
 		if (PR_Delete(buffer) != PR_SUCCESS) {
 			LDAPDebug(LDAP_DEBUG_TRACE, 
 				"LOGINFO:Unable to remove file:%s\n", loginfo.log_audit_file,0,0);
 		}
 
 		/* Delete the rotation file also. */
-		sprintf (buffer, "%s.rotationinfo", loginfo.log_audit_file);
+		PR_snprintf(buffer, sizeof(buffer), "%s.rotationinfo", loginfo.log_audit_file);
 		if (PR_Delete(buffer) != PR_SUCCESS) {
 			LDAPDebug(LDAP_DEBUG_TRACE, 
 				"LOGINFO:Unable to remove file:%s.rotationinfo\n", loginfo.log_audit_file,0,0);
@@ -2995,7 +2997,7 @@ delete_logfile:
 
 	/* Delete the audit file */
 	log_convert_time (delete_logp->l_ctime, tbuf, 1 /*short */);
-	sprintf (buffer, "%s.%s", loginfo.log_audit_file, tbuf );
+	PR_snprintf(buffer, sizeof(buffer), "%s.%s", loginfo.log_audit_file, tbuf );
 	if (PR_Delete(buffer) != PR_SUCCESS) {
 		LDAPDebug(LDAP_DEBUG_TRACE, 
 				"LOGINFO:Unable to remove file:%s.%s\n",
@@ -3227,7 +3229,7 @@ log__open_errorlogfile(int logfile_state, int locked)
 			log->l_size = f_size;
 
 			log_convert_time (log->l_ctime, tbuf, 1/*short */);
-			sprintf(newfile, "%s.%s", loginfo.log_error_file, tbuf);
+			PR_snprintf(newfile, sizeof(newfile), "%s.%s", loginfo.log_error_file, tbuf);
 			if (PR_Rename (loginfo.log_error_file, newfile) != PR_SUCCESS) {
 				return LOG_UNABLE_TO_OPENFILE;
 			}
@@ -3273,13 +3275,13 @@ log__open_errorlogfile(int logfile_state, int locked)
 	/* write the header in the log */
 	now = current_time();
 	log_convert_time (now, tbuf, 2 /*long */);
-	sprintf (buffer,"LOGINFO:Log file created at: %s (%lu)\n", tbuf, now);
+	PR_snprintf(buffer, sizeof(buffer),"LOGINFO:Log file created at: %s (%lu)\n", tbuf, now);
 	LOG_WRITE(fpinfo, buffer, strlen(buffer), 0);
 
 	logp = loginfo.log_error_logchain;
 	while ( logp) {
 		log_convert_time (logp->l_ctime, tbuf, 1 /*short */);
-		sprintf(buffer, "LOGINFO:Previous Log File:%s.%s (%lu) (%u)\n",
+		PR_snprintf(buffer, sizeof(buffer), "LOGINFO:Previous Log File:%s.%s (%lu) (%u)\n",
                         loginfo.log_error_file,	tbuf, logp->l_ctime, logp->l_size);
 		LOG_WRITE(fpinfo, buffer, strlen(buffer), 0);
 		logp = logp->l_next;
@@ -3347,7 +3349,7 @@ log__open_auditlogfile(int logfile_state, int locked)
 			log->l_size = f_size;
 
 			log_convert_time (log->l_ctime, tbuf, 1 /*short */);
-			sprintf(newfile, "%s.%s", loginfo.log_audit_file, tbuf);
+			PR_snprintf(newfile, sizeof(newfile), "%s.%s", loginfo.log_audit_file, tbuf);
 			if (PR_Rename (loginfo.log_audit_file, newfile) != PR_SUCCESS) {
 				if (!locked) LOG_AUDIT_UNLOCK_WRITE();
 				return LOG_UNABLE_TO_OPENFILE;
@@ -3394,13 +3396,13 @@ log__open_auditlogfile(int logfile_state, int locked)
 	/* write the header in the log */
 	now = current_time();
 	log_convert_time (now, tbuf, 2 /*long */);	
-	sprintf (buffer,"LOGINFO:Log file created at: %s (%lu)\n", tbuf, now);
+	PR_snprintf(buffer, sizeof(buffer), "LOGINFO:Log file created at: %s (%lu)\n", tbuf, now);
 	LOG_WRITE(fpinfo, buffer, strlen(buffer), 0);
 
 	logp = loginfo.log_audit_logchain;
 	while ( logp) {
 		log_convert_time (logp->l_ctime, tbuf, 1 /*short */);	
-		sprintf(buffer, "LOGINFO:Previous Log File:%s.%s (%d) (%d)\n",
+		PR_snprintf(buffer, sizeof(buffer), "LOGINFO:Previous Log File:%s.%s (%d) (%d)\n",
                         loginfo.log_audit_file, tbuf, (int)logp->l_ctime, logp->l_size);
 		LOG_WRITE(fpinfo, buffer, strlen(buffer), 0);
 		logp = logp->l_next;
diff --git a/ldap/servers/slapd/main.c b/ldap/servers/slapd/main.c
index 5dfeb337..fe2518a2 100644
--- a/ldap/servers/slapd/main.c
+++ b/ldap/servers/slapd/main.c
@@ -216,7 +216,7 @@ chown_dir_files(char *name, struct passwd *pw, PRBool strip_fn)
 {
   PRDir *dir;
   PRDirEntry *entry;
-  char dirname[MAXPATHLEN + 1], file[MAXPATHLEN + 1];
+  char file[MAXPATHLEN + 1];
   char *log=NULL, *ptr=NULL;
   int rc=0;
 
@@ -240,7 +240,7 @@ chown_dir_files(char *name, struct passwd *pw, PRBool strip_fn)
     /* change the owner for each of the files in the dir */
     while( (entry = PR_ReadDir(dir , PR_SKIP_BOTH )) !=NULL ) 
     {
-	sprintf(file,"%s/%s",log,entry->name);
+	PR_snprintf(file,MAXPATHLEN+1,"%s/%s",log,entry->name);
 	chown_if_not_owner( file, pw->pw_uid, -1 ); 
     }
     PR_CloseDir( dir );
@@ -255,7 +255,6 @@ chown_dir_files(char *name, struct passwd *pw, PRBool strip_fn)
 static void
 fix_ownership() 
 {
-	int len, n;
 	struct passwd* pw=NULL;
 	char dirname[MAXPATHLEN + 1];
 
@@ -272,7 +271,7 @@ fix_ownership()
 
 	/* The instance directory needs to be owned by the local user */
 	chown_if_not_owner( slapdFrontendConfig->instancedir, pw->pw_uid, -1 );
-	sprintf(dirname,"%s/config",slapdFrontendConfig->instancedir);
+	PR_snprintf(dirname,sizeof(dirname),"%s/config",slapdFrontendConfig->instancedir);
 	chown_dir_files(dirname, pw, PR_FALSE); /* config directory */
 	chown_dir_files(slapdFrontendConfig->accesslog, pw, PR_TRUE); /* do access log directory */
 	chown_dir_files(slapdFrontendConfig->auditlog, pw, PR_TRUE);  /* do audit log directory */
@@ -493,7 +492,7 @@ static void ids_get_platform_solaris(char *buf)
     sbuf[0] = '\0';
     sysinfo(SI_PLATFORM,sbuf,128);
     
-    sprintf(buf,"%ssparc%s-%s-solaris",
+    PR_snprintf(buf,sizeof(buf),"%ssparc%s-%s-solaris",
 	    is_u ? "u" : "",
 	    sizeof(long) == 4 ? "" : "v9",
 	    sbuf);
@@ -867,7 +866,7 @@ main( int argc, char **argv)
 	if( !hSlapdEventSource  )
 	{
 		char szMessage[256];
-		sprintf( szMessage, "Directory Server %s is terminating. Failed "
+		PR_snprintf( szMessage, sizeof(szMessage), "Directory Server %s is terminating. Failed "
 			"to set the EventLog source.", pszServerName);
 		MessageBox(GetDesktopWindow(), szMessage, " ", 
 			MB_ICONEXCLAMATION | MB_OK);
@@ -1067,7 +1066,7 @@ main( int argc, char **argv)
     		else
     		{
     			char szMessage[256];
-    			sprintf( szMessage, "The Directory Server %s is terminating due to an error. Check server port specification", pszServerName);
+    			PR_snprintf( szMessage, sizeof(szMessage), "The Directory Server %s is terminating due to an error. Check server port specification", pszServerName);
     			MessageBox(GetDesktopWindow(), szMessage,	" ", MB_ICONEXCLAMATION | MB_OK);
     		}
 #endif
@@ -1645,8 +1644,7 @@ process_command_line(int argc, char **argv, char *myname,
 		case 't':	/* attribute type to index - may be repeated */
 		case 'T':	/* VLV Search to index - may be repeated */
 			if ( slapd_exemode == SLAPD_EXEMODE_DB2INDEX ) {
-                char *p= slapi_ch_malloc(strlen(optarg_ext) + 2);
-                sprintf(p,"%c%s",i,optarg_ext);
+                char *p= slapi_ch_smprintf("%c%s",i,optarg_ext);
     			charray_add( &db2index_attrs, p);
 				break;
             }
@@ -1775,16 +1773,14 @@ lookup_instance_name_by_suffix(char *suffix,
     if (pb == NULL)
         goto done;
 
-    query = slapi_ch_malloc(strlen((const char *)suffix) + 80);         /* round up */
+	if (isexact)
+    	query = slapi_ch_smprintf("(&(objectclass=nsmappingtree)(|(cn=\"%s\")(cn=%s)))", suffix, suffix);
+	else
+    	query = slapi_ch_smprintf("(&(objectclass=nsmappingtree)(|(cn=*%s\")(cn=*%s)))", suffix, suffix);
 
     if (query == NULL)
 		goto done;
 
-	if (isexact)
-    	sprintf(query, "(&(objectclass=nsmappingtree)(|(cn=\"%s\")(cn=%s)))", suffix, suffix);
-	else
-    	sprintf(query, "(&(objectclass=nsmappingtree)(|(cn=*%s\")(cn=*%s)))", suffix, suffix);
-
     slapi_search_internal_set_pb(pb, "cn=mapping tree,cn=config",
         LDAP_SCOPE_SUBTREE, query, NULL, 0, NULL, NULL,
         (void *)plugin_get_default_component_id(), 0);
@@ -1858,12 +1854,11 @@ static struct slapdplugin *lookup_plugin_by_instance_name(const char *name)
     if (pb == NULL)
         return NULL;
 
-    query = slapi_ch_malloc(strlen(name) + 80);         /* round up */
+    query = slapi_ch_smprintf("(&(cn=%s)(objectclass=nsBackendInstance))", name);
     if (query == NULL) {
         slapi_pblock_destroy(pb);
         return NULL;
     }
-    sprintf(query, "(&(cn=%s)(objectclass=nsBackendInstance))", name);
 
     slapi_search_internal_set_pb(pb, "cn=plugins,cn=config",
         LDAP_SCOPE_SUBTREE, query, NULL, 0, NULL, NULL,
@@ -2363,7 +2358,6 @@ static int
 slapd_exemode_db2archive()
 {
     int return_value= 0;
-	Slapi_Backend *be = NULL;
 	Slapi_PBlock pb;
 	struct slapdplugin *backend_plugin;
 	slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig();
@@ -2419,7 +2413,6 @@ static int
 slapd_exemode_archive2db()
 {
     int return_value= 0;
-	Slapi_Backend *be = NULL;
 	Slapi_PBlock pb;
 	struct slapdplugin *backend_plugin;
 	slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig();
diff --git a/ldap/servers/slapd/mapping_tree.c b/ldap/servers/slapd/mapping_tree.c
index 572b1b29..a25f0ab3 100644
--- a/ldap/servers/slapd/mapping_tree.c
+++ b/ldap/servers/slapd/mapping_tree.c
@@ -874,13 +874,10 @@ mapping_tree_node_get_children(mapping_tree_node *target, int is_root)
      * Since we don't really support it, children of the root node won't
      * have a MAPPING_TREE_PARENT_ATTRIBUTE. */
     if (is_root) {
-        filter = slapi_ch_malloc(strlen(MAPPING_TREE_PARENT_ATTRIBUTE)+38);
-        sprintf(filter, "(&(objectclass=nsMappingTree)(!(%s=*)))",
+        filter = slapi_ch_smprintf("(&(objectclass=nsMappingTree)(!(%s=*)))",
                  MAPPING_TREE_PARENT_ATTRIBUTE);
     } else {
-        filter = slapi_ch_malloc(strlen(slapi_sdn_get_dn(target->mtn_subtree))
-                    + strlen(MAPPING_TREE_PARENT_ATTRIBUTE) + 36);
-        sprintf(filter, "(&(objectclass=nsMappingTree)(%s=\"%s\"))",
+        filter = slapi_ch_smprintf("(&(objectclass=nsMappingTree)(%s=\"%s\"))",
             MAPPING_TREE_PARENT_ATTRIBUTE, 
             slapi_sdn_get_dn(target->mtn_subtree));
     }
@@ -1097,7 +1094,7 @@ int mapping_tree_entry_modify_callback(Slapi_PBlock *pb, Slapi_Entry* entryBefor
 
             if ((backends == NULL) && (node->mtn_state == MTN_BACKEND))
             {
-                sprintf(returntext, "mapping tree entry need at least one nsslapd-backend\n");
+                PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE, "mapping tree entry need at least one nsslapd-backend\n");
                 *returncode = LDAP_UNWILLING_TO_PERFORM;
                 mtn_unlock();
                 free_get_backends_from_attr(&backends, &be_names, &be_states, &be_list_count);
@@ -1125,7 +1122,7 @@ int mapping_tree_entry_modify_callback(Slapi_PBlock *pb, Slapi_Entry* entryBefor
              */
             if ((mods[i]->mod_op & ~LDAP_MOD_BVALUES) != LDAP_MOD_REPLACE)
             {
-                sprintf(returntext, "must use replace operation to change state\n");
+                PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE, "must use replace operation to change state\n");
                 *returncode = LDAP_UNWILLING_TO_PERFORM;
                 slapi_sdn_free(&subtree);
                 return SLAPI_DSE_CALLBACK_ERROR;
@@ -1145,7 +1142,7 @@ int mapping_tree_entry_modify_callback(Slapi_PBlock *pb, Slapi_Entry* entryBefor
             {
                 if (slapi_entry_attr_find(entryAfter, "nsslapd-backend", &attr))
                 {
-                    sprintf(returntext, "need to set nsslapd-backend before moving to backend state\n");
+                    PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE, "need to set nsslapd-backend before moving to backend state\n");
                     slapi_sdn_free(&subtree);
                     *returncode = LDAP_UNWILLING_TO_PERFORM;
                     return SLAPI_DSE_CALLBACK_ERROR;
@@ -1157,7 +1154,7 @@ int mapping_tree_entry_modify_callback(Slapi_PBlock *pb, Slapi_Entry* entryBefor
             {
                 if (slapi_entry_attr_find(entryAfter, "nsslapd-referral", &attr))
                 {
-                    sprintf(returntext, "need to set nsslapd-referral before moving to referral state\n");
+                    PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE, "need to set nsslapd-referral before moving to referral state\n");
                     slapi_sdn_free(&subtree);
                     *returncode = LDAP_UNWILLING_TO_PERFORM;
                     return SLAPI_DSE_CALLBACK_ERROR;
@@ -1193,7 +1190,7 @@ int mapping_tree_entry_modify_callback(Slapi_PBlock *pb, Slapi_Entry* entryBefor
                 if ((node->mtn_state == MTN_REFERRAL) ||
                     (node->mtn_state == MTN_REFERRAL_ON_UPDATE))
                 {
-                    sprintf(returntext,
+                    PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE,
                              "cannot delete referrals in this state\n");
                     *returncode = LDAP_UNWILLING_TO_PERFORM;
                     mtn_unlock();
@@ -1281,7 +1278,7 @@ int mapping_tree_entry_modify_callback(Slapi_PBlock *pb, Slapi_Entry* entryBefor
 
             if (plugin == NULL)
             {
-                sprintf(returntext, "cannot find distribution plugin\n");
+                PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE, "cannot find distribution plugin\n");
                 slapi_ch_free((void **) &plugin_fct);
                 slapi_ch_free((void **) &plugin_lib);
                 slapi_sdn_free(&subtree);
@@ -1297,7 +1294,7 @@ int mapping_tree_entry_modify_callback(Slapi_PBlock *pb, Slapi_Entry* entryBefor
         else
         {
             /* only one parameter configured -> ERROR */
-            sprintf(returntext,
+            PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE,
                  "must define distribution function and library\n");
             slapi_ch_free((void **) &plugin_fct);
             slapi_ch_free((void **) &plugin_lib);
@@ -1430,7 +1427,7 @@ int mapping_tree_entry_delete_callback(Slapi_PBlock *pb, Slapi_Entry* entryBefor
     {
         result = SLAPI_DSE_CALLBACK_ERROR;
         *returncode = LDAP_UNWILLING_TO_PERFORM;
-        sprintf(returntext, "this node has some children");
+        PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE, "this node has some children");
         goto done;
     }
 
@@ -2008,9 +2005,9 @@ int slapi_mapping_tree_select(Slapi_PBlock *pb, Slapi_Backend **be, Slapi_Entry
             (op_type != SLAPI_OPERATION_BIND) && 
             (op_type != SLAPI_OPERATION_UNBIND)) {
             ret = LDAP_UNWILLING_TO_PERFORM;
-            strcpy(errorbuf, slapi_config_get_readonly() ? 
+            PL_strncpyz(errorbuf, slapi_config_get_readonly() ? 
                     "Server is read-only" :
-                    "database is read-only");
+                    "database is read-only", BUFSIZ);
             slapi_be_Unlock(*be);
             *be = NULL;
         }
@@ -2177,7 +2174,7 @@ void slapi_mapping_tree_free_all(Slapi_Backend **be_list, Slapi_Entry **referral
     {
         Slapi_Backend * be;
     
-        while (be = be_list[index++])
+        while ((be = be_list[index++]))
         {
             slapi_log_error(SLAPI_LOG_ARGS, NULL, "mapping tree release backend : %s\n", slapi_be_get_name(be));
             slapi_be_Unlock(be);
@@ -2188,7 +2185,7 @@ void slapi_mapping_tree_free_all(Slapi_Backend **be_list, Slapi_Entry **referral
     if (referral_list[index] != NULL)
     {
         Slapi_Entry * referral;
-        while (referral = referral_list[index++])
+        while ((referral = referral_list[index++]))
         {
             slapi_entry_free(referral);
         }
@@ -2237,7 +2234,7 @@ int slapi_mapping_tree_select_and_check(Slapi_PBlock *pb,char *newdn, Slapi_Back
     if ((*be) && ((*be != new_be) || mtn_sdn_has_child(target_sdn)))
     {
         ret = LDAP_UNWILLING_TO_PERFORM;
-        sprintf(errorbuf, "Cannot move entries accross backends\n");
+        PR_snprintf(errorbuf, BUFSIZ, "Cannot move entries accross backends\n");
         goto unlock_and_return;
     }
 
@@ -2356,10 +2353,11 @@ static int mtn_get_be(mapping_tree_node *target_node, Slapi_PBlock *pb,
     target_sdn = operation_get_target_spec (op);
 
     if (target_node->mtn_state == MTN_DISABLED) {
-        if (errorbuf)
-            sprintf(errorbuf,
+		if (errorbuf) {
+			PR_snprintf(errorbuf, BUFSIZ,
                 "Warning: Operation attempted on a disabled node : %s\n",
-                    slapi_sdn_get_dn(target_node->mtn_subtree));
+				slapi_sdn_get_dn(target_node->mtn_subtree));
+		}
         result = LDAP_OPERATIONS_ERROR;
         return result;
     }
@@ -2475,7 +2473,7 @@ static int mtn_get_be(mapping_tree_node *target_node, Slapi_PBlock *pb,
             (*index)++;
             if (NULL == *referral) {
                 if (errorbuf) {
-                    sprintf(errorbuf, 
+                    PR_snprintf(errorbuf, BUFSIZ,
                     "Mapping tree node for %s is set to return a referral,"
                         " but no referral is configured for it",
                         slapi_sdn_get_ndn(target_node->mtn_subtree));
@@ -2672,7 +2670,6 @@ get_mapping_tree_node_by_name(mapping_tree_node * node, char * be_name)
 char* 
 slapi_get_mapping_tree_node_configdn (const Slapi_DN *root)
 {
-    int len;
     char *dn;
 
     if(mapping_tree_freed){
@@ -2682,9 +2679,7 @@ slapi_get_mapping_tree_node_configdn (const Slapi_DN *root)
     if (root == NULL)
         return NULL;
 
-    len = strlen (slapi_sdn_get_dn(root)) + strlen (MAPPING_TREE_BASE_DN) + 7; /* cn= + " + " + , + \0 */
-    dn = (char*)slapi_ch_malloc (len);
-    sprintf (dn, "cn=\"%s\",%s", slapi_sdn_get_dn(root), MAPPING_TREE_BASE_DN);
+    dn = slapi_ch_smprintf("cn=\"%s\",%s", slapi_sdn_get_dn(root), MAPPING_TREE_BASE_DN);
 
     return dn;
 }
diff --git a/ldap/servers/slapd/modify.c b/ldap/servers/slapd/modify.c
index 1e73f7c6..dcb28795 100644
--- a/ldap/servers/slapd/modify.c
+++ b/ldap/servers/slapd/modify.c
@@ -162,7 +162,6 @@ do_modify( Slapi_PBlock *pb )
 		if ( !mod->mod_type || !*mod->mod_type ) {
 			char ebuf[BUFSIZ];
 			PR_snprintf (ebuf, BUFSIZ, "invalid type '%s'", type);
-			ebuf[BUFSIZ-1] = '\0';
 			op_shared_log_error_access (pb, "MOD", dn, ebuf);
 			send_ldap_result( pb, LDAP_INVALID_SYNTAX, NULL, ebuf, 0, NULL );
 			slapi_ch_free((void **)&type);
diff --git a/ldap/servers/slapd/monitor.c b/ldap/servers/slapd/monitor.c
index 2321223e..cfea7ded 100644
--- a/ldap/servers/slapd/monitor.c
+++ b/ldap/servers/slapd/monitor.c
@@ -166,8 +166,7 @@ slapd_get_version_value( void )
         versionstring = config_get_versionstring();
         buildnum = config_get_buildnum();
 
-        vs = slapi_ch_malloc( strlen(versionstring) + strlen( buildnum) + 3 );
-        sprintf( vs, "%s B%s", versionstring, buildnum );
+        vs = slapi_ch_smprintf("%s B%s", versionstring, buildnum );
 
         slapi_ch_free( (void **) &buildnum);
         slapi_ch_free( (void **) &versionstring);
diff --git a/ldap/servers/slapd/ntwdog/cron_conf.c b/ldap/servers/slapd/ntwdog/cron_conf.c
index 78e2c3ac..7d130c4f 100644
--- a/ldap/servers/slapd/ntwdog/cron_conf.c
+++ b/ldap/servers/slapd/ntwdog/cron_conf.c
@@ -261,7 +261,7 @@ static cron_conf_obj *get_object(FILE *fp)
 
 		  if (q)
 		    {
-		      sprintf(command, "%s", q);
+		      PR_snprintf(command, S_BUF_SIZE, "%s", q);
 		      /* debug("Setting command to '%s'", command); */
 		      hascom++;
 		    }
@@ -294,7 +294,7 @@ static cron_conf_obj *get_object(FILE *fp)
 
 		  if (q)
 		    {
-		      sprintf(dir, "%s", q);
+		      PR_snprintf(dir, S_BUF_SIZE, "%s", q);
 		      /* debug("Setting dir to '%s'", dir); */
 		      hasdir++;
 		    }
@@ -313,7 +313,7 @@ static cron_conf_obj *get_object(FILE *fp)
 	    {
 	      if (!hasuser)
 		{
-		  sprintf(user, "%s", q);
+		  PR_snprintf(user, S_BUF_SIZE, "%s", q);
 		  /* debug("Setting user to '%s'", user); */
 		  hasuser++;
 		}
@@ -331,7 +331,7 @@ static cron_conf_obj *get_object(FILE *fp)
 	    {
 	      if (!hastime)
 		{
-		  sprintf(start_time, "%s", q);
+		  PR_snprintf(start_time, S_BUF_SIZE, "%s", q);
 		  /* debug("Setting time to '%s'", start_time); */
 		  hastime++;
 		}
@@ -349,7 +349,7 @@ static cron_conf_obj *get_object(FILE *fp)
 	    {
 	      if (!hasdays)
 		{
-		  sprintf(days, "%s", q);
+		  PR_snprintf(days, S_BUF_SIZE, "%s", q);
 		  /* debug("Setting days to '%s'", days); */
 		  hasdays++;
 		}
diff --git a/ldap/servers/slapd/ntwdog/ntcron.c b/ldap/servers/slapd/ntwdog/ntcron.c
index d3bcb43a..1cb31300 100644
--- a/ldap/servers/slapd/ntwdog/ntcron.c
+++ b/ldap/servers/slapd/ntwdog/ntcron.c
@@ -55,7 +55,7 @@ BOOL CRON_CheckTime(LPSYSTEMTIME lpstNow, char *szTime)
 	char szCurrentTime[16];
 	char szStartTime[16];
 
-	strcpy(szStartTime, szTime);
+	strncpy(szStartTime, szTime, sizeof(szStartTime)-1);
 
 	if(szTime[1] == ':')
 		wsprintf(szStartTime, "0%s", szTime);
diff --git a/ldap/servers/slapd/opshared.c b/ldap/servers/slapd/opshared.c
index 847cdd31..7ff8ff06 100644
--- a/ldap/servers/slapd/opshared.c
+++ b/ldap/servers/slapd/opshared.c
@@ -740,7 +740,7 @@ process_entry(Slapi_PBlock *pb, Slapi_Entry *e, int send_result)
     return 0;
 }
 
-
+#if 0
 /* Loops through search entries and sends them to the client. 
  * returns -1 on error, 0 if result packet was sent or 1 if
  * result packet wasn't sent
@@ -883,6 +883,7 @@ iterate_with_lookahead(Slapi_PBlock *pb, Slapi_Backend *be, int send_result, int
 		return 0;
     }
 }
+#endif
 
 /* Loops through search entries and sends them to the client. 
  * returns -1 on error or 1 if result packet wasn't sent.
@@ -1095,7 +1096,6 @@ static int  send_results (Slapi_PBlock *pb, int send_result, int * nentries)
 {
 	Slapi_Backend *be; 
 	int rc;
-	struct berval **urls = NULL;
 
 	slapi_pblock_get (pb, SLAPI_BACKEND, &be);
 
diff --git a/ldap/servers/slapd/passwd_extop.c b/ldap/servers/slapd/passwd_extop.c
index f0403721..2ff03411 100644
--- a/ldap/servers/slapd/passwd_extop.c
+++ b/ldap/servers/slapd/passwd_extop.c
@@ -173,11 +173,8 @@ passwd_modify_extop( Slapi_PBlock *pb )
 	char		*oldPasswd = NULL;
 	char		*newPasswd = NULL;
 	char		*errMesg = NULL;
-	char		**reqvals = NULL;
 	int             ret=0, rc=0;
 	unsigned long	tag=0, len=-1;
-	LDAPControl	**ctrlp = NULL; /* unused */
-	Slapi_Operation *operation = NULL; /* unused */
 	struct berval *extop_value = NULL;
 	BerElement	*ber = NULL;
 	Slapi_Entry *targetEntry=NULL;
diff --git a/ldap/servers/slapd/plugin.c b/ldap/servers/slapd/plugin.c
index 3db20f67..38dc7f44 100644
--- a/ldap/servers/slapd/plugin.c
+++ b/ldap/servers/slapd/plugin.c
@@ -94,10 +94,11 @@ typedef struct entry_and_plugin {
 	struct entry_and_plugin *next;
 } entry_and_plugin_t;
 
-static entry_and_plugin_t *plugin_entries = NULL;
 static entry_and_plugin_t *dep_plugin_entries = NULL; /* for dependencies */
 
 #if 0
+static entry_and_plugin_t *plugin_entries = NULL;
+
 static void
 add_plugin_entries()
 {
@@ -184,9 +185,7 @@ slapi_register_plugin(
 	int ii = 0;
     int rc = 0;
 	Slapi_Entry *e = slapi_entry_alloc();
-	char *dn = slapi_ch_calloc(1, strlen(name) + strlen(PLUGIN_BASE_DN) + 10);
-
-	sprintf(dn, "cn=%s, %s", name, PLUGIN_BASE_DN);
+	char *dn = slapi_ch_smprintf("cn=%s, %s", name, PLUGIN_BASE_DN);
 	/* this function consumes dn */
 	slapi_entry_init(e, dn, NULL);
 
@@ -199,7 +198,7 @@ slapi_register_plugin(
 
 	for (ii = 0; argv && argv[ii]; ++ii) {
 		char argname[64];
-		sprintf(argname, "%s%d", ATTR_PLUGIN_ARG, ii);
+		PR_snprintf(argname, sizeof(argname), "%s%d", ATTR_PLUGIN_ARG, ii);
 		slapi_entry_attr_set_charptr(e, argname, argv[ii]);
 	}
 
@@ -2123,13 +2122,13 @@ plugin_setup(Slapi_Entry *plugin_entry, struct slapi_componentid *group,
 	/* add the plugin arguments */
 	value = 0;
 	ii = 0;
-	sprintf(attrname, "%s%d", ATTR_PLUGIN_ARG, ii);
+	PR_snprintf(attrname, sizeof(attrname), "%s%d", ATTR_PLUGIN_ARG, ii);
 	while ((value = slapi_entry_attr_get_charptr(plugin_entry, attrname)) != NULL)
 	{
 		charray_add(&plugin->plg_argv, value);
 		plugin->plg_argc++;
 		++ii;
-		sprintf(attrname, "%s%d", ATTR_PLUGIN_ARG, ii);
+		PR_snprintf(attrname, sizeof(attrname), "%s%d", ATTR_PLUGIN_ARG, ii);
 	}
 
 	memset((char *)&pb, '\0', sizeof(pb));
@@ -2430,9 +2429,7 @@ char* plugin_get_dn (const struct slapdplugin *plugin)
 	if (plugin->plg_name == NULL)
 		return NULL;
 
-	plugindn = (char*)slapi_ch_malloc (strlen (pattern) + strlen (plugin->plg_name));
-	if (plugindn)
-		sprintf (plugindn, pattern, plugin->plg_name);
+	plugindn = slapi_ch_smprintf(pattern, plugin->plg_name);
 
 	return plugindn;
 }
diff --git a/ldap/servers/slapd/protect_db.c b/ldap/servers/slapd/protect_db.c
index 3f9c5c16..4efe729a 100644
--- a/ldap/servers/slapd/protect_db.c
+++ b/ldap/servers/slapd/protect_db.c
@@ -247,7 +247,7 @@ sample_and_update(char *dir_name)
 	if (is_process_up(pid)) {
 	    result = (long) pid;
 	} else {
-	    sprintf(file_name, "%s/%s", dir_name, entry->name);
+	    PR_snprintf(file_name, MAXPATHLEN, "%s/%s", dir_name, entry->name);
 	    PR_Delete(file_name);
 	}
     }
@@ -293,7 +293,7 @@ remove_and_update(char *dir_name)
 	    continue;
 	}	
 	if (!is_process_up(pid) || pid == our_pid) {
-	    sprintf(file_name, "%s/%s", dir_name, entry->d_name);
+	    PR_snprintf(file_name, MAXPATHLEN, "%s/%s", dir_name, entry->d_name);
 	    unlink(file_name);
 	}
     }
diff --git a/ldap/servers/slapd/proto-slap.h b/ldap/servers/slapd/proto-slap.h
index 09f04d0b..7ad6ee4d 100644
--- a/ldap/servers/slapd/proto-slap.h
+++ b/ldap/servers/slapd/proto-slap.h
@@ -455,8 +455,6 @@ void send_referrals_from_entry(Slapi_PBlock *pb, Slapi_Entry *referral);
 
 #define DSE_BACKEND             "frontend-internal"
 
-#define SLAPI_DSE_RETURNTEXT_SIZE 512	/* for use by callback functions */
-
 struct dse *dse_new( char *filename, char *tmpfilename, char *backfilename, char *startokfilename, const char *configdir);
 struct dse *dse_new_with_filelist(char *filename, char *tmpfilename, char *backfilename, char *startokfilename, const char *configdir, char **filelist);
 int dse_deletedse(Slapi_PBlock *pb);
@@ -1148,6 +1146,12 @@ void ids_sasl_check_bind(Slapi_PBlock *pb);
 void ids_sasl_server_new(Connection *conn);
 
 /*
+ * sasl_io.c
+ */
+/* This function should be called under the connection mutex */
+int sasl_io_setup(Connection *c);
+
+/*
  * daemon.c
  */
 #ifndef LINUX
diff --git a/ldap/servers/slapd/pw.c b/ldap/servers/slapd/pw.c
index 1b55b954..76e6c5d6 100644
--- a/ldap/servers/slapd/pw.c
+++ b/ldap/servers/slapd/pw.c
@@ -353,7 +353,6 @@ int checkPrefix(char *cipher, char *schemaName, char **encrypt)
 int
 pw_rever_decode(char *cipher, char **plain, const char * attr_name)
 {
-	char	*dec = NULL;
 	struct pw_scheme	*pwsp = NULL;
 	struct slapdplugin	*p = NULL;
 
@@ -510,7 +509,6 @@ update_pw_info ( Slapi_PBlock *pb , char *old_pw) {
 
 	Slapi_Mods	smods;
 	char *timestr;
-	Slapi_PBlock 	*mod_result_pb = NULL;
 	time_t 		pw_exp_date;
 	time_t          cur_time;
 	char 		*dn;
@@ -979,7 +977,6 @@ pw_mod_allowchange_aci(int pw_prohibit_change) {
 	char		*values_mod[2];
 	LDAPMod		mod;
 	LDAPMod		*mods[2];
-	char		*aci_pw = NULL;
 	Slapi_Backend *be;
 	char *cookie = NULL;
 
@@ -1243,104 +1240,104 @@ new_passwdPolicy(Slapi_PBlock *pb, char *dn)
 				{
 					slapi_attr_get_type(attr, &attr_name);
 					if (!strcasecmp(attr_name, "passwordminage")) {
-						if (sval = attr_get_present_values(attr)) {
+						if ((sval = attr_get_present_values(attr))) {
 							pwdpolicy->pw_minage = slapi_value_get_long(*sval);
 						}
 					}
 					else
 					if (!strcasecmp(attr_name, "passwordmaxage")) {
-						if (sval = attr_get_present_values(attr)) {
+						if ((sval = attr_get_present_values(attr))) {
 							pwdpolicy->pw_maxage = slapi_value_get_long(*sval);
 						}
 					}
 					else
 					if (!strcasecmp(attr_name, "passwordwarning")) {
-						if (sval = attr_get_present_values(attr)) {
+						if ((sval = attr_get_present_values(attr))) {
 							pwdpolicy->pw_warning = slapi_value_get_long(*sval);
 						}
 					}
 					else
 					if (!strcasecmp(attr_name, "passwordhistory")) {
-						if (sval = attr_get_present_values(attr)) {
+						if ((sval = attr_get_present_values(attr))) {
 							pwdpolicy->pw_history = 
 							pw_boolean_str2value(slapi_value_get_string(*sval));
 						}
 					}
 					else
 					if (!strcasecmp(attr_name, "passwordinhistory")) {
-						if (sval = attr_get_present_values(attr)) {
+						if ((sval = attr_get_present_values(attr))) {
 							pwdpolicy->pw_inhistory = slapi_value_get_int(*sval);
 						}
 					}
 					else
 					if (!strcasecmp(attr_name, "passwordlockout")) {
-						if (sval = attr_get_present_values(attr)) {
+						if ((sval = attr_get_present_values(attr))) {
 							pwdpolicy->pw_lockout = 
 							pw_boolean_str2value(slapi_value_get_string(*sval));
 						}
 					}
 					else
 					if (!strcasecmp(attr_name, "passwordmaxfailure")) {
-						if (sval = attr_get_present_values(attr)) {
+						if ((sval = attr_get_present_values(attr))) {
 							pwdpolicy->pw_maxfailure = slapi_value_get_int(*sval);
 						}
 					}
 					else
 					if (!strcasecmp(attr_name, "passwordunlock")) {
-						if (sval = attr_get_present_values(attr)) {
+						if ((sval = attr_get_present_values(attr))) {
 							pwdpolicy->pw_unlock = 
 							pw_boolean_str2value(slapi_value_get_string(*sval));
 						}
 					}
 					else
 					if (!strcasecmp(attr_name, "passwordlockoutduration")) {
-						if (sval = attr_get_present_values(attr)) {
+						if ((sval = attr_get_present_values(attr))) {
 							pwdpolicy->pw_lockduration = slapi_value_get_long(*sval);
 						}
 					}
 					else
 					if (!strcasecmp(attr_name, "passwordresetfailurecount")) {
-						if (sval = attr_get_present_values(attr)) {
+						if ((sval = attr_get_present_values(attr))) {
 							pwdpolicy->pw_resetfailurecount = slapi_value_get_long(*sval);
 						}
 					}
 					else
 					if (!strcasecmp(attr_name, "passwordchange")) {
-						if (sval = attr_get_present_values(attr)) {
+						if ((sval = attr_get_present_values(attr))) {
 							pwdpolicy->pw_change = 
 							pw_boolean_str2value(slapi_value_get_string(*sval));
 						}       
 					}
 					else
 					if (!strcasecmp(attr_name, "passwordmustchange")) {
-						if (sval = attr_get_present_values(attr)) {
+						if ((sval = attr_get_present_values(attr))) {
 							pwdpolicy->pw_must_change = 
 							pw_boolean_str2value(slapi_value_get_string(*sval));
 						}
 					}
 					else
 					if (!strcasecmp(attr_name, "passwordchecksyntax")) {
-						if (sval = attr_get_present_values(attr)) {
+						if ((sval = attr_get_present_values(attr))) {
 							pwdpolicy->pw_syntax = 
 							pw_boolean_str2value(slapi_value_get_string(*sval));
 						}
 					}
 					else
 					if (!strcasecmp(attr_name, "passwordminlength")) {
-						if (sval = attr_get_present_values(attr)) {
+						if ((sval = attr_get_present_values(attr))) {
 							pwdpolicy->pw_minlength = slapi_value_get_int(*sval);
 						}
 					}
 					else
 					if (!strcasecmp(attr_name, "passwordexp")) {
-						if (sval = attr_get_present_values(attr)) {
+						if ((sval = attr_get_present_values(attr))) {
 							pwdpolicy->pw_exp = 
 							pw_boolean_str2value(slapi_value_get_string(*sval));
 						}
 					}
 					else
 					if (!strcasecmp(attr_name, "passwordgracelimit")) {
-						if (sval = attr_get_present_values(attr)) {
+						if ((sval = attr_get_present_values(attr))) {
 							pwdpolicy->pw_gracelimit = slapi_value_get_int(*sval);
 						}
 					}
@@ -1554,7 +1551,7 @@ check_pw_storagescheme_value( const char *attr_name, char *value, long minval, l
 		*/ 
 
 		if ( scheme_list != NULL ) {
-			sprintf( errorbuf,
+			PR_snprintf ( errorbuf, BUFSIZ, 
 				"%s: invalid encoding scheme - %s\nValid values are: %s\n",
 				CONFIG_PW_STORAGESCHEME_ATTRIBUTE, value, scheme_list );
 		}
diff --git a/ldap/servers/slapd/pw_retry.c b/ldap/servers/slapd/pw_retry.c
index 094d1587..daf9a8c0 100644
--- a/ldap/servers/slapd/pw_retry.c
+++ b/ldap/servers/slapd/pw_retry.c
@@ -13,7 +13,6 @@
 /* prototypes                                                               */
 /****************************************************************************/
 /* Slapi_Entry *get_entry ( Slapi_PBlock *pb, const char *dn ); */
-static void set_reset_time ( Slapi_PBlock *pb, time_t cur_time );
 static void set_retry_cnt ( Slapi_PBlock *pb, int count);
 static void set_retry_cnt_and_time ( Slapi_PBlock *pb, int count, time_t cur_time);
 
@@ -92,7 +91,6 @@ void set_retry_cnt_and_time ( Slapi_PBlock *pb, int count, time_t cur_time ) {
 	Slapi_Mods	smods;
 	time_t      reset_time;
 	char		*timestr;
-	slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig();
 	passwdPolicy *pwpolicy = NULL;
 
 	slapi_pblock_get( pb, SLAPI_TARGET_DN, &dn );
@@ -119,7 +117,6 @@ void set_retry_cnt_mods(Slapi_PBlock *pb, Slapi_Mods *smods, int count)
 	char 		*timestr;
 	time_t		unlock_time;
 	char        retry_cnt[8]; /* 1-65535 */
-	slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig();
 	char *dn = NULL; 
 	passwdPolicy *pwpolicy = NULL;
 
@@ -162,32 +159,6 @@ void set_retry_cnt ( Slapi_PBlock *pb, int count) {
 	slapi_mods_done(&smods);
 }
 
-static
-void set_reset_time ( Slapi_PBlock *pb, time_t cur_time ) {
-	char            *dn;
-	Slapi_Mods	smods;
-	time_t          reset_time;
-	char *timestr;
-	int resetfailurecount;
-	passwdPolicy *pwpolicy = NULL;
-
-	slapi_pblock_get( pb, SLAPI_TARGET_DN, &dn );
-	
-	pwpolicy = new_passwdPolicy(pb, dn);
-	resetfailurecount = pwpolicy->pw_resetfailurecount;
-
-	slapi_mods_init(&smods, 0);
-
-	reset_time = time_plus_sec ( cur_time, resetfailurecount );
-
-	timestr = format_genTime ( reset_time );
-	slapi_mods_add_string(&smods, LDAP_MOD_REPLACE, "retryCountResetTime", timestr);
-	slapi_ch_free((void **)&timestr);
-
-	pw_apply_mods(dn, &smods);
-	slapi_mods_done(&smods);
-	delete_passwdPolicy(&pwpolicy);
-}
 
 Slapi_Entry *get_entry ( Slapi_PBlock *pb, const char *dn)
 {
diff --git a/ldap/servers/slapd/referral.c b/ldap/servers/slapd/referral.c
index 4391c6b9..cede05d6 100644
--- a/ldap/servers/slapd/referral.c
+++ b/ldap/servers/slapd/referral.c
@@ -1089,13 +1089,11 @@ get_data_source(Slapi_PBlock *pb, const Slapi_DN *sdn, int orc, void *cfrp)
 		/* Get the basic referral */
 		bv = slapi_ch_bvdup(the_refs->ra_refs[walker]->ref_referral);
 		old_referral_string = bv->bv_val;
-		/* The longest new string will be one character longer than the old one */
-		new_referral_string = slapi_ch_malloc(bv->bv_len + 1); 
 		/* Re-write it to replace ldap with ldaps, and remove the port information */
 		/* The original string will look like this: ldap://host:port */
 		/* We need to make it look like this: ldaps://host */
 		/* Potentially the ":port" part might be missing from the original */
-		sprintf(new_referral_string, "%s%s" , LDAPS_URL_PREFIX, old_referral_string + strlen(LDAP_URL_PREFIX) );
+		new_referral_string = slapi_ch_smprintf("%s%s" , LDAPS_URL_PREFIX, old_referral_string + strlen(LDAP_URL_PREFIX) );
 		/* Go looking for the port */
 		p = new_referral_string + (strlen(LDAPS_URL_PREFIX) + 1);
 		while (*p != '\0' && *p != ':') p++;
diff --git a/ldap/servers/slapd/result.c b/ldap/servers/slapd/result.c
index 4995a620..9a406e85 100644
--- a/ldap/servers/slapd/result.c
+++ b/ldap/servers/slapd/result.c
@@ -943,7 +943,6 @@ static int send_all_attrs(Slapi_Entry *e,char **attrs,Slapi_Operation *op,Slapi_
 			/**********************************************/
 			int item_count = 0;
 			int iter = 0;
-			int j = 0;
 			Slapi_DN *namespace_dn;
 			Slapi_Backend *backend=0;
 			vattr_context *ctx;
diff --git a/ldap/servers/slapd/sasl_map.c b/ldap/servers/slapd/sasl_map.c
index ec2068f1..2ac029b4 100644
--- a/ldap/servers/slapd/sasl_map.c
+++ b/ldap/servers/slapd/sasl_map.c
@@ -64,6 +64,7 @@ sasl_map_private *sasl_map_new_private()
 	return new_priv;
 }
 
+#if 0 /* unused for now */
 static void 
 sasl_map_free_private(sasl_map_private **priv)
 {
@@ -71,6 +72,7 @@ sasl_map_free_private(sasl_map_private **priv)
 	slapi_ch_free((void**)priv);
 	*priv = NULL;
 }
+#endif
 
 /* This function does a shallow copy on the payload data supplied, so the caller should not free it, and it needs to be allocated using slapi_ch_malloc() */
 static 
@@ -425,10 +427,7 @@ sasl_map_str_concat(char *s1, char *s2)
 	if (NULL == s2) {
 		return (slapi_ch_strdup(s1));
 	} else {
-		size_t s1len = strlen(s1);
-		size_t length = s1len +  + strlen(s2);
-		char *newstr = slapi_ch_malloc(length + 2);
-		sprintf(newstr,"%s@%s",s1,s2);
+		char *newstr = slapi_ch_smprintf("%s@%s",s1,s2);
 		return newstr;
 	}
 }
diff --git a/ldap/servers/slapd/saslbind.c b/ldap/servers/slapd/saslbind.c
index 669abcd2..1a6c2f14 100644
--- a/ldap/servers/slapd/saslbind.c
+++ b/ldap/servers/slapd/saslbind.c
@@ -840,7 +840,7 @@ void ids_sasl_check_bind(Slapi_PBlock *pb)
         }
 
         /* set the connection bind credentials */
-        sprintf(authtype, "%s%s", SLAPD_AUTH_SASL, mech);
+        PR_snprintf(authtype, sizeof(authtype), "%s%s", SLAPD_AUTH_SASL, mech);
         bind_credentials_set(pb->pb_conn, authtype, dn, 
                              NULL, NULL, NULL, bind_target_entry);
 
diff --git a/ldap/servers/slapd/schema.c b/ldap/servers/slapd/schema.c
index b8324b7c..a078df1b 100644
--- a/ldap/servers/slapd/schema.c
+++ b/ldap/servers/slapd/schema.c
@@ -2777,9 +2777,8 @@ read_oc_ldif ( const char *input, struct objclass **oc, char *errorbuf,
   ** ocname-oid
   */
   if ( strcasecmp ( pOcOid, "NAME" ) == 0 ) {
-	free( pOcOid );
-	pOcOid = slapi_ch_malloc( 8 + strlen(psbOcName->buffer));
-	sprintf(pOcOid, "%s-oid", psbOcName->buffer );
+	slapi_ch_free_string( &pOcOid );
+	pOcOid = slapi_ch_smprintf("%s-oid", psbOcName->buffer );
   }
 
   if ( schema_ds4x_compat ) nextinput = input;
@@ -3194,9 +3193,8 @@ read_at_ldif(const char *input, struct asyntaxinfo **asipp, char *errorbuf,
 	 * attrname-oid 
 	 */ 
 	if ( strcasecmp ( pOid, "NAME" ) == 0 ) { 
-		free( pOid ); 
-		pOid = slapi_ch_malloc( 8 + strlen(first_attr_name)); 
-		sprintf(pOid, "%s-oid", first_attr_name ); 
+		slapi_ch_free_string( &pOid ); 
+		pOid = slapi_ch_smprintf("%s-oid", first_attr_name ); 
 	} 
 
 	/* look for the optional DESCription */
@@ -3645,8 +3643,7 @@ schema_check_oid( const char *name, const char *oid, PRBool isAttribute,
   }
   
   /* check to see if the OID is <name>-oid */
-  namePlusOid = (char *) slapi_ch_malloc( strlen(name) + 256);
-  sprintf(namePlusOid, "%s-oid", name );
+  namePlusOid = slapi_ch_smprintf("%s-oid", name );
   rc = strcasecmp( oid, namePlusOid );
   slapi_ch_free( (void **) &namePlusOid );
 
@@ -3974,9 +3971,7 @@ init_schema_dse(const char *configdir)
 
 	slapi_sdn_init_dn_byref(&schema,"cn=schema");
 
-	schemadir = slapi_ch_calloc(1, strlen(configdir)
-					+ strlen(SCHEMA_SUBDIR_NAME) + 5);
-	sprintf(schemadir, "%s/%s", configdir, SCHEMA_SUBDIR_NAME);
+	schemadir = slapi_ch_smprintf("%s/%s", configdir, SCHEMA_SUBDIR_NAME);
 
 	filelist = get_priority_filelist(schemadir, ".*ldif$");
 	if (!filelist || !*filelist)
@@ -3992,8 +3987,7 @@ init_schema_dse(const char *configdir)
 		int ii = 0;
 		while (filelist[ii]) ++ii;
 		userschemafile = filelist[ii-1];
-		userschematmpfile = slapi_ch_calloc(1, strlen(userschemafile) + 5);
-		sprintf(userschematmpfile, "%s.tmp", userschemafile);
+		userschematmpfile = slapi_ch_smprintf("%s.tmp", userschemafile);
 	}
 
     if(rc && (pschemadse==NULL))
@@ -4477,7 +4471,7 @@ schema_create_errormsg(
 		if ( NULL != name ) {
 			rc = PR_snprintf( errorbuf, errorbufsize, prefix, name );
 		}
-		if ( rc >= 0 ) {
+		if ( (rc >= 0) && (rc < errorbufsize) ) {
 			(void)PR_vsnprintf( errorbuf + rc, errorbufsize - rc, fmt, ap );
 		}
 		va_end( ap );
diff --git a/ldap/servers/slapd/slap.h b/ldap/servers/slapd/slap.h
index 13048aa9..8247e5ad 100644
--- a/ldap/servers/slapd/slap.h
+++ b/ldap/servers/slapd/slap.h
@@ -10,8 +10,7 @@
 
  
 /* Used by SSL and DES plugin */
-#ifndef _TOK
-#define _TOK
+#ifdef NEED_TOK_DES
 static char  tokDes[34] = "Communicator Generic Crypto Svcs";
 static char ptokDes[34] = "Internal (Software) Token        ";
 #endif
diff --git a/ldap/servers/slapd/slapi-plugin.h b/ldap/servers/slapd/slapi-plugin.h
index 968c33a3..e9e4a15a 100644
--- a/ldap/servers/slapd/slapi-plugin.h
+++ b/ldap/servers/slapd/slapi-plugin.h
@@ -817,7 +817,7 @@ void slapi_ch_free_string( char **s );
 struct berval*  slapi_ch_bvdup(const struct berval*);
 struct berval** slapi_ch_bvecdup(struct berval**);
 void slapi_ch_bvfree(struct berval** v);
-
+char * slapi_ch_smprintf(const char *fmt, ...);
 
 /*
  * syntax plugin routines
diff --git a/ldap/servers/slapd/slapi-private.h b/ldap/servers/slapd/slapi-private.h
index 4344a02a..fc956615 100644
--- a/ldap/servers/slapd/slapi-private.h
+++ b/ldap/servers/slapd/slapi-private.h
@@ -1037,6 +1037,10 @@ typedef int (*dseCallbackFn)(Slapi_PBlock *, Slapi_Entry *, Slapi_Entry *,
 #define DSE_FLAG_PREOP          0x0001
 #define DSE_FLAG_POSTOP         0x0002
 
+/* This is the size of the returntext parameter passed to the config callback function,
+   which is the "char *" argument to dseCallbackFn above */
+#define SLAPI_DSE_RETURNTEXT_SIZE 512	/* for use by callback functions */
+
 int slapi_config_register_callback(int operation, int flags, const char *base, int scope, const char *filter, dseCallbackFn fn, void *fn_arg);
 int slapi_config_remove_callback(int operation, int flags, const char *base, int scope, const char *filter, dseCallbackFn fn);
 int config_is_slapd_lite( void );
diff --git a/ldap/servers/slapd/snmp_collator.c b/ldap/servers/slapd/snmp_collator.c
index 68fe4423..3c0f5e65 100644
--- a/ldap/servers/slapd/snmp_collator.c
+++ b/ldap/servers/slapd/snmp_collator.c
@@ -234,9 +234,7 @@ char *make_ds_url(char *host, int port){
 
   char *url;
   
-   url = (char *)slapi_ch_malloc( (strlen(host) + PORT_LEN + URL_CHARS_LEN + 1) * sizeof(char));
- 
-   sprintf(url,"ldap://%s:%d/",host, port);
+   url = slapi_ch_smprintf("ldap://%s:%d/",host, port);
  
    return url;
 }
@@ -362,7 +360,7 @@ int snmp_collator_start()
 	 * Get directory for our stats file
 	 */
 
-  sprintf(szStatsFile, "%s/logs/%s", instancedir, 
+  PR_snprintf(szStatsFile, sizeof(szStatsFile), "%s/logs/%s", instancedir, 
 		  AGT_STATS_FILE);
   tmpstatsfile = szStatsFile;
 
diff --git a/ldap/servers/slapd/ssl.c b/ldap/servers/slapd/ssl.c
index 96e6be33..70ca82da 100644
--- a/ldap/servers/slapd/ssl.c
+++ b/ldap/servers/slapd/ssl.c
@@ -31,6 +31,7 @@
 #include <string.h>
 #include <errno.h>
 
+#define NEED_TOK_DES /* defines tokDes and ptokDes - see slap.h */
 #include "slap.h"
 
 #include "svrcore.h"
@@ -183,7 +184,7 @@ _conf_setciphers(char *ciphers)
           case '-':
             active = 0; break;
           default:
-			sprintf(err, "invalid ciphers <%s>: format is "
+			PR_snprintf(err, sizeof(err), "invalid ciphers <%s>: format is "
 					"+cipher1,-cipher2...", raw);
             return slapi_ch_strdup(err);
         }
@@ -200,7 +201,7 @@ _conf_setciphers(char *ciphers)
                 }
             }
             if(!_conf_ciphers[x].name) {
-                sprintf(err, "unknown cipher %s", ciphers);
+                PR_snprintf(err, sizeof(err), "unknown cipher %s", ciphers);
                 return slapi_ch_strdup(err);
             }
         }
@@ -213,73 +214,6 @@ _conf_setciphers(char *ciphers)
 /* SSL Policy stuff */
 
 /*
- * Policy table
- */
-static struct policy
-{
-  long   ciphersuite;
-  int    exportPolicy;
-} policy_table[] = {
-  { SSL_EN_RC4_128_WITH_MD5,              SSL_NOT_ALLOWED },
-  { SSL_EN_RC4_128_EXPORT40_WITH_MD5,     SSL_ALLOWED },
-  { SSL_EN_RC2_128_CBC_WITH_MD5,          SSL_NOT_ALLOWED },
-  { SSL_EN_RC2_128_CBC_EXPORT40_WITH_MD5, SSL_ALLOWED },
-  { SSL_EN_IDEA_128_CBC_WITH_MD5,         SSL_NOT_ALLOWED },
-  { SSL_EN_DES_64_CBC_WITH_MD5,           SSL_NOT_ALLOWED },
-  { SSL_EN_DES_192_EDE3_CBC_WITH_MD5,     SSL_NOT_ALLOWED },
-
-  /* SSL v3 Cipher Suites */
-  { SSL_RSA_WITH_NULL_MD5,                SSL_ALLOWED },
-#if 0
-  { SSL_RSA_WITH_NULL_SHA,                SSL_ALLOWED },
-#endif
-  { SSL_RSA_EXPORT_WITH_RC4_40_MD5,       SSL_ALLOWED },
-  { SSL_RSA_WITH_RC4_128_MD5,             SSL_RESTRICTED },
-#if 0
-  { SSL_RSA_WITH_RC4_128_SHA,             SSL_NOT_ALLOWED },
-#endif
-  { SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5,   SSL_ALLOWED },
-
-#if 0
-  { SSL_RSA_WITH_IDEA_CBC_SHA,            SSL_NOT_ALLOWED },
-  { SSL_RSA_EXPORT_WITH_DES40_CBC_SHA,    SSL_ALLOWED },
-#endif
-
-  { SSL_RSA_WITH_DES_CBC_SHA,             SSL_NOT_ALLOWED },
-  { SSL_RSA_WITH_3DES_EDE_CBC_SHA,        SSL_RESTRICTED },
-
-#if 0
-  { SSL_DH_DSS_EXPORT_WITH_DES40_CBC_SHA, SSL_ALLOWED },
-  { SSL_DH_DSS_WITH_DES_CBC_SHA,          SSL_NOT_ALLOWED },
-  { SSL_DH_DSS_WITH_3DES_EDE_CBC_SHA,     SSL_NOT_ALLOWED },
-  { SSL_DH_RSA_EXPORT_WITH_DES40_CBC_SHA, SSL_ALLOWED },
-  { SSL_DH_RSA_WITH_DES_CBC_SHA,          SSL_NOT_ALLOWED },
-  { SSL_DH_RSA_WITH_3DES_EDE_CBC_SHA,     SSL_NOT_ALLOWED },
-
-  { SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA, SSL_ALLOWED },
-  { SSL_DHE_DSS_WITH_DES_CBC_SHA,         SSL_NOT_ALLOWED },
-  { SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA,    SSL_NOT_ALLOWED },
-  { SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA, SSL_ALLOWED },
-  { SSL_DHE_RSA_WITH_DES_CBC_SHA,         SSL_NOT_ALLOWED },
-  { SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA,    SSL_NOT_ALLOWED },
-
-  { SSL_DH_ANON_EXPORT_WITH_RC4_40_MD5,   SSL_ALLOWED },
-  { SSL_DH_ANON_WITH_RC4_128_MD5,         SSL_NOT_ALLOWED },
-  { SSL_DH_ANON_EXPORT_WITH_DES40_CBC_SHA, SSL_ALLOWED },
-  { SSL_DH_ANON_WITH_DES_CBC_SHA,         SSL_NOT_ALLOWED },
-  { SSL_DH_ANON_WITH_3DES_EDE_CBC_SHA,    SSL_NOT_ALLOWED },
-#endif
-
-  { SSL_FORTEZZA_DMS_WITH_NULL_SHA,       SSL_NOT_ALLOWED },
-  { SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA, SSL_NOT_ALLOWED },
-  { SSL_FORTEZZA_DMS_WITH_RC4_128_SHA,    SSL_NOT_ALLOWED },
-
-  { SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA,   SSL_RESTRICTED },
-  { SSL_RSA_FIPS_WITH_DES_CBC_SHA,        SSL_NOT_ALLOWED },
-};
-
-
-/*
  * SSLPLCY_Install
  *
  * Call the SSL_CipherPolicySet function for each ciphersuite.
@@ -312,7 +246,7 @@ static void
 slapd_SSL_report(int degree, char *fmt, va_list args)
 {
     char buf[2048];
-    vsprintf( buf, fmt, args );
+    PR_vsnprintf( buf, sizeof(buf), fmt, args );
     LDAPDebug( LDAP_DEBUG_ANY, "SSL %s: %s\n",
 	       (degree == LOG_FAILURE) ? "failure" : "alert",
 	       buf, 0 );
@@ -336,16 +270,6 @@ slapd_SSL_warn(char *fmt, ...)
     va_end(args);
 }
 
-
-static void
-server_free_alias_dir(char *s)
-{
-  void *mem = s;
-
-  slapi_ch_free(&mem);
-}
-
-
 /**
  * Get a particular entry
  */
@@ -533,7 +457,7 @@ slapd_nss_init(int init_ssl, int config_available)
 						   (keyfn ? "found" : "not found"),
 						   (certfn ? "found" : "not found"));
 		}
-		sprintf(certPref, "%s-", val);
+		PR_snprintf(certPref, sizeof(certPref), "%s-", val);
 		strcpy(keyPref, certPref);
 		strcpy(val, "alias/");
 	}
@@ -875,7 +799,7 @@ int slapd_ssl_init2(PRFileDesc **fd, int startTLS)
                     strcpy(cert_name, personality);
                 else
                     /* external PKCS #11 token - attach token name */
-                    sprintf(cert_name, "%s:%s", token, personality);
+                    PR_snprintf(cert_name, sizeof(cert_name), "%s:%s", token, personality);
             }
             else {
                 errorCode = PR_GetError();
@@ -1210,7 +1134,7 @@ slapd_SSL_client_auth (LDAP* ld)
 						/* external PKCS #11 token - attach token name */
 						/*ssltoken was already dupped and we don't need it anymore*/
 						token = ssltoken;
-						sprintf(cert_name, "%s:%s", token, personality);
+						PR_snprintf(cert_name, sizeof(cert_name), "%s:%s", token, personality);
 			  }
  			} else {
 			  errorCode = PR_GetError(); 
@@ -1236,7 +1160,7 @@ slapd_SSL_client_auth (LDAP* ld)
 				token = ssltoken; /*ssltoken was already dupped and we don't need it anymore*/
 
 				/* external PKCS #11 token - attach token name */
-				sprintf(cert_name, "%s:%s", token, personality);
+				PR_snprintf(cert_name, sizeof(cert_name), "%s:%s", token, personality);
 			} else {
 			  errorCode = PR_GetError();
 			  slapd_SSL_warn("Security Initialization: Failed to get cipher "
@@ -1459,7 +1383,7 @@ char* slapd_get_tmp_dir()
 #endif
 	}
 
-	sprintf(tmp,"%s/tmp",instanceDir);
+	PR_snprintf(tmp,sizeof(tmp),"%s/tmp",instanceDir);
 
 #if defined( XP_WIN32 )
 	for(ilen=0;ilen < strlen(tmp); ilen++)
diff --git a/ldap/servers/slapd/start_tls_extop.c b/ldap/servers/slapd/start_tls_extop.c
index 915ad1b0..9f65ff2a 100644
--- a/ldap/servers/slapd/start_tls_extop.c
+++ b/ldap/servers/slapd/start_tls_extop.c
@@ -47,7 +47,10 @@ start_tls( Slapi_PBlock *pb )
 	Connection      *conn;
 	PRFileDesc      *oldsocket, *newsocket;
 	int             secure;
-	int             ns, oldnativesocket;
+	int             ns;
+#ifdef _WIN32
+	int				oldnativesocket;
+#endif
 	int             rv;
 
 	/* Get the pb ready for sending Start TLS Extended Responses back to the client. 
diff --git a/ldap/servers/slapd/task.c b/ldap/servers/slapd/task.c
index e1e6f1af..20e42b95 100644
--- a/ldap/servers/slapd/task.c
+++ b/ldap/servers/slapd/task.c
@@ -1256,10 +1256,9 @@ static int task_index_add(Slapi_PBlock *pb, Slapi_Entry *e,
     	for (idx = slapi_attr_first_value(attr, &val);
              idx >= 0; idx = slapi_attr_next_value(attr, idx, &val)) {
             const char *indexname = slapi_value_get_string(val);
-            char *index = (char *)slapi_ch_malloc(strlen(indexname) + 2);
+            char *index = slapi_ch_smprintf("t%s", indexname);
 
             if (index != NULL) {
-                sprintf(index, "t%s", indexname);
                 charray_add(&indexlist, index);
             }
     	}
@@ -1270,10 +1269,9 @@ static int task_index_add(Slapi_PBlock *pb, Slapi_Entry *e,
     	for (idx = slapi_attr_first_value(attr, &val);
              idx >= 0; idx = slapi_attr_next_value(attr, idx, &val)) {
             const char *indexname = slapi_value_get_string(val);
-            char *index = (char *)slapi_ch_malloc(strlen(indexname) + 2);
+            char *index = slapi_ch_smprintf("T%s", indexname);
 
             if (index != NULL) {
-                sprintf(index, "T%s", indexname);
                 charray_add(&indexlist, index);
             }
     	}
@@ -1347,7 +1345,6 @@ task_upgradedb_add(Slapi_PBlock *pb, Slapi_Entry *e, Slapi_Entry *eAfter,
     Slapi_Backend *be = NULL;
     Slapi_Task *task = NULL;
     Slapi_PBlock mypb;
-    PRThread *thread = NULL;
     const char *archive_dir = NULL;
     const char *force = NULL;
     const char *database_type = "ldbm database";
@@ -1587,11 +1584,10 @@ int slapi_task_register_handler(const char *name, dseCallbackFn func)
     int ret = -1;
     int x;
 
-    dn = slapi_ch_malloc(strlen(name) + strlen(TASK_BASE_DN) + 20);
+    dn = slapi_ch_smprintf("cn=%s, %s", name, TASK_BASE_DN);
     if (dn == NULL) {
         goto out;
     }
-    sprintf(dn, "cn=%s, %s", name, TASK_BASE_DN);
 
     pb = slapi_pblock_new();
     if (pb == NULL) {
diff --git a/ldap/servers/slapd/time.c b/ldap/servers/slapd/time.c
index a4253c3a..a008134f 100644
--- a/ldap/servers/slapd/time.c
+++ b/ldap/servers/slapd/time.c
@@ -188,8 +188,7 @@ format_localTime (time_t from)
 #else
     localtime_r (&from, &t);
 #endif
-    into = slapi_ch_malloc (15);
-    sprintf (into, "%.4li%.2i%.2i%.2i%.2i%.2i",
+    into = slapi_ch_smprintf("%.4li%.2i%.2i%.2i%.2i%.2i",
              1900L + t.tm_year, t.tm_mon + 1, t.tm_mday, t.tm_hour, t.tm_min, t.
 tm_sec);
     return into;
diff --git a/ldap/servers/slapd/tools/ldif.c b/ldap/servers/slapd/tools/ldif.c
index 98f8f6d4..29f480e9 100644
--- a/ldap/servers/slapd/tools/ldif.c
+++ b/ldap/servers/slapd/tools/ldif.c
@@ -99,7 +99,7 @@ int main( int argc, char **argv )
 			perror( "malloc" );
 		    return( 1 );
 		}
-		while ( buf = fgets(buf, maxlen, stdin) ) {
+		while ( (buf = fgets(buf, maxlen, stdin)) ) {
 			/* if buffer was filled, expand and keep reading unless last char
 			is linefeed, in which case it is OK for buffer to be full */
 			while( ((curlen = strlen(buf)) == (maxlen - 1)) && buf[curlen-1] != '\n' ) {
diff --git a/ldap/servers/slapd/tools/mmldif.c b/ldap/servers/slapd/tools/mmldif.c
index 995b7bc3..68ec793f 100644
--- a/ldap/servers/slapd/tools/mmldif.c
+++ b/ldap/servers/slapd/tools/mmldif.c
@@ -297,7 +297,6 @@ int mm_diff(stats_t *statsp)
     char        fingerprint[16];
     int stat;
     int count;
-    int firsttime = TRUE;
     int records = 0;
     int added;
     struct entryblock *block, *next;
@@ -586,7 +585,7 @@ int mm_diff(stats_t *statsp)
 
 static void usage(char *m)
 {
-    fprintf(stderr,"usage: mmldif [-c] [-D] [-o out.ldif] in1.ldif in2.ldif ...\n\n", m);
+    fprintf(stderr,"usage: %s [-c] [-D] [-o out.ldif] in1.ldif in2.ldif ...\n\n", m);
     fprintf(stderr,"-c\tWrite a change file (.delta) for each input file\n");
     fprintf(stderr,"-D\tPrint debugging information\n");
     fprintf(stderr,"-o\tWrite authoritative data to this file\n");
@@ -1217,7 +1216,6 @@ putvalue(
     int	len;
     char *	sptr;
     int	rc;
-    int	simpletxt = TRUE;
 
     lptr = line;
     if (tag != NULL) {
@@ -1314,7 +1312,7 @@ signedmemcmp(unsigned char * a, int lena, unsigned char * b, int lenb)
             return lena;
         if (!lena)
             return -1;
-        if (c=(int)*a - (int)*b)
+        if ((c=(int)*a - (int)*b))
             return c;
         lena--;
         lenb--;
@@ -1436,17 +1434,17 @@ int main(int argc, char *argv[])
 
     memset(&stats, 0, sizeof(stats));
 
-    if (rc = mm_init(argc, argv))
+    if ((rc = mm_init(argc, argv)))
         return rc;
 
     if ((mm_diff(&stats) == IDDS_MM_OK)
 	&&  (license_limit > 0)) {
         if (license_count > license_limit * 98.0 / 100)
-            fprintf(stderr, "That was over 98% of your license limit.\n");
+            fprintf(stderr, "That was over 98%% of your license limit.\n");
         else if (license_count > license_limit * 95.0 / 100)
-            fprintf(stderr, "That was over 95% of your license limit.\n");
+            fprintf(stderr, "That was over 95%% of your license limit.\n");
         else if (license_count > license_limit * 90.0 / 100)
-            fprintf(stderr, "That was over 90% of your license limit.\n");
+            fprintf(stderr, "That was over 90%% of your license limit.\n");
     }
     mm_fin_winner();
     printf("start time %s", ctime(&stats.diff_start_time));
diff --git a/ldap/servers/slapd/tools/pwenc.c b/ldap/servers/slapd/tools/pwenc.c
index 80affdcb..bb5df4c5 100644
--- a/ldap/servers/slapd/tools/pwenc.c
+++ b/ldap/servers/slapd/tools/pwenc.c
@@ -247,7 +247,7 @@ slapd_config(const char *configdir)
 	char *lastp = 0;
 	char *entrystr = 0;
 
-	sprintf(configfile, "%s/%s", configdir, CONFIG_FILENAME);
+	PR_snprintf(configfile, sizeof(configfile), "%s/%s", configdir, CONFIG_FILENAME);
 	if ( (rc = PR_GetFileInfo( configfile, &prfinfo )) != PR_SUCCESS )
 	{
 		fprintf(stderr,
diff --git a/ldap/servers/slapd/util.c b/ldap/servers/slapd/util.c
index 767441cc..7d8fa0b4 100644
--- a/ldap/servers/slapd/util.c
+++ b/ldap/servers/slapd/util.c
@@ -77,7 +77,7 @@ do_escape_string (
 
     last = str + len - 1;
     for (s = str; s <= last; ++s) {
-	if ( esc = (*special)((unsigned char)*s)) {
+	if ( (esc = (*special)((unsigned char)*s))) {
 	    const char* first = str;
 	    char* bufNext = buf;
 	    int bufSpace = BUFSIZ - 4;
@@ -445,7 +445,7 @@ void slapd_nasty(char* str, int c, int err)
 {
 	char *msg = NULL;
 	char buffer[100];
-	sprintf(buffer,"%s BAD %d",str,c);
+	PR_snprintf(buffer,sizeof(buffer), "%s BAD %d",str,c);
 	LDAPDebug(LDAP_DEBUG_ANY,"%s, err=%d %s\n",buffer,err,(msg = strerror( err )) ? msg : "");
 }
 
diff --git a/ldap/servers/slapd/uuid.c b/ldap/servers/slapd/uuid.c
index f490fbae..317b745c 100644
--- a/ldap/servers/slapd/uuid.c
+++ b/ldap/servers/slapd/uuid.c
@@ -441,14 +441,13 @@ static int read_state_from_file (const char *configDir)
 	}
 	else 
 	{
-		path = (char*)slapi_ch_malloc(strlen(configDir) + strlen(STATE_FILE) + 2);
+		path = slapi_ch_smprintf("%s/%s", configDir, STATE_FILE);    
 		if (path == NULL)
 		{
 			slapi_log_error (SLAPI_LOG_FATAL, MODULE, "read_state: "
 							"memory allocation failed.\n");
 			return (UUID_MEMORY_ERROR);
 		}
-		sprintf (path, "%s/%s", configDir, STATE_FILE);    
 	}
 
 	/* open or create state file for read/write and keep it in sync */
diff --git a/ldap/servers/slapd/vattr.c b/ldap/servers/slapd/vattr.c
index 26bdd61f..37ee814c 100644
--- a/ldap/servers/slapd/vattr.c
+++ b/ldap/servers/slapd/vattr.c
@@ -380,7 +380,6 @@ int vattr_test_filter( /* Entry we're interested in */ Slapi_Entry *e,
 
 	if (list) {
 		vattr_sp_handle *current_handle = NULL;
-		Slapi_Attr *cache_attr = NULL;
 		/* first lets consult the cache to save work */
 		int cache_status;
 					
@@ -618,8 +617,6 @@ slapi_vattr_values_get_sp(vattr_context *c,
 		if (list) {
 			vattr_sp_handle *current_handle = NULL;
 			void *hint = NULL;
-			Slapi_Attr* cache_attr = 0;
-			char *vattr_type = NULL;
 			/* first lets consult the cache to save work */
 			int cache_status;
 						
@@ -814,8 +811,6 @@ int slapi_vattr_namespace_values_get_sp(vattr_context *c,
 		if (list) {
 			vattr_sp_handle *current_handle = NULL;
 			void *hint = NULL;
-			Slapi_Attr* cache_attr = 0;
-			char *vattr_type=NULL;
 			/* first lets consult the cache to save work */
 			int cache_status;
 			
@@ -1947,7 +1942,6 @@ objAttrValue *vattr_map_entry_build_schema(char *type_name)
 {
 	objAttrValue *ret = 0;
 	struct objclass	*oc;
-	int attr_index = 0;
 
 	LDAPDebug( LDAP_DEBUG_TRACE, "--> vattr_map_entry_build_schema\n",0,0,0);
 
diff --git a/ldap/systools/idsktune.c b/ldap/systools/idsktune.c
index 65123600..cac3d5fe 100644
--- a/ldap/systools/idsktune.c
+++ b/ldap/systools/idsktune.c
@@ -80,6 +80,7 @@ extern char *optarg;
 #include <sys/time.h>
 #include <sys/param.h>
 #include <mntent.h>
+#include <sys/sysinfo.h>
 
 #define IDDS_MNTENT mntent
 #define IDDS_MNTENT_DIRNAME mnt_dir
diff --git a/ldap/systools/pio.c b/ldap/systools/pio.c
index 527570eb..bb90750a 100644
--- a/ldap/systools/pio.c
+++ b/ldap/systools/pio.c
@@ -69,7 +69,6 @@ int iii_pio_getnum (
 {
   FILE *fp;
   char buf[8192];
-  int rc = 0;
   
   fp = popen(cmd,"r");
   
diff --git a/lib/base/shexp.cpp b/lib/base/shexp.cpp
index dd7990a6..9db37ac6 100644
--- a/lib/base/shexp.cpp
+++ b/lib/base/shexp.cpp
@@ -23,7 +23,7 @@
 int valid_subexp(char *exp, char stop) 
 {
     register int x,y,t;
-    int nsc,np,tld;
+    int nsc,tld;
 
     x=0;nsc=0;tld=0;
 
diff --git a/lib/base/system.cpp b/lib/base/system.cpp
index c15c2f58..556d94a4 100644
--- a/lib/base/system.cpp
+++ b/lib/base/system.cpp
@@ -171,7 +171,6 @@ NSAPI_PUBLIC void *system_realloc_perm(void *ptr, int size)
     return realloc(ptr, size);
 #else
     int *magic, *length;
-    char *baseptr;
     char *cptr;
 
     cptr = (char *)ptr - DEBUG_MARGIN - 2 * sizeof(int);
diff --git a/lib/ldaputil/certmap.c b/lib/ldaputil/certmap.c
index 88f970ac..ade67b33 100644
--- a/lib/ldaputil/certmap.c
+++ b/lib/ldaputil/certmap.c
@@ -132,6 +132,7 @@ static long certmap_name_to_bit_pos (const char *str)
     return CERTMAP_BIT_POS_UNKNOWN;
 }
 
+#if 0 /* may need this in the future */
 static int certmap_name_to_secoid (const char *str)
 {
     if (!ldapu_strcasecmp(str, "c")) return SEC_OID_AVA_COUNTRY_NAME;
@@ -147,6 +148,7 @@ static int certmap_name_to_secoid (const char *str)
 
     return SEC_OID_AVA_UNKNOWN;	/* return invalid OID */
 }
+#endif
 
 NSAPI_PUBLIC int ldapu_list_alloc (LDAPUList_t **list)
 {
@@ -874,7 +876,7 @@ static int ldapu_cert_searchfn_default (void *cert, LDAP *ld,
 	if (rv != LDAPU_SUCCESS || !subjectDN || !*subjectDN) return rv;
 	len = strlen(certmap_info->searchAttr) + strlen(subjectDN) +
 	    strlen("=") + 1;
-	certFilter = (char *)malloc(len * sizeof(char));
+	certFilter = (char *)ldapu_malloc(len * sizeof(char));
 	if (!certFilter) return LDAPU_ERR_OUT_OF_MEMORY;
 	sprintf(certFilter, "%s=%s", certmap_info->searchAttr, subjectDN);
 	free(subjectDN);
@@ -1354,6 +1356,7 @@ NSAPI_PUBLIC CertVerifyFn_t ldapu_get_cert_verifyfn (const char *issuerDN)
     return ldapu_get_cert_verifyfn_sub(certmap_info);
 }
 
+#if 0 /* may need this in the future */
 static int ldapu_certinfo_copy (const LDAPUCertMapInfo_t *from,
 				const char *newIssuerName,
 				const char *newIssuerDN,
@@ -1374,6 +1377,7 @@ static int ldapu_certinfo_copy (const LDAPUCertMapInfo_t *from,
 
     return process_certinfo(to);
 }
+#endif
 
 NSAPI_PUBLIC int ldapu_cert_to_ldap_entry (void *cert, LDAP *ld,
 					   const char *basedn,
@@ -1387,7 +1391,6 @@ NSAPI_PUBLIC int ldapu_cert_to_ldap_entry (void *cert, LDAP *ld,
     CertMapFn_t mapfn;
     CertVerifyFn_t verifyfn;
     CertSearchFn_t searchfn;
-    void *entry_cert = 0;
     int rv,i,j;
 
     *res = 0;
diff --git a/lib/ldaputil/dbconf.c b/lib/ldaputil/dbconf.c
index 5832b863..ff1d8652 100644
--- a/lib/ldaputil/dbconf.c
+++ b/lib/ldaputil/dbconf.c
@@ -342,7 +342,6 @@ static int read_db_info (FILE *fp, char *buf, DBConfDBInfo_t **db_info_out,
 			 int *eof)
 {
     char *ptr;
-    int found_directive = 0;
     DBConfDBInfo_t *db_info;
     int rv;
 
@@ -489,44 +488,13 @@ NSAPI_PUBLIC int dbconf_read_default_dbinfo (const char *file,
 }
 
 /*
- * ldapu_strncasecmp - is like strncasecmp on UNIX but also accepts null strings.
- */
-/* Not tested */
-static int ldapu_strncasecmp (const char *s1, const char *s2, size_t len)
-{
-    int ls1, ls2;		/* tolower values of chars in s1 & s2 resp. */
-
-    if (0 == len) return 0;
-    else if (!s1) return !s2 ? 0 : 0-tolower(*s2);
-    else if (!s2) return tolower(*s1);
-
-#ifdef XP_WIN32
-    while(len > 0 && *s1 && *s2 &&
-	  (ls1 = tolower(*s1)) == (ls2 = tolower(*s2)))
-    {
-	s1++; s2++; len--;
-    }
-
-    if (0 == len)
-	return 0;
-    else if (!*s1)
-	return *s2 ? 0-tolower(*s2) : 0;
-    else if (!*s2)
-	return tolower(*s1);
-    else
-	return ls1 - ls2;
-#else
-    return strncasecmp(s1, s2, len);
-#endif
-}
-
-
-/*
  * ldapu_strcasecmp - is like strcasecmp on UNIX but also accepts null strings.
  */
 int ldapu_strcasecmp (const char *s1, const char *s2)
 {
+#ifdef XP_WIN32
     int ls1, ls2;		/* tolower values of chars in s1 & s2 resp. */
+#endif
 
     if (!s1) return !s2 ? 0 : 0-tolower(*s2);
     else if (!s2) return tolower(*s1);
diff --git a/lib/ldaputil/init.c b/lib/ldaputil/init.c
index 4d565982..fb6aaa6b 100644
--- a/lib/ldaputil/init.c
+++ b/lib/ldaputil/init.c
@@ -44,7 +44,7 @@ static int load_server_libs (const char *dir)
 	/* Dir exists */
         while( (d = PR_ReadDir(ds, PR_SKIP_BOTH)) )  {
 	    PRLibrary *lib = 0;
-            char *libname = d->name;
+		const char *libname = d->name;
 	    int len = strlen(libname);
 	    int is_lib;
 
diff --git a/lib/ldaputil/ldapauth.c b/lib/ldaputil/ldapauth.c
index 802184fb..f915d310 100644
--- a/lib/ldaputil/ldapauth.c
+++ b/lib/ldaputil/ldapauth.c
@@ -1017,7 +1017,6 @@ int ldapu_auth_uid_attrfilter (LDAP *ld, const char *uid, const char *attrfilter
  */
 int ldapu_auth_userdn_password (LDAP *ld, const char *userdn, const char *password)
 {
-    LDAPMessage *res = 0;
     int retval;
 
     DBG_PRINT2("\tuserdn:\t\"%s\"\n", userdn);
diff --git a/lib/libaccess/acl.tab.cpp b/lib/libaccess/acl.tab.cpp
index f8eae8f2..0e499fa0 100644
--- a/lib/libaccess/acl.tab.cpp
+++ b/lib/libaccess/acl.tab.cpp
@@ -99,38 +99,6 @@ acl_set_args(ACLExprHandle_t *expr, char **args_list)
 }
 
 static int
-acl_set_users(ACLExprHandle_t *expr, char **user_list)
-{
-	int ii;
-	int jj;
-
-	if (expr == NULL)
-		return(-1);
-
-	for (ii = 0; ii < MAX_LIST_SIZE; ii++) {
-		if ( user_list[ii] ) {
-			if ( ACL_ExprTerm(NULL, expr, "user", CMP_OP_EQ, 
-					user_list[ii]) < 0 ) {
-				aclerror("ACL_ExprTerm() failed");
-				acl_free_args(user_list);
-				return(-1);
-			}
-		} else
-			break;
-	}
-
-	acl_free_args(user_list);
-
-	for (jj = 0; jj < ii - 1; jj++) {
-		if ( ACL_ExprOr(NULL, expr)  < 0 ) {
-			aclerror("ACL_ExprOr() failed");
-			return(-1);
-		}
-	}
-	return(0);
-}
-
-static int
 acl_set_users_or_groups(ACLExprHandle_t *expr, char **user_list)
 {
 	int ii;
@@ -1261,7 +1229,7 @@ case 24:
 			aclerror("Could not set authorization processing flags");
 			return(-1);
 		}
-                curr_auth_info = PListCreate(NULL, ACL_ATTR_INDEX_MAX, NULL, NULL);
+                curr_auth_info = PListCreate(NULL, ACL_ATTR_INDEX_MAX, 0, 0);
 		if ( ACL_ExprAddAuthInfo(curr_expr, curr_auth_info) < 0 ) {
 			aclerror("Could not set authorization info");
 			return(-1);
@@ -1275,7 +1243,7 @@ case 26:
 			aclerror("ACL_ExprNew(auth) failed");
 			return(-1);
 		}
-                curr_auth_info = PListCreate(NULL, ACL_ATTR_INDEX_MAX, NULL, NULL);
+                curr_auth_info = PListCreate(NULL, ACL_ATTR_INDEX_MAX, 0, 0);
 		if ( ACL_ExprAddAuthInfo(curr_expr, curr_auth_info) < 0 ) {
 			aclerror("Could not set authorization info");
 			return(-1);
@@ -1475,7 +1443,7 @@ case 68:
 			aclerror("ACL_ExprNew(allow) failed");
 			return(-1);
 		}
-                curr_auth_info = PListCreate(NULL, ACL_ATTR_INDEX_MAX, NULL, NULL);
+                curr_auth_info = PListCreate(NULL, ACL_ATTR_INDEX_MAX, 0, 0);
 		if ( ACL_ExprAddAuthInfo(curr_expr, curr_auth_info) < 0 ) {
 			aclerror("Could not set authorization info");
 			return(-1);
diff --git a/lib/libaccess/aclcache.cpp b/lib/libaccess/aclcache.cpp
index 37f4b0ea..1cac6388 100644
--- a/lib/libaccess/aclcache.cpp
+++ b/lib/libaccess/aclcache.cpp
@@ -150,8 +150,6 @@ ACL_ListHashUpdate(ACLListHandle_t **acllistp)
 NSAPI_PUBLIC void
 ACL_ListHashEnter(ACLListHandle_t **acllistp)
 {
-    NSErr_t *errp = 0;
-
     ACL_CritEnter();
 
     /*  Look for a matching ACL List and use it if we find one.  */
diff --git a/lib/libaccess/acltext.y b/lib/libaccess/acltext.y
index 864f70e6..1dfe6ec7 100644
--- a/lib/libaccess/acltext.y
+++ b/lib/libaccess/acltext.y
@@ -104,38 +104,6 @@ acl_set_args(ACLExprHandle_t *expr, char **args_list)
 }
 
 static int
-acl_set_users(ACLExprHandle_t *expr, char **user_list)
-{
-	int ii;
-	int jj;
-
-	if (expr == NULL)
-		return(-1);
-
-	for (ii = 0; ii < MAX_LIST_SIZE; ii++) {
-		if ( user_list[ii] ) {
-			if ( ACL_ExprTerm(NULL, expr, "user", CMP_OP_EQ, 
-					user_list[ii]) < 0 ) {
-				yyerror("ACL_ExprTerm() failed");
-				acl_free_args(user_list);
-				return(-1);
-			}
-		} else
-			break;
-	}
-
-	acl_free_args(user_list);
-
-	for (jj = 0; jj < ii - 1; jj++) {
-		if ( ACL_ExprOr(NULL, expr)  < 0 ) {
-			yyerror("ACL_ExprOr() failed");
-			return(-1);
-		}
-	}
-	return(0);
-}
-
-static int
 acl_set_users_or_groups(ACLExprHandle_t *expr, char **user_list)
 {
 	int ii;
@@ -424,7 +392,7 @@ auth_method_v2:
 			yyerror("Could not set authorization processing flags");
 			return(-1);
 		}
-                curr_auth_info = PListCreate(NULL, ACL_ATTR_INDEX_MAX, NULL, NULL);
+                curr_auth_info = PListCreate(NULL, ACL_ATTR_INDEX_MAX, 0, 0);
 		if ( ACL_ExprAddAuthInfo(curr_expr, curr_auth_info) < 0 ) {
 			yyerror("Could not set authorization info");
 			return(-1);
@@ -438,7 +406,7 @@ auth_method_v2:
 			yyerror("ACL_ExprNew(auth) failed");
 			return(-1);
 		}
-                curr_auth_info = PListCreate(NULL, ACL_ATTR_INDEX_MAX, NULL, NULL);
+                curr_auth_info = PListCreate(NULL, ACL_ATTR_INDEX_MAX, 0, 0);
 		if ( ACL_ExprAddAuthInfo(curr_expr, curr_auth_info) < 0 ) {
 			yyerror("Could not set authorization info");
 			return(-1);
@@ -696,7 +664,7 @@ authenticate_statement: ACL_AUTHENTICATE_TOK
 			yyerror("ACL_ExprNew(allow) failed");
 			return(-1);
 		}
-                curr_auth_info = PListCreate(NULL, ACL_ATTR_INDEX_MAX, NULL, NULL);
+                curr_auth_info = PListCreate(NULL, ACL_ATTR_INDEX_MAX, 0, 0);
 		if ( ACL_ExprAddAuthInfo(curr_expr, curr_auth_info) < 0 ) {
 			yyerror("Could not set authorization info");
 			return(-1);
diff --git a/lib/libaccess/acltools.cpp b/lib/libaccess/acltools.cpp
index 5f7b00ac..907cd52a 100644
--- a/lib/libaccess/acltools.cpp
+++ b/lib/libaccess/acltools.cpp
@@ -3434,7 +3434,7 @@ ACL_InitAttr2Index(void)
 
     ACLAttr2IndexPList = PListNew(NULL);
     for (i = 1; i < ACL_ATTR_INDEX_MAX; i++) {
-        PListInitProp(ACLAttr2IndexPList, NULL, ACLAttrTable[i], (const void *)i, NULL);
+        PListInitProp(ACLAttr2IndexPList, 0, ACLAttrTable[i], (const void *)i, NULL);
     }
  
     return 0;
diff --git a/lib/libaccess/lasdns.cpp b/lib/libaccess/lasdns.cpp
index b5c37a12..0340a51f 100644
--- a/lib/libaccess/lasdns.cpp
+++ b/lib/libaccess/lasdns.cpp
@@ -259,7 +259,7 @@ LASDnsBuild(NSErr_t *errp, char *attr_pattern, LASDnsContext_t *context, int ali
 
     } while ((attr_pattern != NULL) && 
 	     (attr_pattern[0] != '\0') && 
-	     (delimiter != (int)NULL));
+	     (delimiter != 0));
 
     return 0;
 }
diff --git a/lib/libaccess/lasip.cpp b/lib/libaccess/lasip.cpp
index 9b1a9127..51d2bd58 100644
--- a/lib/libaccess/lasip.cpp
+++ b/lib/libaccess/lasip.cpp
@@ -146,7 +146,7 @@ dotdecimal(char *ipstr, char *netmaskstr, int *ip, int *netmask)
         }
     }
 
-    return (int)NULL;
+    return 0;
 }
 
 
@@ -262,12 +262,12 @@ LASIpBuild(NSErr_t *errp, char *attr_name, CmpOp_t comparator, char *attr_patter
                 return (retcode);
         }
 
-        if (LASIpAddPattern(errp, netmask, ip, treetop) != (int)NULL)
+        if (LASIpAddPattern(errp, netmask, ip, treetop) != 0)
             return LAS_EVAL_INVALID;
 
-    } while ((curptr != NULL) && (delimiter != (int)NULL));
+    } while ((curptr != NULL) && (delimiter != 0));
 
-    return (int)NULL;
+    return 0;
 }
 
 
diff --git a/lib/libaccess/ldapacl.cpp b/lib/libaccess/ldapacl.cpp
index 6f37c3e2..04582503 100644
--- a/lib/libaccess/ldapacl.cpp
+++ b/lib/libaccess/ldapacl.cpp
@@ -401,7 +401,6 @@ int acl_map_cert_to_user (NSErr_t *errp, const char *dbname,
 	/* LDAPU_REQ will reconnect & retry once if LDAP server went down */
 	/* it sets the variable rv */
 	if (rv == LDAPU_SUCCESS) {
-	    char *dn = 0;
 
 	    LDAPU_REQ(rv, ldb, ldapu_cert_to_user(cert, ldb->ld, ldb->basedn,
 						  &res, &uid));
@@ -726,7 +725,6 @@ NSAPI_PUBLIC int acl_user_exists (const char *user, const char *userdn,
     PList_t resource = 0;
     PList_t auth_info = 0;
     PList_t global_auth = NULL;
-    char *olddn = 0;
     int rv;
 
     /* Check if the userdn is available in the usr_cache */
@@ -748,9 +746,9 @@ NSAPI_PUBLIC int acl_user_exists (const char *user, const char *userdn,
     }
 
     pool = pool_create();
-    subject = PListCreate(pool, ACL_ATTR_INDEX_MAX, NULL, NULL);
-    resource = PListCreate(pool, ACL_ATTR_INDEX_MAX, NULL, NULL);
-    auth_info = PListCreate(pool, ACL_ATTR_INDEX_MAX, NULL, NULL);
+    subject = PListCreate(pool, ACL_ATTR_INDEX_MAX, 0, 0);
+    resource = PListCreate(pool, ACL_ATTR_INDEX_MAX, 0, 0);
+    auth_info = PListCreate(pool, ACL_ATTR_INDEX_MAX, 0, 0);
  
     if (!pool || !subject || !resource || !auth_info) {
 	/* ran out of memory */
diff --git a/lib/libaccess/oneeval.cpp b/lib/libaccess/oneeval.cpp
index f14b971f..9b99c996 100644
--- a/lib/libaccess/oneeval.cpp
+++ b/lib/libaccess/oneeval.cpp
@@ -35,8 +35,6 @@
 #include "oneeval.h"
 #include "permhash.h"
 
-static int acl_default_result = ACL_RES_DENY;
-
 static ACLDispatchVector_t __nsacl_vector = {
 
     /* Error frame stack support */
@@ -470,10 +468,10 @@ ACLEvalBuildContext(
 		    if (PListFindValue(absauthplist, *argp, NULL, NULL) < 0)
 		    {
 			/*  Save pointer to the property list  */
-			PListInitProp(curauthplist, NULL, *argp, ace->expr_auth,
+			PListInitProp(curauthplist, 0, *argp, ace->expr_auth,
 				      ace->expr_auth);
                         if (IS_ABSOLUTE(ace->expr_flags))
-			    PListInitProp(absauthplist, NULL, *argp, NULL,
+			    PListInitProp(absauthplist, 0, *argp, NULL,
 			    NULL);
 		    }
 
diff --git a/lib/libaccess/usrcache.cpp b/lib/libaccess/usrcache.cpp
index 87b7afe7..dbc6624a 100644
--- a/lib/libaccess/usrcache.cpp
+++ b/lib/libaccess/usrcache.cpp
@@ -451,15 +451,6 @@ int acl_usr_cache_passwd_check (const char *uid, const char *dbname,
     return rv;
 }
 
-
-static int group_check_helper (UserCacheObj *usrobj, void *val)
-{
-    if (usrobj->group && !strcmp(usrobj->group, (char *)val))
-	return LAS_EVAL_TRUE;
-    else
-	return LAS_EVAL_FALSE;
-}
-
 int acl_usr_cache_group_check (const char *uid, const char *dbname,
 			       const char *group, const time_t time)
 {
diff --git a/lib/libadmin/Makefile b/lib/libadmin/Makefile
index 7a80d1de..d6a72db7 100644
--- a/lib/libadmin/Makefile
+++ b/lib/libadmin/Makefile
@@ -26,7 +26,7 @@ OBJS=$(addprefix $(OBJDEST)/, error.o \
                               template.o util.o \
                               authdb.o $(OSOBJS))
 
-# moved files [to libadminutil] : form_post.o strlist.o distadm.o cron_conf.o 
+# moved files [to libadminutil] : form_post.o distadm.o cron_conf.o 
 # candidate for moing: admlog.o error.o admserv.o
 # replaced files: error.o [by libadminutil/errRpt.c]
 # removed for lack of ndbm support from binary release of libdbm.... userdb.o
diff --git a/lib/libsi18n/acclanglist.c b/lib/libsi18n/acclanglist.c
index 0e9f25a8..2d24f80d 100644
--- a/lib/libsi18n/acclanglist.c
+++ b/lib/libsi18n/acclanglist.c
@@ -77,7 +77,7 @@ AcceptLangList(const char* AcceptLanguage,
     cPtr = strtok(input,",");
     while (cPtr) {
       qvalue[countLang] = 1.0f;
-      if (cPtr1 = strchr(cPtr,';')) {
+      if ((cPtr1 = strchr(cPtr,';'))) {
         sscanf(cPtr1,";q=%f",&qvalue[countLang]);
         *cPtr1 = '\0';
       }
diff --git a/lib/libsi18n/makstrdb.c b/lib/libsi18n/makstrdb.c
index 788edfa9..25fe84a9 100644
--- a/lib/libsi18n/makstrdb.c
+++ b/lib/libsi18n/makstrdb.c
@@ -125,7 +125,6 @@ XP_MakeStringProperties(void)
 {
     int j;
     char* LibraryName;
-    char* cptr;
     RESOURCE_TABLE* table;
     FILE *hresfile;
     char buffer[2000];
@@ -145,7 +144,7 @@ XP_MakeStringProperties(void)
     }
  
     j = 0;
-    while (table=allxpstr[j++].restable) {
+    while ((table=allxpstr[j++].restable)) {
         LibraryName = table->str;
         fprintf(hresfile, "\n");
         fprintf(hresfile, "#######################################\n");
diff --git a/lib/libsi18n/propset.c b/lib/libsi18n/propset.c
index 4f5ab66d..75173a7b 100644
--- a/lib/libsi18n/propset.c
+++ b/lib/libsi18n/propset.c
@@ -7,6 +7,7 @@
 #include <stdlib.h>
 #include <string.h>
 #include <sys/stat.h>
+#include <ctype.h>
 #include "i18n.h"
 
 #include "txtfile.h"
author	Rich Megginson <rmeggins@redhat.com>	2005-03-05 04:29:24 +0000
committer	Rich Megginson <rmeggins@redhat.com>	2005-03-05 04:29:24 +0000
commit	b352660e243c7b9b7d050f1c38cff1c9faf278b1 (patch)
tree	ede08019beb931c3206609ab2377a015d510bdb4
parent	f08951680ddfebc3f3df07e720ad0650fe473c0f (diff)
download	ds-b352660e243c7b9b7d050f1c38cff1c9faf278b1.tar.gz ds-b352660e243c7b9b7d050f1c38cff1c9faf278b1.tar.xz ds-b352660e243c7b9b7d050f1c38cff1c9faf278b1.zip